Release 2021.12.2

This is a cherry-pick of 157f5d1412
followed by build/CI changes so that amd64/linux FIPS compliance is
provided by new/separate binaries/artifacts/packages.

The reasoning being that FIPS compliance places excessive requirements
in the encryption algorithms used for regular users that do not care
about that. This can cause cloudflared to reject HTTPS origins that
would otherwise be accepted without FIPS checks.

This way, by having separate binaries, existing ones remain as they
were, and only FIPS-needy users will opt-in to the new FIPS binaries.

.dockerignore

@@ -1 +0,0 @@
-.git

.github/workflows/check.yaml

@@ -4,7 +4,7 @@ jobs:
   check:
     strategy:
       matrix:
-        go-version: [1.15.x]
+        go-version: [1.17.x]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
@@ -13,7 +13,7 @@ jobs:
       with:
         go-version: ${{ matrix.go-version }}
     - name: Install go-sumtype
-      run: go get github.com/BurntSushi/go-sumtype
+      run: go get github.com/sudarshan-reddy/go-sumtype
     - name: Checkout code
       uses: actions/checkout@v2
     - name: Test

.teamcity/update-homebrew.sh

@@ -46,8 +46,8 @@ git reset --hard origin/master
 URL="https://packages.argotunnel.com/dl/cloudflared-$VERSION-darwin-amd64.tgz"
 tee cloudflared.rb <<EOF
 class Cloudflared < Formula
-  desc 'Argo Tunnel'
-  homepage 'https://developers.cloudflare.com/argo-tunnel/'
+  desc 'Cloudflare Tunnel'
+  homepage 'https://developers.cloudflare.com/cloudflare-one/connections/connect-apps'
   url '$URL'
   sha256 '$SHA256'
   version '$VERSION'
@@ -62,6 +62,6 @@ git add cloudflared.rb
 git diff
 git config user.name "cloudflare-warp-bot"
 git config user.email "warp-bot@cloudflare.com"
-git commit -m "Release Argo Tunnel $VERSION"
+git commit -m "Release Cloudflare Tunnel $VERSION"
 
 git push -v origin master

CHANGES.md

@@ -1,5 +1,45 @@
 **Experimental**: This is a new format for release notes. The format and availability is subject to change.
 
+## 2021.12.1
+### Bug Fixe
+ - Fixes Github issue #530 where cloudflared 2021.12.0 could not reach origins that were HTTPS and using certain encryption methods forbidden by FIPS compliance (such as Let's Encrypt certificates). To address this fix we have temporarily reverted FIPS compliance from amd64 linux binaries that was recently introduced (or fixed actually as it was never working before).
+
+## 2021.12.0
+### New Features
+- Cloudflared binary released for amd64 linux is now FIPS compliant.
+
+### Improvements
+- Logging about connectivity to Cloudflare edge now only yields `ERR` level logging if there are no connections to
+Cloudflare edge that are active. Otherwise it logs `WARN` level.
+ 
+### Bug Fixes
+- Fixes Github issue #501.
+
+## 2021.11.0
+### Improvements
+- Fallback from `protocol:quic` to `protocol:http2` immediately if UDP connectivity isn't available. This could be because of a firewall or 
+egress rule.
+
+## 2021.10.4
+### Improvements
+- Collect quic transport metrics on RTT, packets and bytes transferred.
+
+### Bug Fixes
+- Fix race condition that was writing to the connection after the http2 handler returns.
+
+## 2021.9.2
+
+### New features
+- `cloudflared` can now run with `quic` as the underlying tunnel transport protocol. To try it, change or add "protocol: quic" to your config.yml file or
+run cloudflared with the `--protocol quic` flag. e.g:
+    `cloudflared tunnel --protocol quic run <tunnel-name>`
+
+### Bug Fixes
+- Fixed some generic transport bugs in `quic` mode. It's advised to upgrade to at least this version (2021.9.2) when running `cloudflared`
+with `quic` protocol.
+- `cloudflared` docker images will now show version.
+
+
 ## 2021.8.4
 ### Improvements
 - Temporary tunnels (those hosted on trycloudflare.com that do not require a Cloudflare login) now run as Named Tunnels

Dockerfile

@@ -1,7 +1,7 @@
 # use a builder image for building cloudflare
 ARG TARGET_GOOS
 ARG TARGET_GOARCH
-FROM golang:1.16.4 as builder
+FROM golang:1.17.1 as builder
 ENV GO111MODULE=on \
     CGO_ENABLED=0 \
     TARGET_GOOS=${TARGET_GOOS} \

Makefile

@@ -1,25 +1,36 @@
-VERSION       := $(shell git describe --tags --always --dirty="-dev" --match "[0-9][0-9][0-9][0-9].*.*")
+VERSION       := $(shell git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 MSI_VERSION   := $(shell git tag -l --sort=v:refname | grep "w" | tail -1 | cut -c2-)
 #MSI_VERSION expects the format of the tag to be: (wX.X.X). Starts with the w character to not break cfsetup.
 #e.g. w3.0.1 or w4.2.10. It trims off the w character when creating the MSI.
 
 ifeq ($(FIPS), true)
-	GO_BUILD_TAGS := $(GO_BUILD_TAGS) fips
-endif
-
-ifneq ($(GO_BUILD_TAGS),)
-	GO_BUILD_TAGS := -tags $(GO_BUILD_TAGS)
+	BINARY_NAME := cloudflared-fips
+else
+	BINARY_NAME := cloudflared
 endif
 
 ifeq ($(NIGHTLY), true)
+	# We do not release FIPS in NIGHTLY, so no need to consider that case here.
 	DEB_PACKAGE_NAME := cloudflared-nightly
 	NIGHTLY_FLAGS := --conflicts cloudflared --replaces cloudflared
 else
-	DEB_PACKAGE_NAME := cloudflared
+	DEB_PACKAGE_NAME := $(BINARY_NAME)
 endif
 
 DATE          := $(shell date -u '+%Y-%m-%d-%H%M UTC')
-VERSION_FLAGS := -ldflags='-X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"'
+VERSION_FLAGS := -X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"
+
+LINK_FLAGS :=
+ifeq ($(FIPS), true)
+	LINK_FLAGS := -linkmode=external -extldflags=-static $(LINK_FLAGS)
+	# Prevent linking with libc regardless of CGO enabled or not.
+	GO_BUILD_TAGS := $(GO_BUILD_TAGS) osusergo netgo fips
+endif
+
+LDFLAGS := -ldflags='$(VERSION_FLAGS) $(LINK_FLAGS)'
+ifneq ($(GO_BUILD_TAGS),)
+	GO_BUILD_TAGS := -tags "$(GO_BUILD_TAGS)"
+endif
 
 IMPORT_PATH   := github.com/cloudflare/cloudflared
 PACKAGE_DIR   := $(CURDIR)/packaging
@@ -39,6 +50,8 @@ else ifeq ($(shell echo $(LOCAL_ARCH) | head -c 5),armv8)
     TARGET_ARCH ?= arm64
 else ifeq ($(LOCAL_ARCH),aarch64)
     TARGET_ARCH ?= arm64
+else ifeq ($(LOCAL_ARCH),arm64)
+    TARGET_ARCH ?= arm64
 else ifeq ($(shell echo $(LOCAL_ARCH) | head -c 4),armv)
     TARGET_ARCH ?= arm
 else
@@ -59,9 +72,9 @@ else
 endif
 
 ifeq ($(TARGET_OS), windows)
-	EXECUTABLE_PATH=./cloudflared.exe
+	EXECUTABLE_PATH=./$(BINARY_NAME).exe
 else
-	EXECUTABLE_PATH=./cloudflared
+	EXECUTABLE_PATH=./$(BINARY_NAME)
 endif
 
 ifeq ($(FLAVOR), centos-7)
@@ -78,17 +91,15 @@ clean:
 	go clean
 
 .PHONY: cloudflared
-cloudflared: 
+cloudflared:
 ifeq ($(FIPS), true)
 	$(info Building cloudflared with go-fips)
-	-test -f fips/fips.go && mv fips/fips.go fips/fips.go.linux-amd64
-	mv fips/fips.go.linux-amd64 fips/fips.go
+	cp -f fips/fips.go.linux-amd64 cmd/cloudflared/fips.go
 endif
-
-	GOOS=$(TARGET_OS) GOARCH=$(TARGET_ARCH) go build -v -mod=vendor $(GO_BUILD_TAGS) $(VERSION_FLAGS) $(IMPORT_PATH)/cmd/cloudflared
-
+	GOOS=$(TARGET_OS) GOARCH=$(TARGET_ARCH) go build -v -mod=vendor $(GO_BUILD_TAGS) $(LDFLAGS) $(IMPORT_PATH)/cmd/cloudflared
 ifeq ($(FIPS), true)
-	mv fips/fips.go fips/fips.go.linux-amd64
+	rm -f cmd/cloudflared/fips.go
+	./check-fips.sh cloudflared
 endif
 
 .PHONY: container
@@ -98,10 +109,10 @@ container:
 .PHONY: test
 test: vet
 ifndef CI
-	go test -v -mod=vendor -race $(VERSION_FLAGS) ./...
+	go test -v -mod=vendor -race $(LDFLAGS) ./...
 else
 	@mkdir -p .cover
-	go test -v -mod=vendor -race $(VERSION_FLAGS) -coverprofile=".cover/c.out" ./...
+	go test -v -mod=vendor -race $(LDFLAGS) -coverprofile=".cover/c.out" ./...
 	go tool cover -html ".cover/c.out" -o .cover/all.html
 endif
 
@@ -110,10 +121,10 @@ test-ssh-server:
 	docker-compose -f ssh_server_tests/docker-compose.yml up
 
 define publish_package
-	chmod 664 cloudflared*.$(1); \
+	chmod 664 $(BINARY_NAME)*.$(1); \
 	for HOST in $(CF_PKG_HOSTS); do \
-		ssh-keyscan -t rsa $$HOST >> ~/.ssh/known_hosts; \
-		scp -p -4 cloudflared*.$(1) cfsync@$$HOST:/state/cf-pkg/staging/$(2)/$(TARGET_PUBLIC_REPO)/cloudflared/; \
+		ssh-keyscan -t ecdsa $$HOST >> ~/.ssh/known_hosts; \
+		scp -p -4 $(BINARY_NAME)*.$(1) cfsync@$$HOST:/state/cf-pkg/staging/$(2)/$(TARGET_PUBLIC_REPO)/$(BINARY_NAME)/; \
 	done
 endef
 
@@ -125,12 +136,14 @@ publish-deb: cloudflared-deb
 publish-rpm: cloudflared-rpm
 	$(call publish_package,rpm,yum)
 
+# When we build packages, the package name will be FIPS-aware.
+# But we keep the binary installed by it to be named "cloudflared" regardless.
 define build_package
 	mkdir -p $(PACKAGE_DIR)
 	cp cloudflared $(PACKAGE_DIR)/cloudflared
 	cat cloudflared_man_template | sed -e 's/\$${VERSION}/$(VERSION)/; s/\$${DATE}/$(DATE)/' > $(PACKAGE_DIR)/cloudflared.1
 	fakeroot fpm -C $(PACKAGE_DIR) -s dir -t $(1) \
-		--description 'Cloudflare Argo tunnel daemon' \
+		--description 'Cloudflare Tunnel daemon' \
 		--vendor 'Cloudflare' \
 		--license 'Cloudflare Service Agreement' \
 		--url 'https://github.com/cloudflare/cloudflared' \
@@ -245,17 +258,20 @@ tunnelrpc-deps:
 	capnp compile -ogo tunnelrpc/tunnelrpc.capnp
 
 .PHONY: quic-deps
-quic-deps: 
-	which capnp 
+quic-deps:
+	which capnp
 	which capnpc-go
 	capnp compile -ogo quic/schema/quic_metadata_protocol.capnp
 
 .PHONY: vet
 vet:
 	go vet -mod=vendor ./...
-	which go-sumtype  # go get github.com/BurntSushi/go-sumtype (don't do this in build directory or this will cause vendor issues)
+	# go get github.com/sudarshan-reddy/go-sumtype (don't do this in build directory or this will cause vendor issues)
+	# Note: If you have github.com/BurntSushi/go-sumtype then you might have to use the repo above instead
+	# for now because it uses an older version of golang.org/x/tools.
+	which go-sumtype
 	go-sumtype $$(go list -mod=vendor ./...)
 
 .PHONY: goimports
 goimports:
-	for d in $$(go list -mod=readonly -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc) ; do goimports -format-only -local github.com/cloudflare/cloudflared -w $$d ; done
+	for d in $$(go list -mod=readonly -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc) ; do goimports -format-only -local github.com/cloudflare/cloudflared -w $$d ; done

README.md

@@ -1,14 +1,28 @@
-# Argo Tunnel client
+# Cloudflare Tunnel client
+
+Contains the command-line client for Cloudflare Tunnel, a tunneling daemon that proxies traffic from the Cloudflare network to your origins.
+This daemon sits between Cloudflare network and your origin (e.g. a webserver). Cloudflare attracts client requests and sends them to you
+via this daemon, without requiring you to poke holes on your firewall --- your origin can remain as closed as possible.
+Extensive documentation can be found in the [Cloudflare Tunnel section](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps) of the Cloudflare Docs.
+All usages related with proxying to your origins are available under `cloudflared tunnel help`.
+
+You can also use `cloudflared` to access Tunnel origins (that are protected with `cloudflared tunnel`) for TCP traffic
+at Layer 4 (i.e., not HTTP/websocket), which is relevant for use cases such as SSH, RDP, etc.
+Such usages are available under `cloudflared access help`.
+
+You can instead use [WARP client](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/private-networks)
+to access private origins behind Tunnels for Layer 4 traffic without requiring `cloudflared access` commands on the client side.
 
-Contains the command-line client for Argo Tunnel, a tunneling daemon that proxies any local webserver through the Cloudflare network. Extensive documentation can be found in the [Argo Tunnel section](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps) of the Cloudflare Docs.
 
 ## Before you get started
 
-Before you use Argo Tunnel, you'll need to complete a few steps in the Cloudflare dashboard. The website you add to Cloudflare will be used to route traffic to your Tunnel.
-
+Before you use Cloudflare Tunnel, you'll need to complete a few steps in the Cloudflare dashboard: you need to add a
+website to your Cloudflare account. Note that today it is possible to use Tunnel without a website (e.g. for private
+routing), but for legacy reasons this requirement is still necessary:
 1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
 2. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708)
 
+
 ## Installing `cloudflared`
 
 Downloads are available as standalone binaries, a Docker image, and Debian, RPM, and Homebrew packages. You can also find releases here on the `cloudflared` GitHub repository.
@@ -18,26 +32,29 @@ Downloads are available as standalone binaries, a Docker image, and Debian, RPM,
 * A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared)
 * You can install on Windows machines with the [steps here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#windows)
 
-User documentation for Argo Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
+User documentation for Cloudflare Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
+
 
 ## Creating Tunnels and routing traffic
 
-Once installed, you can authenticate `cloudflared` into your Cloudflare account and begin creating Tunnels that serve traffic for hostnames in your account.
+Once installed, you can authenticate `cloudflared` into your Cloudflare account and begin creating Tunnels to serve traffic to your origins.
 
 * Create a Tunnel with [these instructions](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/create-tunnel)
-* Route traffic to that Tunnel with [DNS records in Cloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/dns) or with a [Cloudflare Load Balancer](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb)
+* Route traffic to that Tunnel:
+  * Via public [DNS records in Cloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/dns)
+  * Or via a public hostname guided by a [Cloudflare Load Balancer](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb)
+  * Or from [WARP client private traffic](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/private-networks)
+
 
 ## TryCloudflare
 
-Want to test Argo Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/trycloudflare).
+Want to test Cloudflare Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare).
 
 ## Deprecated versions
 
-Cloudflare currently supports all versions of `cloudflared`. Starting on March 20, 2021, Cloudflare will no longer support versions released prior to 2020.5.1.
-
-All features available in versions released prior to 2020.5.1 are available in current versions. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1. You can read more about upgrading `cloudflared` in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#updating-cloudflared).
+Cloudflare currently supports versions of `cloudflared` 2020.5.1 and later. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1. You can read more about upgrading `cloudflared` in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#updating-cloudflared).
 
 | Version(s) | Deprecation status |
 |---|---|
 | 2020.5.1 and later | Supported |
-| Versions prior to 2020.5.1 | Will no longer be supported starting March 20, 2021 |
+| Versions prior to 2020.5.1 | No longer supported |

RELEASE_NOTES

@@ -1,3 +1,104 @@
+2021.12.2
+- 2021-12-20 TUN-5571: Remove redundant session manager log, it's already logged in origin/tunnel.ServeQUIC
+- 2021-12-20 TUN-5570: Only log RPC server events at error level to reduce noise
+- 2021-12-14 TUN-5494: Send a RPC with terminate reason to edge if the session is closed locally
+- 2021-11-09 TUN-5551: Reintroduce FIPS compliance for linux amd64 now as separate binaries
+
+2021.12.1
+- 2021-12-16 TUN-5549: Revert "TUN-5277: Ensure cloudflared binary is FIPS compliant on linux amd64"
+
+2021.12.0
+- 2021-12-13 TUN-5530: Get current time from ticker
+- 2021-12-15 TUN-5544: Update CHANGES.md for next release
+- 2021-12-07 TUN-5519: Adjust URL for virtual_networks endpoint to match what we will publish
+- 2021-12-02 TUN-5488: Close session after it's idle for a period defined by registerUdpSession RPC
+- 2021-12-09 TUN-5504: Fix upload of packages to public repo
+- 2021-11-30 TUN-5481: Create abstraction for Origin UDP Connection
+- 2021-11-30 TUN-5422: Define RPC to unregister session
+- 2021-11-26 TUN-5361: Commands for managing virtual networks
+- 2021-11-29 TUN-5362: Adjust route ip commands to be aware of virtual networks
+- 2021-11-23 TUN-5301: Separate datagram multiplex and session management logic from quic connection logic
+- 2021-11-10 TUN-5405: Update net package to v0.0.0-20211109214657-ef0fda0de508
+- 2021-11-10 TUN-5408: Update quic package to v0.24.0
+- 2021-11-12 Fix typos
+- 2021-11-13 Fix for Issue #501: Unexpected User-agent insertion when tunneling http request
+- 2021-11-16 TUN-5129: Remove `-dev` suffix when computing version and Git has uncommitted changes
+- 2021-11-18 TUN-5441: Fix message about available protocols
+- 2021-11-12 TUN-5300: Define RPC to register UDP sessions
+- 2021-11-14 TUN-5299: Send/receive QUIC datagram from edge and proxy to origin as UDP
+- 2021-11-04 TUN-5387: Updated CHANGES.md for 2021.11.0
+- 2021-11-08 TUN-5368: Log connection issues with LogLevel that depends on tunnel state
+- 2021-11-09 TUN-5397: Log cloudflared output when it fails to connect tunnel
+- 2021-11-09 TUN-5277: Ensure cloudflared binary is FIPS compliant on linux amd64
+- 2021-11-08 TUN-5393: Content-length is no longer a control header for non-h2mux transports
+
+2021.11.0
+- 2021-11-03 TUN-5285: Fallback to HTTP2 immediately if connection times out with no network activity
+- 2021-09-29 Add flag to 'tunnel create' subcommand to specify a base64-encoded secret
+
+2021.10.5
+- 2021-10-25 Update change log for release 2021.10.4
+- 2021-10-25 Revert "TUN-5184: Make sure outstanding websocket write is finished, and no more writes after shutdown"
+
+2021.10.4
+- 2021-10-21 TUN-5287: Fix misuse of wait group in TestQUICServer that caused the test to exit immediately
+- 2021-10-21 TUN-5286: Upgrade crypto/ssh package to fix CVE-2020-29652
+- 2021-10-18 TUN-5262: Allow to configure max fetch size for listing queries
+- 2021-10-19 TUN-5262: Improvements to `max-fetch-size` that allow to deal with large number of tunnels in account
+- 2021-10-15 TUN-5261: Collect QUIC metrics about RTT, packets and bytes transfered and log events at tracing level
+- 2021-10-19 TUN-5184: Make sure outstanding websocket write is finished, and no more writes after shutdown
+
+2021.10.3
+- 2021-10-14 TUN-5255: Fix potential panic if Cloudflare API fails to respond to GetTunnel(id) during delete command
+- 2021-10-14 TUN-5257: Fix more cfsetup targets that were broken by recent package changes
+
+2021.10.2
+- 2021-10-11 TUN-5138: Switch to QUIC on auto protocol based on threshold
+- 2021-10-14 TUN-5250: Add missing packages for cfsetup to succeed in github release pkgs target
+
+2021.10.1
+- 2021-10-12 TUN-5246: Use protocol: quic for Quick tunnels if one is not already set
+- 2021-10-13 TUN-5249: Revert "TUN-5138: Switch to QUIC on auto protocol based on threshold"
+
+2021.10.0
+- 2021-10-11 TUN-5138: Switch to QUIC on auto protocol based on threshold
+- 2021-10-07 TUN-5195: Do not set empty body if not applicable
+- 2021-10-08 UN-5213: Increase MaxStreams value for QUIC transport
+- 2021-09-28 TUN-5169: Release 2021.9.2 CHANGES.md
+- 2021-09-28 TUN-5164: Update README and clean up references to Argo Tunnel (using Cloudflare Tunnel instead)
+
+2021.9.2
+- 2021-09-21 TUN-5129: Use go 1.17 and copy .git folder to docker build to compute version
+- 2021-09-21 TUN-5128: Enforce maximum grace period
+- 2021-09-22 TUN-5141: Make sure websocket pinger returns before streaming returns
+- 2021-09-24 TUN-5142: Add asynchronous servecontrolstream for QUIC
+- 2021-09-24 TUN-5142: defer close rpcconn inside unregister instead of ServeControlStream
+- 2021-09-27 TUN-5160: Set request.ContentLength when this value is in request header
+
+2021.9.1
+- 2021-09-21 TUN-5118: Quic connection now detects duplicate connections similar to http2
+- 2021-09-15 Fix TryCloudflare link
+
+2021.9.0
+- 2021-09-02 Fix broken TryCloudflare link
+- 2021-09-03 Add support for taking named tunnel credentials from an environment variable
+- 2021-08-30 TUN-5012: Use patched go-sumtype
+- 2021-08-31 TUN-5011: Use the region parameter in fallback SRV lookup
+- 2021-08-31 TUN-5029: Do not strip cf- prefixed headers
+- 2021-08-29 TUN-5009: Updated github action to use go 1.17.x for checks
+- 2021-08-28 TUN-5010: --region should be a string flag
+- 2021-08-10 Allow building on arm64 platforms
+- 2021-06-09 Update README.md
+- 2021-05-31 🖌️ Allow providing TokenID and TokenSecret as env vars when calling cloudflared access
+- 2021-05-31 🎨 Prefix env var parameters with TUNNEL
+
+2021.8.7
+- 2021-08-28 Revert "TUN-4926: Implement --region configuration option"
+
+2021.8.6
+- 2021-08-27 TUN-5000: De-flake logging to dir component test in Windows by increasing to buffer to cope with more logging
+- 2021-08-27 TUN-5003: Fix cfsetup for non-FIPS golang version
+
 2021.8.5
 - 2021-08-27 TUN-4961: Update quic-go to latest
 - 2021-08-27 Release 2021.8.4

build-packages-fips.sh

@@ -0,0 +1,25 @@
+VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
+echo $VERSION
+
+# This controls the directory the built artifacts go into
+export ARTIFACT_DIR=built_artifacts/
+mkdir -p $ARTIFACT_DIR
+
+arch=("amd64")
+export TARGET_ARCH=$arch
+export TARGET_OS=linux
+export FIPS=true
+# For BoringCrypto to link, we need CGO enabled. Otherwise compilation fails.
+export CGO_ENABLED=1
+
+make cloudflared-deb
+mv cloudflared-fips\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-fips-linux-$arch.deb
+
+# rpm packages invert the - and _ and use x86_64 instead of amd64.
+RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
+RPMARCH="x86_64"
+make cloudflared-rpm
+mv cloudflared-fips-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-fips-linux-$RPMARCH.rpm
+
+# finally move the linux binary as well.
+mv ./cloudflared $ARTIFACT_DIR/cloudflared-fips-linux-$arch

build-packages.sh

@@ -1,12 +1,15 @@
-VERSION=$(git describe --tags --always --dirty="-dev" --match "[0-9][0-9][0-9][0-9].*.*")
+VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
+
+# Avoid depending on C code since we don't need it.
 export CGO_ENABLED=0
+
 # This controls the directory the built artifacts go into
 export ARTIFACT_DIR=built_artifacts/
 mkdir -p $ARTIFACT_DIR
 windowsArchs=("amd64" "386")
 export TARGET_OS=windows
-for arch in ${windowsArchs[@]}; do 
+for arch in ${windowsArchs[@]}; do
     export TARGET_ARCH=$arch
     make cloudflared-msi
     mv ./cloudflared.exe $ARTIFACT_DIR/cloudflared-windows-$arch.exe
@@ -14,15 +17,14 @@ for arch in ${windowsArchs[@]}; do
 done
 
 
-export FIPS=true
-linuxArchs=("amd64" "386" "arm" "arm64")
+linuxArchs=("386" "amd64" "arm" "arm64")
 export TARGET_OS=linux
-for arch in ${linuxArchs[@]}; do 
+for arch in ${linuxArchs[@]}; do
     export TARGET_ARCH=$arch
     make cloudflared-deb
     mv cloudflared\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-linux-$arch.deb
 
-    # rpm packages invert the - and _ and use x86_64 instead of amd64. 
+    # rpm packages invert the - and _ and use x86_64 instead of amd64.
     RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
     RPMARCH=$arch
     if [ $arch == "amd64" ];then
@@ -37,4 +39,3 @@ for arch in ${linuxArchs[@]}; do
     # finally move the linux binary as well.
     mv ./cloudflared $ARTIFACT_DIR/cloudflared-linux-$arch
 done
-

carrier/carrier.go

@@ -54,7 +54,7 @@ func (c *StdinoutStream) Write(p []byte) (int, error) {
 	return os.Stdout.Write(p)
 }
 
-// Helper to allow defering the response close with a check that the resp is not nil
+// Helper to allow deferring the response close with a check that the resp is not nil
 func closeRespBody(resp *http.Response) {
 	if resp != nil {
 		_ = resp.Body.Close()

certutil/certutil.go

@@ -66,7 +66,7 @@ func DecodeOriginCert(blocks []byte) (*OriginCert, error) {
 				originCert.ServiceKey = ntt.ServiceKey
 				originCert.AccountID = ntt.AccountID
 			} else {
-				// Try the older format, where the zoneID and service key are seperated by
+				// Try the older format, where the zoneID and service key are separated by
 				// a new line character
 				token := string(block.Bytes)
 				s := strings.Split(token, "\n")

cfsetup.yaml

@@ -1,10 +1,19 @@
-pinned_go: &pinned_go go=1.17
-pinned_go_fips: &pinned_go_fips go-boring=1.16.6-6
+pinned_go: &pinned_go go=1.17-1
+pinned_go_fips: &pinned_go_fips go-boring=1.16.6-7
 
 build_dir: &build_dir /cfsetup_build
 default-flavor: buster
 stretch: &stretch
   build:
+    build_dir: *build_dir
+    builddeps:
+      - *pinned_go
+      - build-essential
+    post-cache:
+      - export GOOS=linux
+      - export GOARCH=amd64
+      - make cloudflared
+  build-fips:
     build_dir: *build_dir
     builddeps:
       - *pinned_go_fips
@@ -14,30 +23,11 @@ stretch: &stretch
       - export GOARCH=amd64
       - export FIPS=true
       - make cloudflared
-  build-all-packages: #except osxpkg
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go_fips
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - wget
-      # libmsi and libgcab are libraries the wixl binary depends on.
-      - libmsi-dev
-      - libgcab-dev
-    pre-cache:
-      # TODO: https://jira.cfops.it/browse/TUN-4792 Replace this wixl with the official one once msitools supports
-      # environment.
-      - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
-      - chmod a+x /usr/local/bin/wixl
-    post-cache:
-      - export FIPS=true
-      - ./build-packages.sh
+  # except FIPS (handled in github-fips-release-pkgs) and macos (handled in github-release-macos-amd64)
   github-release-pkgs:
     build_dir: *build_dir
     builddeps:
-      - *pinned_go_fips
+      - *pinned_go
       - build-essential
       - fakeroot
       - rubygem-fpm
@@ -46,20 +36,55 @@ stretch: &stretch
       # libmsi and libgcab are libraries the wixl binary depends on.
       - libmsi-dev
       - libgcab-dev
+      - python3-dev
+      - libffi-dev
       - python3-setuptools
       - python3-pip
-    pre-cache:
+    pre-cache: &github_release_pkgs_pre_cache
       - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
       - chmod a+x /usr/local/bin/wixl
       - pip3 install pygithub
     post-cache:
-      # build all packages and move them to /cfsetup/built_artifacts
+      # build all packages (except macos and FIPS) and move them to /cfsetup/built_artifacts
       - ./build-packages.sh
       # release the packages built and moved to /cfsetup/built_artifacts
       - make github-release-built-pkgs
+  # handle FIPS separately so that we built with gofips compiler
+  github-fips-release-pkgs:
+    build_dir: *build_dir
+    builddeps:
+      - *pinned_go_fips
+      - build-essential
+      - fakeroot
+      - rubygem-fpm
+      - rpm
+      - wget
+      # libmsi and libgcab are libraries the wixl binary depends on.
+      - libmsi-dev
+      - libgcab-dev
+      - python3-dev
+      - libffi-dev
+      - python3-setuptools
+      - python3-pip
+    pre-cache: *github_release_pkgs_pre_cache
+    post-cache:
+      # same logic as above, but for FIPS packages only
+      - ./build-packages-fips.sh
+      - make github-release-built-pkgs
   build-deb:
     build_dir: *build_dir
     builddeps: &build_deb_deps
+      - *pinned_go
+      - build-essential
+      - fakeroot
+      - rubygem-fpm
+    post-cache:
+      - export GOOS=linux
+      - export GOARCH=amd64
+      - make cloudflared-deb
+  build-fips-deb:
+    build_dir: *build_dir
+    builddeps:
       - *pinned_go_fips
       - build-essential
       - fakeroot
@@ -75,7 +100,6 @@ stretch: &stretch
     post-cache:
       - export GOOS=linux
       - export GOARCH=amd64
-      - export FIPS=true
       - export NIGHTLY=true
       - make cloudflared-deb
   build-deb-arm64:
@@ -88,7 +112,7 @@ stretch: &stretch
   publish-deb:
     build_dir: *build_dir
     builddeps:
-      - *pinned_go_fips
+      - *pinned_go
       - build-essential
       - fakeroot
       - rubygem-fpm
@@ -96,12 +120,14 @@ stretch: &stretch
     post-cache:
       - export GOOS=linux
       - export GOARCH=amd64
-      - export FIPS=true
       - make publish-deb
   github-release-macos-amd64:
     build_dir: *build_dir
     builddeps:
       - *pinned_go
+      - build-essential
+      - python3-dev
+      - libffi-dev
       - python3-setuptools
       - python3-pip
     pre-cache: &install_pygithub
@@ -109,14 +135,27 @@ stretch: &stretch
     post-cache:
       - make github-mac-upload
   test:
+    build_dir: *build_dir
+    builddeps:
+      - *pinned_go
+      - build-essential
+      - gotest-to-teamcity
+    pre-cache: &test_pre_cache
+      - go get golang.org/x/tools/cmd/goimports
+      - go get github.com/sudarshan-reddy/go-sumtype@v0.0.0-20210827105221-82eca7e5abb1
+    post-cache:
+      - export GOOS=linux
+      - export GOARCH=amd64
+      - export PATH="$HOME/go/bin:$PATH"
+      - ./fmt-check.sh
+      - make test | gotest-to-teamcity
+  test-fips:
     build_dir: *build_dir
     builddeps:
       - *pinned_go_fips
       - build-essential
       - gotest-to-teamcity
-    pre-cache:
-      - go get golang.org/x/tools/cmd/goimports
-      - go get github.com/sudarshan-reddy/go-sumtype@v0.0.0-20210827105221-82eca7e5abb1
+    pre-cache: *test_pre_cache
     post-cache:
       - export GOOS=linux
       - export GOARCH=amd64
@@ -141,7 +180,7 @@ stretch: &stretch
     post-cache:
       # Creates and routes a Named Tunnel for this build. Also constructs config file from env vars.
       - python3 component-tests/setup.py --type create
-      - pytest component-tests
+      - pytest component-tests -o log_cli=true --log-cli-level=INFO
       # The Named Tunnel is deleted and its route unprovisioned here.
       - python3 component-tests/setup.py --type cleanup
   update-homebrew:
@@ -154,6 +193,9 @@ stretch: &stretch
     build_dir: *build_dir
     builddeps:
       - *pinned_go
+      - build-essential
+      - python3-dev
+      - libffi-dev
       - python3-setuptools
       - python3-pip
     pre-cache: *install_pygithub

check-fips.sh

@@ -0,0 +1,15 @@
+# Pass the path to the executable to check for FIPS compliance
+exe=$1
+
+if [ "$(go tool nm "${exe}" | grep -c '_Cfunc__goboringcrypto_')" -eq 0 ]; then
+    # Asserts that executable is using FIPS-compliant boringcrypto
+    echo "${exe}: missing goboring symbols" >&2
+    exit 1
+fi
+if [ "$(go tool nm "${exe}" | grep -c 'crypto/internal/boring/sig.FIPSOnly')" -eq 0 ]; then
+    # Asserts that executable is using FIPS-only schemes
+    echo "${exe}: missing fipsonly symbols" >&2
+    exit 1
+fi
+
+echo "${exe} is FIPS-compliant"

cmd/cloudflared/access/cmd.go

@@ -143,11 +143,13 @@ func Commands() []*cli.Command {
 							Name:    sshTokenIDFlag,
 							Aliases: []string{"id"},
 							Usage:   "specify an Access service token ID you wish to use.",
+							EnvVars: []string{"TUNNEL_SERVICE_TOKEN_ID"},
 						},
 						&cli.StringFlag{
 							Name:    sshTokenSecretFlag,
 							Aliases: []string{"secret"},
 							Usage:   "specify an Access service token secret you wish to use.",
+							EnvVars: []string{"TUNNEL_SERVICE_TOKEN_SECRET"},
 						},
 						&cli.StringFlag{
 							Name:    logger.LogSSHDirectoryFlag,
@@ -238,7 +240,7 @@ func login(c *cli.Context) error {
 	return nil
 }
 
-// ensureURLScheme prepends a URL with https:// if it doesnt have a scheme. http:// URLs will not be converted.
+// ensureURLScheme prepends a URL with https:// if it doesn't have a scheme. http:// URLs will not be converted.
 func ensureURLScheme(url string) string {
 	url = strings.Replace(strings.ToLower(url), "http://", "https://", 1)
 	if !strings.HasPrefix(url, "https://") {

cmd/cloudflared/cliutil/deprecated.go

@@ -11,7 +11,7 @@ func RemovedCommand(name string) *cli.Command {
 		Name: name,
 		Action: func(context *cli.Context) error {
 			return cli.Exit(
-				fmt.Sprintf("%s command is no longer supported by cloudflared. Consult Argo Tunnel documentation for possible alternative solutions.", name),
+				fmt.Sprintf("%s command is no longer supported by cloudflared. Consult Cloudflare Tunnel documentation for possible alternative solutions.", name),
 				-1,
 			)
 		},

cmd/cloudflared/generic_service.go

@@ -1,3 +1,4 @@
+//go:build !windows && !darwin && !linux
 // +build !windows,!darwin,!linux
 
 package main

cmd/cloudflared/linux_service.go

@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 package main
@@ -19,11 +20,11 @@ import (
 func runApp(app *cli.App, graceShutdownC chan struct{}) {
 	app.Commands = append(app.Commands, &cli.Command{
 		Name:  "service",
-		Usage: "Manages the Argo Tunnel system service",
+		Usage: "Manages the Cloudflare Tunnel system service",
 		Subcommands: []*cli.Command{
 			{
 				Name:   "install",
-				Usage:  "Install Argo Tunnel as a system service",
+				Usage:  "Install Cloudflare Tunnel as a system service",
 				Action: cliutil.ConfiguredAction(installLinuxService),
 				Flags: []cli.Flag{
 					&cli.BoolFlag{
@@ -34,7 +35,7 @@ func runApp(app *cli.App, graceShutdownC chan struct{}) {
 			},
 			{
 				Name:   "uninstall",
-				Usage:  "Uninstall the Argo Tunnel service",
+				Usage:  "Uninstall the Cloudflare Tunnel service",
 				Action: cliutil.ConfiguredAction(uninstallLinuxService),
 			},
 		},
@@ -55,7 +56,7 @@ var systemdTemplates = []ServiceTemplate{
 	{
 		Path: "/etc/systemd/system/cloudflared.service",
 		Content: `[Unit]
-Description=Argo Tunnel
+Description=Cloudflare Tunnel
 After=network.target
 
 [Service]
@@ -72,7 +73,7 @@ WantedBy=multi-user.target
 	{
 		Path: "/etc/systemd/system/cloudflared-update.service",
 		Content: `[Unit]
-Description=Update Argo Tunnel
+Description=Update Cloudflare Tunnel
 After=network.target
 
 [Service]
@@ -82,7 +83,7 @@ ExecStart=/bin/bash -c '{{ .Path }} update; code=$?; if [ $code -eq 11 ]; then s
 	{
 		Path: "/etc/systemd/system/cloudflared-update.timer",
 		Content: `[Unit]
-Description=Update Argo Tunnel
+Description=Update Cloudflare Tunnel
 
 [Timer]
 OnCalendar=daily
@@ -99,7 +100,7 @@ var sysvTemplate = ServiceTemplate{
 	Content: `#!/bin/sh
 # For RedHat and cousins:
 # chkconfig: 2345 99 01
-# description: Argo Tunnel agent
+# description: Cloudflare Tunnel agent
 # processname: {{.Path}}
 ### BEGIN INIT INFO
 # Provides:          {{.Path}}
@@ -107,8 +108,8 @@ var sysvTemplate = ServiceTemplate{
 # Required-Stop:
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
-# Short-Description: Argo Tunnel
-# Description:       Argo Tunnel agent
+# Short-Description: Cloudflare Tunnel
+# Description:       Cloudflare Tunnel agent
 ### END INIT INFO
 name=$(basename $(readlink -f $0))
 cmd="{{.Path}} --config /etc/cloudflared/config.yml --pidfile /var/run/$name.pid --autoupdate-freq 24h0m0s{{ range .ExtraArgs }} {{ . }}{{ end }}"

cmd/cloudflared/macos_service.go

@@ -1,3 +1,4 @@
+//go:build darwin
 // +build darwin
 
 package main
@@ -20,16 +21,16 @@ const (
 func runApp(app *cli.App, graceShutdownC chan struct{}) {
 	app.Commands = append(app.Commands, &cli.Command{
 		Name:  "service",
-		Usage: "Manages the Argo Tunnel launch agent",
+		Usage: "Manages the Cloudflare Tunnel launch agent",
 		Subcommands: []*cli.Command{
 			{
 				Name:   "install",
-				Usage:  "Install Argo Tunnel as an user launch agent",
+				Usage:  "Install Cloudflare Tunnel as an user launch agent",
 				Action: cliutil.ConfiguredAction(installLaunchd),
 			},
 			{
 				Name:   "uninstall",
-				Usage:  "Uninstall the Argo Tunnel launch agent",
+				Usage:  "Uninstall the Cloudflare Tunnel launch agent",
 				Action: cliutil.ConfiguredAction(uninstallLaunchd),
 			},
 		},
@@ -110,13 +111,13 @@ func installLaunchd(c *cli.Context) error {
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
 
 	if isRootUser() {
-		log.Info().Msg("Installing Argo Tunnel client as a system launch daemon. " +
-			"Argo Tunnel client will run at boot")
+		log.Info().Msg("Installing Cloudflare Tunnel client as a system launch daemon. " +
+			"Cloudflare Tunnel client will run at boot")
 	} else {
-		log.Info().Msg("Installing Argo Tunnel client as an user launch agent. " +
-			"Note that Argo Tunnel client will only run when the user is logged in. " +
-			"If you want to run Argo Tunnel client at boot, install with root permission. " +
-			"For more information, visit https://developers.cloudflare.com/argo-tunnel/reference/service/")
+		log.Info().Msg("Installing Cloudflare Tunnel client as an user launch agent. " +
+			"Note that Cloudflare Tunnel client will only run when the user is logged in. " +
+			"If you want to run Cloudflare Tunnel client at boot, install with root permission. " +
+			"For more information, visit https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/run-as-service")
 	}
 	etPath, err := os.Executable()
 	if err != nil {
@@ -159,9 +160,9 @@ func uninstallLaunchd(c *cli.Context) error {
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
 
 	if isRootUser() {
-		log.Info().Msg("Uninstalling Argo Tunnel as a system launch daemon")
+		log.Info().Msg("Uninstalling Cloudflare Tunnel as a system launch daemon")
 	} else {
-		log.Info().Msg("Uninstalling Argo Tunnel as an user launch agent")
+		log.Info().Msg("Uninstalling Cloudflare Tunnel as an user launch agent")
 	}
 	installPath, err := installPath()
 	if err != nil {

cmd/cloudflared/main.go

@@ -67,7 +67,7 @@ func main() {
 	app.Copyright = fmt.Sprintf(
 		`(c) %d Cloudflare Inc.
    Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept
-   the terms of the Cloudflare License (https://developers.cloudflare.com/argo-tunnel/license/),
+   the terms of the Cloudflare License (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/license),
    Terms (https://www.cloudflare.com/terms/) and Privacy Policy (https://www.cloudflare.com/privacypolicy/).`,
 		time.Now().Year(),
 	)
@@ -76,7 +76,7 @@ func main() {
 	You can use it to authenticate a session to reach an API behind Access, route web traffic to this machine,
 	and configure access control.
 
-	See https://developers.cloudflare.com/argo-tunnel/ for more in-depth documentation.`
+	See https://developers.cloudflare.com/cloudflare-one/connections/connect-apps for more in-depth documentation.`
 	app.Flags = flags()
 	app.Action = action(graceShutdownC)
 	app.Commands = commands(cli.ShowVersion)

cmd/cloudflared/tunnel/cmd.go

@@ -102,6 +102,8 @@ func Commands() []*cli.Command {
 		buildLoginSubcommand(false),
 		buildCreateCommand(),
 		buildRouteCommand(),
+		// TODO TUN-5477 this should not be hidden
+		buildVirtualNetworkSubcommand(true),
 		buildRunCommand(),
 		buildListCommand(),
 		buildInfoCommand(),
@@ -126,14 +128,14 @@ func buildTunnelCommand(subcommands []*cli.Command) *cli.Command {
 		Name:      "tunnel",
 		Action:    cliutil.ConfiguredAction(TunnelCommand),
 		Category:  "Tunnel",
-		Usage:     "Make a locally-running web service accessible over the internet using Argo Tunnel.",
+		Usage:     "Make a locally-running web service accessible over the internet using Cloudflare Tunnel.",
 		ArgsUsage: " ",
-		Description: `Argo Tunnel asks you to specify a hostname on a Cloudflare-powered
+		Description: `Cloudflare Tunnel asks you to specify a hostname on a Cloudflare-powered
 		domain you control and a local address. Traffic from that hostname is routed
 		(optionally via a Cloudflare Load Balancer) to this machine and appears on the
 		specified port where it can be served.
 
-		This feature requires your Cloudflare account be subscribed to the Argo Smart Routing feature.
+		This feature requires your Cloudflare account be subscribed to the Cloudflare Smart Routing feature.
 
 		To use, begin by calling login to download a certificate:
 
@@ -181,7 +183,8 @@ func Init(ver string, gracefulShutdown chan struct{}) {
 func runAdhocNamedTunnel(sc *subcommandContext, name, credentialsOutputPath string) error {
 	tunnel, ok, err := sc.tunnelActive(name)
 	if err != nil || !ok {
-		tunnel, err = sc.create(name, credentialsOutputPath)
+		// pass empty string as secret to generate one
+		tunnel, err = sc.create(name, credentialsOutputPath, "")
 		if err != nil {
 			return errors.Wrap(err, "failed to create tunnel")
 		}
@@ -384,7 +387,11 @@ func StartServer(
 		observer.RegisterSink(app)
 	}
 
-	return waitToShutdown(&wg, cancel, errC, graceShutdownC, c.Duration("grace-period"), log)
+	gracePeriod, err := gracePeriod(c)
+	if err != nil {
+		return err
+	}
+	return waitToShutdown(&wg, cancel, errC, graceShutdownC, gracePeriod, log)
 }
 
 func waitToShutdown(wg *sync.WaitGroup,
@@ -484,7 +491,7 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 		credentialsFileFlag,
 		altsrc.NewBoolFlag(&cli.BoolFlag{
 			Name:   "is-autoupdated",
-			Usage:  "Signal the new process that Argo Tunnel connector has been autoupdated",
+			Usage:  "Signal the new process that Cloudflare Tunnel connector has been autoupdated",
 			Value:  false,
 			Hidden: true,
 		}),
@@ -494,7 +501,7 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_EDGE"},
 			Hidden:  true,
 		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "region",
 			Usage:   "Cloudflare Edge region to connect to. Omit or set to empty to connect to the global region.",
 			EnvVars: []string{"TUNNEL_REGION"},
@@ -642,6 +649,12 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:  "https://api.trycloudflare.com",
 			Hidden: true,
 		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:    "max-fetch-size",
+			Usage:   `The maximum number of results that cloudflared can fetch from Cloudflare API for any listing operations needed`,
+			EnvVars: []string{"TUNNEL_MAX_FETCH_SIZE"},
+			Hidden:  true,
+		}),
 		selectProtocolFlag,
 		overwriteDNSFlag,
 	}...)

cmd/cloudflared/tunnel/configuration.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/google/uuid"
 	homedir "github.com/mitchellh/go-homedir"
@@ -237,7 +238,7 @@ func prepareTunnelConfig(
 		log.Info().Msgf("Warp-routing is enabled")
 	}
 
-	protocolSelector, err := connection.NewProtocolSelector(c.String("protocol"), warpRoutingEnabled, namedTunnel, edgediscovery.HTTP2Percentage, origin.ResolveTTL, log)
+	protocolSelector, err := connection.NewProtocolSelector(c.String("protocol"), warpRoutingEnabled, namedTunnel, edgediscovery.ProtocolPercentage, origin.ResolveTTL, log)
 	if err != nil {
 		return nil, ingress.Ingress{}, err
 	}
@@ -260,9 +261,13 @@ func prepareTunnelConfig(
 	}
 
 	originProxy := origin.NewOriginProxy(ingressRules, warpRoutingService, tags, log)
+	gracePeriod, err := gracePeriod(c)
+	if err != nil {
+		return nil, ingress.Ingress{}, err
+	}
 	connectionConfig := &connection.Config{
 		OriginProxy:     originProxy,
-		GracePeriod:     c.Duration("grace-period"),
+		GracePeriod:     gracePeriod,
 		ReplaceExisting: c.Bool("force"),
 	}
 	muxerConfig := &connection.MuxerConfig{
@@ -300,6 +305,14 @@ func prepareTunnelConfig(
 	}, ingressRules, nil
 }
 
+func gracePeriod(c *cli.Context) (time.Duration, error) {
+	period := c.Duration("grace-period")
+	if period > connection.MaxGracePeriod {
+		return time.Duration(0), fmt.Errorf("grace-period must be equal or less than %v", connection.MaxGracePeriod)
+	}
+	return period, nil
+}
+
 func isWarpRoutingEnabled(warpConfig config.WarpRoutingConfig, isNamedTunnel bool) bool {
 	return warpConfig.Enabled && isNamedTunnel
 }

cmd/cloudflared/tunnel/configuration_test.go

@@ -1,4 +1,6 @@
+//go:build ignore
 // +build ignore
+
 // TODO: Remove the above build tag and include this test when we start compiling with Golang 1.10.0+
 
 package tunnel

cmd/cloudflared/tunnel/quick_tunnel.go

@@ -70,6 +70,10 @@ func RunQuickTunnel(sc *subcommandContext) error {
 		sc.log.Info().Msg(line)
 	}
 
+	if !sc.c.IsSet("protocol") {
+		sc.c.Set("protocol", "quic")
+	}
+
 	return StartServer(
 		sc.c,
 		version,

cmd/cloudflared/tunnel/signal_test.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package tunnel

cmd/cloudflared/tunnel/subcommand_context.go

@@ -1,6 +1,7 @@
 package tunnel
 
 import (
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -148,15 +149,27 @@ func (sc *subcommandContext) readTunnelCredentials(credFinder CredFinder) (conne
 	return credentials, nil
 }
 
-func (sc *subcommandContext) create(name string, credentialsFilePath string) (*tunnelstore.Tunnel, error) {
+func (sc *subcommandContext) create(name string, credentialsFilePath string, secret string) (*tunnelstore.Tunnel, error) {
 	client, err := sc.client()
 	if err != nil {
-		return nil, errors.Wrap(err, "couldn't create client to talk to Argo Tunnel backend")
+		return nil, errors.Wrap(err, "couldn't create client to talk to Cloudflare Tunnel backend")
 	}
 
-	tunnelSecret, err := generateTunnelSecret()
-	if err != nil {
-		return nil, errors.Wrap(err, "couldn't generate the secret for your new tunnel")
+	var tunnelSecret []byte
+	if secret == "" {
+		tunnelSecret, err = generateTunnelSecret()
+		if err != nil {
+			return nil, errors.Wrap(err, "couldn't generate the secret for your new tunnel")
+		}
+	} else {
+		decodedSecret, err := base64.StdEncoding.DecodeString(secret)
+		if err != nil {
+			return nil, errors.Wrap(err, "Couldn't decode tunnel secret from base64")
+		}
+		tunnelSecret = []byte(decodedSecret)
+		if len(tunnelSecret) < 32 {
+			return nil, errors.New("Decoded tunnel secret must be at least 32 bytes long")
+		}
 	}
 
 	tunnel, err := client.CreateTunnel(name, tunnelSecret)
@@ -230,7 +243,7 @@ func (sc *subcommandContext) delete(tunnelIDs []uuid.UUID) error {
 	for _, id := range tunnelIDs {
 		tunnel, err := client.GetTunnel(id)
 		if err != nil {
-			return errors.Wrapf(err, "Can't get tunnel information. Please check tunnel id: %s", tunnel.ID)
+			return errors.Wrapf(err, "Can't get tunnel information. Please check tunnel id: %s", id)
 		}
 
 		// Check if tunnel DeletedAt field has already been set
@@ -261,8 +274,16 @@ func (sc *subcommandContext) delete(tunnelIDs []uuid.UUID) error {
 // and add the TunnelID into any old credentials (generated before TUN-3581 added the `TunnelID`
 // field to credentials files)
 func (sc *subcommandContext) findCredentials(tunnelID uuid.UUID) (connection.Credentials, error) {
-	credFinder := sc.credentialFinder(tunnelID)
-	credentials, err := sc.readTunnelCredentials(credFinder)
+	var credentials connection.Credentials
+	var err error
+	if credentialsContents := sc.c.String(CredContentsFlag); credentialsContents != "" {
+		if err = json.Unmarshal([]byte(credentialsContents), &credentials); err != nil {
+			err = errInvalidJSONCredential{path: "TUNNEL_CRED_CONTENTS", err: err}
+		}
+	} else {
+		credFinder := sc.credentialFinder(tunnelID)
+		credentials, err = sc.readTunnelCredentials(credFinder)
+	}
 	// This line ensures backwards compatibility with credentials files generated before
 	// TUN-3581. Those old credentials files don't have a TunnelID field, so we enrich the struct
 	// with the ID, which we have already resolved from the user input.
@@ -365,52 +386,42 @@ func (sc *subcommandContext) findID(input string) (uuid.UUID, error) {
 }
 
 // findIDs is just like mapping `findID` over a slice, but it only uses
-// one Tunnelstore API call.
+// one Tunnelstore API call per non-UUID input provided.
 func (sc *subcommandContext) findIDs(inputs []string) ([]uuid.UUID, error) {
+	uuids, names := splitUuids(inputs)
 
-	// Shortcut without Tunnelstore call if we find that all inputs are already UUIDs.
-	uuids, err := convertNamesToUuids(inputs, make(map[string]uuid.UUID))
-	if err == nil {
-		return uuids, nil
+	for _, name := range names {
+		filter := tunnelstore.NewFilter()
+		filter.NoDeleted()
+		filter.ByName(name)
+
+		tunnels, err := sc.list(filter)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(tunnels) != 1 {
+			return nil, fmt.Errorf("there should only be 1 non-deleted Tunnel named %s", name)
+		}
+
+		uuids = append(uuids, tunnels[0].ID)
 	}
 
-	// First, look up all tunnels the user has
-	filter := tunnelstore.NewFilter()
-	filter.NoDeleted()
-	tunnels, err := sc.list(filter)
-	if err != nil {
-		return nil, err
-	}
-	// Do the pure list-processing in its own function, so that it can be
-	// unit tested easily.
-	return findIDs(tunnels, inputs)
+	return uuids, nil
 }
 
-func findIDs(tunnels []*tunnelstore.Tunnel, inputs []string) ([]uuid.UUID, error) {
-	// Put them into a dictionary for faster lookups
-	nameToID := make(map[string]uuid.UUID, len(tunnels))
-	for _, tunnel := range tunnels {
-		nameToID[tunnel.Name] = tunnel.ID
-	}
+func splitUuids(inputs []string) ([]uuid.UUID, []string) {
+	uuids := make([]uuid.UUID, 0)
+	names := make([]string, 0)
 
-	return convertNamesToUuids(inputs, nameToID)
-}
-
-func convertNamesToUuids(inputs []string, nameToID map[string]uuid.UUID) ([]uuid.UUID, error) {
-	tunnelIDs := make([]uuid.UUID, len(inputs))
-	var badInputs []string
-	for i, input := range inputs {
-		if id, err := uuid.Parse(input); err == nil {
-			tunnelIDs[i] = id
-		} else if id, ok := nameToID[input]; ok {
-			tunnelIDs[i] = id
+	for _, input := range inputs {
+		id, err := uuid.Parse(input)
+		if err != nil {
+			names = append(names, input)
 		} else {
-			badInputs = append(badInputs, input)
+			uuids = append(uuids, id)
 		}
 	}
-	if len(badInputs) > 0 {
-		msg := "Please specify either the ID or name of a tunnel. The following inputs were neither: %s"
-		return nil, fmt.Errorf(msg, strings.Join(badInputs, ", "))
-	}
-	return tunnelIDs, nil
+
+	return uuids, names
 }

cmd/cloudflared/tunnel/subcommand_context_teamnet.go

@@ -1,8 +1,6 @@
 package tunnel
 
 import (
-	"net"
-
 	"github.com/pkg/errors"
 
 	"github.com/cloudflare/cloudflared/teamnet"
@@ -26,18 +24,18 @@ func (sc *subcommandContext) addRoute(newRoute teamnet.NewRoute) (teamnet.Route,
 	return client.AddRoute(newRoute)
 }
 
-func (sc *subcommandContext) deleteRoute(network net.IPNet) error {
+func (sc *subcommandContext) deleteRoute(params teamnet.DeleteRouteParams) error {
 	client, err := sc.client()
 	if err != nil {
 		return errors.Wrap(err, noClientMsg)
 	}
-	return client.DeleteRoute(network)
+	return client.DeleteRoute(params)
 }
 
-func (sc *subcommandContext) getRouteByIP(ip net.IP) (teamnet.DetailedRoute, error) {
+func (sc *subcommandContext) getRouteByIP(params teamnet.GetRouteByIpParams) (teamnet.DetailedRoute, error) {
 	client, err := sc.client()
 	if err != nil {
 		return teamnet.DetailedRoute{}, errors.Wrap(err, noClientMsg)
 	}
-	return client.GetByIP(ip)
+	return client.GetByIP(params)
 }

cmd/cloudflared/tunnel/subcommand_context_test.go

@@ -17,79 +17,6 @@ import (
 	"github.com/cloudflare/cloudflared/tunnelstore"
 )
 
-func Test_findIDs(t *testing.T) {
-	type args struct {
-		tunnels []*tunnelstore.Tunnel
-		inputs  []string
-	}
-	tests := []struct {
-		name    string
-		args    args
-		want    []uuid.UUID
-		wantErr bool
-	}{
-		{
-			name: "input not found",
-			args: args{
-				inputs: []string{"asdf"},
-			},
-			wantErr: true,
-		},
-		{
-			name: "only UUID",
-			args: args{
-				inputs: []string{"a8398a0b-876d-48ed-b609-3fcfd67a4950"},
-			},
-			want: []uuid.UUID{uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950")},
-		},
-		{
-			name: "only name",
-			args: args{
-				tunnels: []*tunnelstore.Tunnel{
-					{
-						ID:   uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950"),
-						Name: "tunnel1",
-					},
-				},
-				inputs: []string{"tunnel1"},
-			},
-			want: []uuid.UUID{uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950")},
-		},
-		{
-			name: "both UUID and name",
-			args: args{
-				tunnels: []*tunnelstore.Tunnel{
-					{
-						ID:   uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950"),
-						Name: "tunnel1",
-					},
-					{
-						ID:   uuid.MustParse("bf028b68-744f-466e-97f8-c46161d80aa5"),
-						Name: "tunnel2",
-					},
-				},
-				inputs: []string{"tunnel1", "bf028b68-744f-466e-97f8-c46161d80aa5"},
-			},
-			want: []uuid.UUID{
-				uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950"),
-				uuid.MustParse("bf028b68-744f-466e-97f8-c46161d80aa5"),
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := findIDs(tt.args.tunnels, tt.args.inputs)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("findIDs() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("findIDs() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
 type mockFileSystem struct {
 	rf  func(string) ([]byte, error)
 	vfp func(string) bool
@@ -191,6 +118,51 @@ func Test_subcommandContext_findCredentials(t *testing.T) {
 				TunnelName:   name,
 			},
 		},
+		{
+			name: "TUNNEL_CRED_CONTENTS given contains old credentials contents",
+			fields: fields{
+				log: &log,
+				fs:  fs,
+				c: func() *cli.Context {
+					flagSet := flag.NewFlagSet("test0", flag.PanicOnError)
+					flagSet.String(CredContentsFlag, "", "")
+					c := cli.NewContext(cli.NewApp(), flagSet, nil)
+					_ = c.Set(CredContentsFlag, fmt.Sprintf(`{"AccountTag":"%s","TunnelSecret":"%s"}`, accountTag, secretB64))
+					return c
+				}(),
+			},
+			args: args{
+				tunnelID: tunnelID,
+			},
+			want: connection.Credentials{
+				AccountTag:   accountTag,
+				TunnelID:     tunnelID,
+				TunnelSecret: secret,
+			},
+		},
+		{
+			name: "TUNNEL_CRED_CONTENTS given contains new credentials contents",
+			fields: fields{
+				log: &log,
+				fs:  fs,
+				c: func() *cli.Context {
+					flagSet := flag.NewFlagSet("test0", flag.PanicOnError)
+					flagSet.String(CredContentsFlag, "", "")
+					c := cli.NewContext(cli.NewApp(), flagSet, nil)
+					_ = c.Set(CredContentsFlag, fmt.Sprintf(`{"AccountTag":"%s","TunnelSecret":"%s","TunnelID":"%s","TunnelName":"%s"}`, accountTag, secretB64, tunnelID, name))
+					return c
+				}(),
+			},
+			args: args{
+				tunnelID: tunnelID,
+			},
+			want: connection.Credentials{
+				AccountTag:   accountTag,
+				TunnelID:     tunnelID,
+				TunnelSecret: secret,
+				TunnelName:   name,
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

cmd/cloudflared/tunnel/subcommand_context_vnets.go

@@ -0,0 +1,40 @@
+package tunnel
+
+import (
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+
+	"github.com/cloudflare/cloudflared/vnet"
+)
+
+func (sc *subcommandContext) addVirtualNetwork(newVnet vnet.NewVirtualNetwork) (vnet.VirtualNetwork, error) {
+	client, err := sc.client()
+	if err != nil {
+		return vnet.VirtualNetwork{}, errors.Wrap(err, noClientMsg)
+	}
+	return client.CreateVirtualNetwork(newVnet)
+}
+
+func (sc *subcommandContext) listVirtualNetworks(filter *vnet.Filter) ([]*vnet.VirtualNetwork, error) {
+	client, err := sc.client()
+	if err != nil {
+		return nil, errors.Wrap(err, noClientMsg)
+	}
+	return client.ListVirtualNetworks(filter)
+}
+
+func (sc *subcommandContext) deleteVirtualNetwork(vnetId uuid.UUID) error {
+	client, err := sc.client()
+	if err != nil {
+		return errors.Wrap(err, noClientMsg)
+	}
+	return client.DeleteVirtualNetwork(vnetId)
+}
+
+func (sc *subcommandContext) updateVirtualNetwork(vnetId uuid.UUID, updates vnet.UpdateVirtualNetwork) error {
+	client, err := sc.client()
+	if err != nil {
+		return errors.Wrap(err, noClientMsg)
+	}
+	return client.UpdateVirtualNetwork(vnetId, updates)
+}

cmd/cloudflared/tunnel/subcommands.go

@@ -33,6 +33,7 @@ const (
 	connsSortByOptions   = "id, startedAt, numConnections, version"
 	CredFileFlagAlias    = "cred-file"
 	CredFileFlag         = "credentials-file"
+	CredContentsFlag     = "credentials-contents"
 	overwriteDNSFlagName = "overwrite-dns"
 
 	LogFieldTunnelID = "tunnelID"
@@ -111,8 +112,13 @@ var (
 		Usage:   "Filepath at which to read/write the tunnel credentials",
 		EnvVars: []string{"TUNNEL_CRED_FILE"},
 	}
-	credentialsFileFlag = altsrc.NewStringFlag(credentialsFileFlagCLIOnly)
-	forceDeleteFlag     = &cli.BoolFlag{
+	credentialsFileFlag     = altsrc.NewStringFlag(credentialsFileFlagCLIOnly)
+	credentialsContentsFlag = altsrc.NewStringFlag(&cli.StringFlag{
+		Name:    CredContentsFlag,
+		Usage:   "Contents of the tunnel credentials JSON file to use. When provided along with credentials-file, this will take precedence.",
+		EnvVars: []string{"TUNNEL_CRED_CONTENTS"},
+	})
+	forceDeleteFlag = &cli.BoolFlag{
 		Name:    "force",
 		Aliases: []string{"f"},
 		Usage: "Cleans up any stale connections before the tunnel is deleted. cloudflared will not " +
@@ -150,6 +156,12 @@ var (
 		Usage:   `Overwrites existing DNS records with this hostname`,
 		EnvVars: []string{"TUNNEL_FORCE_PROVISIONING_DNS"},
 	}
+	createSecretFlag = &cli.StringFlag{
+		Name:    "secret",
+		Aliases: []string{"s"},
+		Usage:   "Base64 encoded secret to set for the tunnel. The decoded secret must be at least 32 bytes long. If not specified, a random 32-byte secret will be generated.",
+		EnvVars: []string{"TUNNEL_CREATE_SECRET"},
+	}
 )
 
 func buildCreateCommand() *cli.Command {
@@ -164,7 +176,7 @@ func buildCreateCommand() *cli.Command {
   For example, to create a tunnel named 'my-tunnel' run:
 
   $ cloudflared tunnel create my-tunnel`,
-		Flags:              []cli.Flag{outputFormatFlag, credentialsFileFlagCLIOnly},
+		Flags:              []cli.Flag{outputFormatFlag, credentialsFileFlagCLIOnly, createSecretFlag},
 		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
@@ -190,7 +202,7 @@ func createCommand(c *cli.Context) error {
 	warningChecker := updater.StartWarningCheck(c)
 	defer warningChecker.LogWarningIfAny(sc.log)
 
-	_, err = sc.create(name, c.String(CredFileFlag))
+	_, err = sc.create(name, c.String(CredFileFlag), c.String(createSecretFlag.Name))
 	return errors.Wrap(err, "failed to create tunnel")
 }
 
@@ -271,6 +283,9 @@ func listCommand(c *cli.Context) error {
 		}
 		filter.ByTunnelID(tunnelID)
 	}
+	if maxFetch := c.Int("max-fetch-size"); maxFetch > 0 {
+		filter.MaxFetchSize(uint(maxFetch))
+	}
 
 	tunnels, err := sc.list(filter)
 	if err != nil {
@@ -314,7 +329,7 @@ func listCommand(c *cli.Context) error {
 	if len(tunnels) > 0 {
 		formatAndPrintTunnelList(tunnels, c.Bool("show-recently-disconnected"))
 	} else {
-		fmt.Println("You have no tunnels, use 'cloudflared tunnel create' to define a new tunnel")
+		fmt.Println("No tunnels were found for the given filter flags. You can use 'cloudflared tunnel create' to create a tunnel.")
 	}
 
 	return nil
@@ -579,6 +594,7 @@ func buildRunCommand() *cli.Command {
 	flags := []cli.Flag{
 		forceFlag,
 		credentialsFileFlag,
+		credentialsContentsFlag,
 		selectProtocolFlag,
 		featuresFlag,
 	}

cmd/cloudflared/tunnel/teamnet_subcommands.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"text/tabwriter"
 
+	"github.com/google/uuid"
 	"github.com/pkg/errors"
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
@@ -15,26 +16,45 @@ import (
 	"github.com/urfave/cli/v2"
 )
 
+var (
+	vnetFlag = &cli.StringFlag{
+		Name:    "virtual-network",
+		Aliases: []string{"vn"},
+		Usage:   "The ID or name of the virtual network to which the route is associated to.",
+	}
+)
+
 func buildRouteIPSubcommand() *cli.Command {
 	return &cli.Command{
 		Name:      "ip",
-		Usage:     "Configure and query Cloudflare WARP routing to services or private networks available through this tunnel.",
+		Usage:     "Configure and query Cloudflare WARP routing to private IP networks made available through Cloudflare Tunnels.",
 		UsageText: "cloudflared tunnel [--config FILEPATH] route COMMAND [arguments...]",
-		Description: `cloudflared can provision private routes from any IP space to origins in your corporate network.
-Users enrolled in your Cloudflare for Teams organization can reach those routes through the
-Cloudflare WARP client. You can also build rules to determine who can reach certain routes.`,
+		Description: `cloudflared can provision routes for any IP space in your corporate network. Users enrolled in
+your Cloudflare for Teams organization can reach those IPs through the Cloudflare WARP
+client. You can then configure L7/L4 filtering on https://dash.teams.cloudflare.com to
+determine who can reach certain routes.
+By default IP routes all exist within a single virtual network. If you use the same IP
+space(s) in different physical private networks, all meant to be reachable via IP routes,
+then you have to manage the ambiguous IP routes by associating them to virtual networks.
+See "cloudflared tunnel network --help" for more information.`,
 		Subcommands: []*cli.Command{
 			{
 				Name:      "add",
 				Action:    cliutil.ConfiguredAction(addRouteCommand),
-				Usage:     "Add any new network to the routing table reachable via the tunnel",
-				UsageText: "cloudflared tunnel [--config FILEPATH] route ip add [CIDR] [TUNNEL] [COMMENT?]",
-				Description: `Adds any network route space (represented as a CIDR) to your routing table.
-That network space becomes reachable for requests egressing from a user's machine
+				Usage:     "Add a new network to the routing table reachable via a Tunnel",
+				UsageText: "cloudflared tunnel [--config FILEPATH] route ip add [flags] [CIDR] [TUNNEL] [COMMENT?]",
+				Description: `Adds a network IP route space (represented as a CIDR) to your routing table.
+That network IP space becomes reachable for requests egressing from a user's machine
 as long as it is using Cloudflare WARP client and is enrolled in the same account
-that is running the tunnel chosen here. Further, those requests will be proxied to
-the specified tunnel, and reach an IP in the given CIDR, as long as that IP is
-reachable from the tunnel.`,
+that is running the Tunnel chosen here. Further, those requests will be proxied to
+the specified Tunnel, and reach an IP in the given CIDR, as long as that IP is
+reachable from cloudflared.
+If the CIDR exists in more than one private network, to be connected with Cloudflare
+Tunnels, then you have to manage those IP routes with virtual networks (see
+"cloudflared tunnel network --help)". In those cases, you then have to tell
+which virtual network's routing table you want to add the route to with:
+"cloudflared tunnel route ip add --virtual-network [ID/name] [CIDR] [TUNNEL]".`,
+				Flags: []cli.Flag{vnetFlag},
 			},
 			{
 				Name:        "show",
@@ -49,17 +69,22 @@ reachable from the tunnel.`,
 				Name:      "delete",
 				Action:    cliutil.ConfiguredAction(deleteRouteCommand),
 				Usage:     "Delete a row from your organization's private routing table",
-				UsageText: "cloudflared tunnel [--config FILEPATH] route ip delete [CIDR]",
-				Description: `Deletes the row for a given CIDR from your routing table. That portion
-of your network will no longer be reachable by the WARP clients.`,
+				UsageText: "cloudflared tunnel [--config FILEPATH] route ip delete [flags] [CIDR]",
+				Description: `Deletes the row for a given CIDR from your routing table. That portion of your network
+will no longer be reachable by the WARP clients. Note that if you use virtual
+networks, then you have to tell which virtual network whose routing table you
+have a row deleted from.`,
+				Flags: []cli.Flag{vnetFlag},
 			},
 			{
 				Name:      "get",
 				Action:    cliutil.ConfiguredAction(getRouteByIPCommand),
 				Usage:     "Check which row of the routing table matches a given IP.",
-				UsageText: "cloudflared tunnel [--config FILEPATH] route ip get [IP]",
-				Description: `Checks which row of the routing table will be used to proxy a given IP.
-				This helps check and validate your config.`,
+				UsageText: "cloudflared tunnel [--config FILEPATH] route ip get [flags] [IP]",
+				Description: `Checks which row of the routing table will be used to proxy a given IP. This helps check
+and validate your config. Note that if you use virtual networks, then you have
+to tell which virtual network whose routing table you want to use.`,
+				Flags: []cli.Flag{vnetFlag},
 			},
 		},
 	}
@@ -98,7 +123,7 @@ func showRoutesCommand(c *cli.Context) error {
 	if len(routes) > 0 {
 		formatAndPrintRouteList(routes)
 	} else {
-		fmt.Println("You have no routes, use 'cloudflared tunnel route ip add' to add a route")
+		fmt.Println("No routes were found for the given filter flags. You can use 'cloudflared tunnel route ip add' to add a route.")
 	}
 
 	return nil
@@ -112,7 +137,9 @@ func addRouteCommand(c *cli.Context) error {
 	if c.NArg() < 2 {
 		return errors.New("You must supply at least 2 arguments, first the network you wish to route (in CIDR form e.g. 1.2.3.4/32) and then the tunnel ID to proxy with")
 	}
+
 	args := c.Args()
+
 	_, network, err := net.ParseCIDR(args.Get(0))
 	if err != nil {
 		return errors.Wrap(err, "Invalid network CIDR")
@@ -120,19 +147,32 @@ func addRouteCommand(c *cli.Context) error {
 	if network == nil {
 		return errors.New("Invalid network CIDR")
 	}
+
 	tunnelRef := args.Get(1)
 	tunnelID, err := sc.findID(tunnelRef)
 	if err != nil {
 		return errors.Wrap(err, "Invalid tunnel")
 	}
+
 	comment := ""
 	if c.NArg() >= 3 {
 		comment = args.Get(2)
 	}
+
+	var vnetId *uuid.UUID
+	if c.IsSet(vnetFlag.Name) {
+		id, err := getVnetId(sc, c.String(vnetFlag.Name))
+		if err != nil {
+			return err
+		}
+		vnetId = &id
+	}
+
 	_, err = sc.addRoute(teamnet.NewRoute{
 		Comment:  comment,
 		Network:  *network,
 		TunnelID: tunnelID,
+		VNetID:   vnetId,
 	})
 	if err != nil {
 		return errors.Wrap(err, "API error")
@@ -146,9 +186,11 @@ func deleteRouteCommand(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
+
 	if c.NArg() != 1 {
 		return errors.New("You must supply exactly one argument, the network whose route you want to delete (in CIDR form e.g. 1.2.3.4/32)")
 	}
+
 	_, network, err := net.ParseCIDR(c.Args().First())
 	if err != nil {
 		return errors.Wrap(err, "Invalid network CIDR")
@@ -156,7 +198,20 @@ func deleteRouteCommand(c *cli.Context) error {
 	if network == nil {
 		return errors.New("Invalid network CIDR")
 	}
-	if err := sc.deleteRoute(*network); err != nil {
+
+	params := teamnet.DeleteRouteParams{
+		Network: *network,
+	}
+
+	if c.IsSet(vnetFlag.Name) {
+		vnetId, err := getVnetId(sc, c.String(vnetFlag.Name))
+		if err != nil {
+			return err
+		}
+		params.VNetID = &vnetId
+	}
+
+	if err := sc.deleteRoute(params); err != nil {
 		return errors.Wrap(err, "API error")
 	}
 	fmt.Printf("Successfully deleted route for %s\n", network)
@@ -177,7 +232,20 @@ func getRouteByIPCommand(c *cli.Context) error {
 	if ip == nil {
 		return fmt.Errorf("Invalid IP %s", ipInput)
 	}
-	route, err := sc.getRouteByIP(ip)
+
+	params := teamnet.GetRouteByIpParams{
+		Ip: ip,
+	}
+
+	if c.IsSet(vnetFlag.Name) {
+		vnetId, err := getVnetId(sc, c.String(vnetFlag.Name))
+		if err != nil {
+			return err
+		}
+		params.VNetID = &vnetId
+	}
+
+	route, err := sc.getRouteByIP(params)
 	if err != nil {
 		return errors.Wrap(err, "API error")
 	}
@@ -202,7 +270,7 @@ func formatAndPrintRouteList(routes []*teamnet.DetailedRoute) {
 	defer writer.Flush()
 
 	// Print column headers with tabbed columns
-	_, _ = fmt.Fprintln(writer, "NETWORK\tCOMMENT\tTUNNEL ID\tTUNNEL NAME\tCREATED\tDELETED\t")
+	_, _ = fmt.Fprintln(writer, "NETWORK\tVIRTUAL NET ID\tCOMMENT\tTUNNEL ID\tTUNNEL NAME\tCREATED\tDELETED\t")
 
 	// Loop through routes, create formatted string for each, and print using tabwriter
 	for _, route := range routes {

cmd/cloudflared/tunnel/vnets_subcommands.go

@@ -0,0 +1,285 @@
+package tunnel
+
+import (
+	"fmt"
+	"os"
+	"text/tabwriter"
+
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+	"github.com/urfave/cli/v2"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
+	"github.com/cloudflare/cloudflared/vnet"
+)
+
+var (
+	makeDefaultFlag = &cli.BoolFlag{
+		Name:    "default",
+		Aliases: []string{"d"},
+		Usage: "The virtual network becomes the default one for the account. This means that all operations that " +
+			"omit a virtual network will now implicitly be using this virtual network (i.e., the default one) such " +
+			"as new IP routes that are created. When this flag is not set, the virtual network will not become the " +
+			"default one in the account.",
+	}
+	newNameFlag = &cli.StringFlag{
+		Name:    "name",
+		Aliases: []string{"n"},
+		Usage:   "The new name for the virtual network.",
+	}
+	newCommentFlag = &cli.StringFlag{
+		Name:    "comment",
+		Aliases: []string{"c"},
+		Usage:   "A new comment describing the purpose of the virtual network.",
+	}
+)
+
+func buildVirtualNetworkSubcommand(hidden bool) *cli.Command {
+	return &cli.Command{
+		Name:      "network",
+		Usage:     "Configure and query virtual networks to manage private IP routes with overlapping IPs.",
+		UsageText: "cloudflared tunnel [--config FILEPATH] network COMMAND [arguments...]",
+		Description: `cloudflared allows to manage IP routes that expose origins in your private network space via their IP directly
+to clients outside (e.g. using WARP client) --- those are configurable via "cloudflared tunnel route ip" commands.
+By default, all those IP routes live in the same virtual network. Managing virtual networks (e.g. by creating a
+new one) becomes relevant when you have different private networks that have overlapping IPs. E.g.: if you have
+a private network A running Tunnel 1, and private network B running Tunnel 2, it is possible that both Tunnels
+expose the same IP space (say 10.0.0.0/8); to handle that, you have to add each IP Route (one that points to
+Tunnel 1 and another that points to Tunnel 2) in different Virtual Networks. That way, if your clients are on
+Virtual Network X, they will see Tunnel 1 (via Route A) and not see Tunnel 2 (since its Route B is associated
+to another Virtual Network Y).`,
+		Hidden: hidden,
+		Subcommands: []*cli.Command{
+			{
+				Name:      "add",
+				Action:    cliutil.ConfiguredAction(addVirtualNetworkCommand),
+				Usage:     "Add a new virtual network to which IP routes can be attached",
+				UsageText: "cloudflared tunnel [--config FILEPATH] network add [flags] NAME [\"comment\"]",
+				Description: `Adds a new virtual network. You can then attach IP routes to this virtual network with "cloudflared tunnel route ip"
+commands. By doing so, such route(s) become segregated from route(s) in another virtual networks. Note that all
+routes exist within some virtual network. If you do not specify any, then the system pre-creates a default virtual
+network to which all routes belong. That is fine if you do not have overlapping IPs within different physical
+private networks in your infrastructure exposed via Cloudflare Tunnel. Note: if a virtual network is added as
+the new default, then the previous existing default virtual network will be automatically modified to no longer
+be the current default.`,
+				Flags:  []cli.Flag{makeDefaultFlag},
+				Hidden: hidden,
+			},
+			{
+				Name:        "list",
+				Action:      cliutil.ConfiguredAction(listVirtualNetworksCommand),
+				Usage:       "Lists the virtual networks",
+				UsageText:   "cloudflared tunnel [--config FILEPATH] network list [flags]",
+				Description: "Lists the virtual networks based on the given filter flags.",
+				Flags:       listVirtualNetworksFlags(),
+				Hidden:      hidden,
+			},
+			{
+				Name:      "delete",
+				Action:    cliutil.ConfiguredAction(deleteVirtualNetworkCommand),
+				Usage:     "Delete a virtual network",
+				UsageText: "cloudflared tunnel [--config FILEPATH] network delete VIRTUAL_NETWORK",
+				Description: `Deletes the virtual network (given its ID or name). This is only possible if that virtual network is unused. 
+A virtual network may be used by IP routes or by WARP devices.`,
+				Hidden: hidden,
+			},
+			{
+				Name:      "update",
+				Action:    cliutil.ConfiguredAction(updateVirtualNetworkCommand),
+				Usage:     "Update a virtual network",
+				UsageText: "cloudflared tunnel [--config FILEPATH] network update [flags] VIRTUAL_NETWORK",
+				Description: `Updates the virtual network (given its ID or name). If this virtual network is updated to become the new
+default, then the previously existing default virtual network will also be modified to no longer be the default.
+You cannot update a virtual network to not be the default anymore directly. Instead, you should create a new
+default or update an existing one to become the default.`,
+				Flags:  []cli.Flag{newNameFlag, newCommentFlag, makeDefaultFlag},
+				Hidden: hidden,
+			},
+		},
+	}
+}
+
+func listVirtualNetworksFlags() []cli.Flag {
+	flags := make([]cli.Flag, 0)
+	flags = append(flags, vnet.FilterFlags...)
+	flags = append(flags, outputFormatFlag)
+	return flags
+}
+
+func addVirtualNetworkCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+	if c.NArg() < 1 {
+		return errors.New("You must supply at least 1 argument, the name of the virtual network you wish to add.")
+	}
+
+	warningChecker := updater.StartWarningCheck(c)
+	defer warningChecker.LogWarningIfAny(sc.log)
+
+	args := c.Args()
+
+	name := args.Get(0)
+
+	comment := ""
+	if c.NArg() >= 2 {
+		comment = args.Get(1)
+	}
+
+	newVnet := vnet.NewVirtualNetwork{
+		Name:      name,
+		Comment:   comment,
+		IsDefault: c.Bool(makeDefaultFlag.Name),
+	}
+	createdVnet, err := sc.addVirtualNetwork(newVnet)
+
+	if err != nil {
+		return errors.Wrap(err, "Could not add virtual network")
+	}
+
+	extraMsg := ""
+	if createdVnet.IsDefault {
+		extraMsg = " (as the new default for this account) "
+	}
+	fmt.Printf(
+		"Successfully added virtual 'network' %s with ID: %s%s\n"+
+			"You can now add IP routes attached to this virtual network. See `cloudflared tunnel route ip add -help`\n",
+		name, createdVnet.ID, extraMsg,
+	)
+	return nil
+}
+
+func listVirtualNetworksCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+
+	warningChecker := updater.StartWarningCheck(c)
+	defer warningChecker.LogWarningIfAny(sc.log)
+
+	filter, err := vnet.NewFromCLI(c)
+	if err != nil {
+		return errors.Wrap(err, "invalid flags for filtering virtual networks")
+	}
+
+	vnets, err := sc.listVirtualNetworks(filter)
+	if err != nil {
+		return err
+	}
+
+	if outputFormat := c.String(outputFormatFlag.Name); outputFormat != "" {
+		return renderOutput(outputFormat, vnets)
+	}
+
+	if len(vnets) > 0 {
+		formatAndPrintVnetsList(vnets)
+	} else {
+		fmt.Println("No virtual networks were found for the given filter flags. You can use 'cloudflared tunnel network add' to add a virtual network.")
+	}
+
+	return nil
+}
+
+func deleteVirtualNetworkCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+	if c.NArg() != 1 {
+		return errors.New("You must supply exactly one argument, either the ID or name of the virtual network to delete")
+	}
+
+	input := c.Args().Get(0)
+	vnetId, err := getVnetId(sc, input)
+	if err != nil {
+		return err
+	}
+
+	if err := sc.deleteVirtualNetwork(vnetId); err != nil {
+		return errors.Wrap(err, "API error")
+	}
+	fmt.Printf("Successfully deleted virtual network '%s'\n", input)
+	return nil
+}
+
+func updateVirtualNetworkCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+	if c.NArg() != 1 {
+		return errors.New(" You must supply exactly one argument, either the ID or (current) name of the virtual network to update")
+	}
+
+	input := c.Args().Get(0)
+	vnetId, err := getVnetId(sc, input)
+	if err != nil {
+		return err
+	}
+
+	updates := vnet.UpdateVirtualNetwork{}
+
+	if c.IsSet(newNameFlag.Name) {
+		newName := c.String(newNameFlag.Name)
+		updates.Name = &newName
+	}
+	if c.IsSet(newCommentFlag.Name) {
+		newComment := c.String(newCommentFlag.Name)
+		updates.Comment = &newComment
+	}
+	if c.IsSet(makeDefaultFlag.Name) {
+		isDefault := c.Bool(makeDefaultFlag.Name)
+		updates.IsDefault = &isDefault
+	}
+
+	if err := sc.updateVirtualNetwork(vnetId, updates); err != nil {
+		return errors.Wrap(err, "API error")
+	}
+	fmt.Printf("Successfully updated virtual network '%s'\n", input)
+	return nil
+}
+
+func getVnetId(sc *subcommandContext, input string) (uuid.UUID, error) {
+	val, err := uuid.Parse(input)
+	if err == nil {
+		return val, nil
+	}
+
+	filter := vnet.NewFilter()
+	filter.WithDeleted(false)
+	filter.ByName(input)
+
+	vnets, err := sc.listVirtualNetworks(filter)
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	if len(vnets) != 1 {
+		return uuid.Nil, fmt.Errorf("there should only be 1 non-deleted virtual network named %s", input)
+	}
+
+	return vnets[0].ID, nil
+}
+
+func formatAndPrintVnetsList(vnets []*vnet.VirtualNetwork) {
+	const (
+		minWidth = 0
+		tabWidth = 8
+		padding  = 1
+		padChar  = ' '
+		flags    = 0
+	)
+
+	writer := tabwriter.NewWriter(os.Stdout, minWidth, tabWidth, padding, padChar, flags)
+	defer writer.Flush()
+
+	_, _ = fmt.Fprintln(writer, "ID\tNAME\tIS DEFAULT\tCOMMENT\tCREATED\tDELETED\t")
+
+	for _, virtualNetwork := range vnets {
+		formattedStr := virtualNetwork.TableString()
+		_, _ = fmt.Fprintln(writer, formattedStr)
+	}
+}

cmd/cloudflared/updater/update.go

@@ -19,7 +19,7 @@ import (
 
 const (
 	DefaultCheckUpdateFreq        = time.Hour * 24
-	noUpdateInShellMessage        = "cloudflared will not automatically update when run from the shell. To enable auto-updates, run cloudflared as a service: https://developers.cloudflare.com/argo-tunnel/reference/service/"
+	noUpdateInShellMessage        = "cloudflared will not automatically update when run from the shell. To enable auto-updates, run cloudflared as a service: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/run-as-service"
 	noUpdateOnWindowsMessage      = "cloudflared will not automatically update on Windows systems."
 	noUpdateManagedPackageMessage = "cloudflared will not automatically update if installed by a package manager."
 	isManagedInstallFile          = ".installedFromPackageManager"

cmd/cloudflared/updater/workers_service_test.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package updater

cmd/cloudflared/updater/workers_update.go

@@ -47,7 +47,7 @@ type batchData struct {
 }
 
 // WorkersVersion implements the Version interface.
-// It contains everything needed to preform a version upgrade
+// It contains everything needed to perform a version upgrade
 type WorkersVersion struct {
 	downloadURL  string
 	checksum     string

cmd/cloudflared/windows_service.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package main
@@ -25,8 +26,8 @@ import (
 
 const (
 	windowsServiceName        = "Cloudflared"
-	windowsServiceDescription = "Argo Tunnel agent"
-	windowsServiceUrl         = "https://developers.cloudflare.com/argo-tunnel/reference/service/"
+	windowsServiceDescription = "Cloudflare Tunnel agent"
+	windowsServiceUrl         = "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/run-as-service#windows"
 
 	recoverActionDelay      = time.Second * 20
 	failureCountResetPeriod = time.Hour * 24
@@ -45,16 +46,16 @@ const (
 func runApp(app *cli.App, graceShutdownC chan struct{}) {
 	app.Commands = append(app.Commands, &cli.Command{
 		Name:  "service",
-		Usage: "Manages the Argo Tunnel Windows service",
+		Usage: "Manages the Cloudflare Tunnel Windows service",
 		Subcommands: []*cli.Command{
 			{
 				Name:   "install",
-				Usage:  "Install Argo Tunnel as a Windows service",
+				Usage:  "Install Cloudflare Tunnel as a Windows service",
 				Action: cliutil.ConfiguredAction(installWindowsService),
 			},
 			{
 				Name:   "uninstall",
-				Usage:  "Uninstall the Argo Tunnel service",
+				Usage:  "Uninstall the Cloudflare Tunnel service",
 				Action: cliutil.ConfiguredAction(uninstallWindowsService),
 			},
 		},
@@ -176,7 +177,7 @@ func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeReques
 func installWindowsService(c *cli.Context) error {
 	zeroLogger := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
 
-	zeroLogger.Info().Msg("Installing Argo Tunnel Windows service")
+	zeroLogger.Info().Msg("Installing Cloudflare Tunnel Windows service")
 	exepath, err := os.Executable()
 	if err != nil {
 		return errors.Wrap(err, "Cannot find path name that start the process")
@@ -198,7 +199,7 @@ func installWindowsService(c *cli.Context) error {
 		return errors.Wrap(err, "Cannot install service")
 	}
 	defer s.Close()
-	log.Info().Msg("Argo Tunnel agent service is installed")
+	log.Info().Msg("Cloudflare Tunnel agent service is installed")
 	err = eventlog.InstallAsEventCreate(windowsServiceName, eventlog.Error|eventlog.Warning|eventlog.Info)
 	if err != nil {
 		s.Delete()
@@ -217,7 +218,7 @@ func uninstallWindowsService(c *cli.Context) error {
 		With().
 		Str(LogFieldWindowsServiceName, windowsServiceName).Logger()
 
-	log.Info().Msg("Uninstalling Argo Tunnel Windows Service")
+	log.Info().Msg("Uninstalling Cloudflare Tunnel Windows Service")
 	m, err := mgr.Connect()
 	if err != nil {
 		return errors.Wrap(err, "Cannot establish a connection to the service control manager")
@@ -232,7 +233,7 @@ func uninstallWindowsService(c *cli.Context) error {
 	if err != nil {
 		return errors.Wrap(err, "Cannot delete service")
 	}
-	log.Info().Msg("Argo Tunnel agent service is uninstalled")
+	log.Info().Msg("Cloudflare Tunnel agent service is uninstalled")
 	err = eventlog.Remove(windowsServiceName)
 	if err != nil {
 		return errors.Wrap(err, "Cannot remove event logger")

component-tests/test_logging.py

@@ -17,7 +17,7 @@ def assert_log_to_terminal(cloudflared):
 
 def assert_log_in_file(file):
     with open(file, "r") as f:
-        log = f.read(1850)
+        log = f.read(2000)
         assert expect_message in log, f"{log} doesn't contain {expect_message}"
 
 
@@ -75,7 +75,7 @@ class TestLogging:
         }
         config = component_tests_config(extra_config)
         with start_cloudflared(tmp_path, config, new_process=True, capture_output=False):
-            wait_tunnel_ready(tunnel_url=config.get_url())
+            wait_tunnel_ready(tunnel_url=config.get_url(), cfd_logs=str(log_file))
             assert_log_in_file(log_file)
             assert_json_log(log_file)
 
@@ -88,5 +88,5 @@ class TestLogging:
         }
         config = component_tests_config(extra_config)
         with start_cloudflared(tmp_path, config, new_process=True, capture_output=False):
-            wait_tunnel_ready(tunnel_url=config.get_url())
+            wait_tunnel_ready(tunnel_url=config.get_url(), cfd_logs=str(log_dir))
             assert_log_to_dir(config, log_dir)

component-tests/util.py

@@ -1,12 +1,13 @@
-from contextlib import contextmanager
 import logging
-import requests
-from retrying import retry
+import os
 import subprocess
-import yaml
-
+from contextlib import contextmanager
 from time import sleep
 
+import requests
+import yaml
+from retrying import retry
+
 from constants import METRICS_PORT, MAX_RETRIES, BACKOFF_SECS
 
 LOGGER = logging.getLogger(__name__)
@@ -19,7 +20,8 @@ def write_config(directory, config):
     return config_path
 
 
-def start_cloudflared(directory, config, cfd_args=["run"], cfd_pre_args=["tunnel"], new_process=False, allow_input=False, capture_output=True, root=False):
+def start_cloudflared(directory, config, cfd_args=["run"], cfd_pre_args=["tunnel"], new_process=False,
+                      allow_input=False, capture_output=True, root=False):
     config_path = write_config(directory, config.full_config)
     cmd = cloudflared_cmd(config, config_path, cfd_args, cfd_pre_args, root)
     if new_process:
@@ -53,18 +55,42 @@ def run_cloudflared_background(cmd, allow_input, capture_output):
             LOGGER.info(f"cloudflared log: {cfd.stderr.read()}")
 
 
+def wait_tunnel_ready(tunnel_url=None, require_min_connections=1, cfd_logs=None):
+    try:
+        inner_wait_tunnel_ready(tunnel_url, require_min_connections)
+    except Exception as e:
+        if cfd_logs is not None:
+            _log_cloudflared_logs(cfd_logs)
+        raise e
+
+
 @retry(stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
-def wait_tunnel_ready(tunnel_url=None, require_min_connections=1):
+def inner_wait_tunnel_ready(tunnel_url=None, require_min_connections=1):
     metrics_url = f'http://localhost:{METRICS_PORT}/ready'
 
     with requests.Session() as s:
         resp = send_request(s, metrics_url, True)
-        assert resp.json()[
-            "readyConnections"] >= require_min_connections, f"Ready endpoint returned {resp.json()} but we expect at least {require_min_connections} connections"
+
+        assert resp.json()["readyConnections"] >= require_min_connections, \
+            f"Ready endpoint returned {resp.json()} but we expect at least {require_min_connections} connections"
+
         if tunnel_url is not None:
             send_request(s, tunnel_url, True)
 
 
+def _log_cloudflared_logs(cfd_logs):
+    log_file = cfd_logs
+    if os.path.isdir(cfd_logs):
+        files = os.listdir(cfd_logs)
+        if len(files) == 0:
+            return
+        log_file = os.path.join(cfd_logs, files[0])
+    with open(log_file, "r") as f:
+        LOGGER.warning("Cloudflared Tunnel was not ready:")
+        for line in f.readlines():
+            LOGGER.warning(line)
+
+
 @retry(stop_max_attempt_number=MAX_RETRIES * BACKOFF_SECS, wait_fixed=1000)
 def check_tunnel_not_connected():
     url = f'http://localhost:{METRICS_PORT}/ready'

connection/connection.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"math"
 	"net/http"
 	"strconv"
 	"strings"
@@ -18,6 +19,8 @@ import (
 const (
 	lbProbeUserAgentPrefix = "Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/;"
 	LogFieldConnIndex      = "connIndex"
+	MaxGracePeriod         = time.Minute * 3
+	MaxConcurrentStreams   = math.MaxUint32
 )
 
 var switchingProtocolText = fmt.Sprintf("%d %s", http.StatusSwitchingProtocols, http.StatusText(http.StatusSwitchingProtocols))

connection/control.go

@@ -29,7 +29,7 @@ type controlStream struct {
 
 // ControlStreamHandler registers connections with origintunneld and initiates graceful shutdown.
 type ControlStreamHandler interface {
-	ServeControlStream(ctx context.Context, rw io.ReadWriteCloser, connOptions *tunnelpogs.ConnectionOptions) error
+	ServeControlStream(ctx context.Context, rw io.ReadWriteCloser, connOptions *tunnelpogs.ConnectionOptions, shouldWaitForUnregister bool) error
 	IsStopped() bool
 }
 
@@ -61,16 +61,28 @@ func (c *controlStream) ServeControlStream(
 	ctx context.Context,
 	rw io.ReadWriteCloser,
 	connOptions *tunnelpogs.ConnectionOptions,
+	shouldWaitForUnregister bool,
 ) error {
 	rpcClient := c.newRPCClientFunc(ctx, rw, c.observer.log)
-	defer rpcClient.Close()
 
 	if err := rpcClient.RegisterConnection(ctx, c.namedTunnelConfig, connOptions, c.connIndex, c.observer); err != nil {
+		rpcClient.Close()
 		return err
 	}
 	c.connectedFuse.Connected()
 
+	if shouldWaitForUnregister {
+		c.waitForUnregister(ctx, rpcClient)
+	} else {
+		go c.waitForUnregister(ctx, rpcClient)
+	}
+
+	return nil
+}
+
+func (c *controlStream) waitForUnregister(ctx context.Context, rpcClient NamedTunnelRPCClient) {
 	// wait for connection termination or start of graceful shutdown
+	defer rpcClient.Close()
 	select {
 	case <-ctx.Done():
 		break
@@ -81,7 +93,6 @@ func (c *controlStream) ServeControlStream(
 	c.observer.sendUnregisteringEvent(c.connIndex)
 	rpcClient.GracefulShutdown(ctx, c.gracePeriod)
 	c.observer.log.Info().Uint8(LogFieldConnIndex, c.connIndex).Msg("Unregistered tunnel connection")
-	return nil
 }
 
 func (c *controlStream) IsStopped() bool {

connection/h2mux_header.go

@@ -0,0 +1,128 @@
+package connection
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+)
+
+// H2RequestHeadersToH1Request converts the HTTP/2 headers coming from origintunneld
+// to an HTTP/1 Request object destined for the local origin web service.
+// This operation includes conversion of the pseudo-headers into their closest
+// HTTP/1 equivalents. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
+func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
+	for _, header := range h2 {
+		name := strings.ToLower(header.Name)
+		if !IsH2muxControlRequestHeader(name) {
+			continue
+		}
+
+		switch name {
+		case ":method":
+			h1.Method = header.Value
+		case ":scheme":
+			// noop - use the preexisting scheme from h1.URL
+		case ":authority":
+			// Otherwise the host header will be based on the origin URL
+			h1.Host = header.Value
+		case ":path":
+			// We don't want to be an "opinionated" proxy, so ideally we would use :path as-is.
+			// However, this HTTP/1 Request object belongs to the Go standard library,
+			// whose URL package makes some opinionated decisions about the encoding of
+			// URL characters: see the docs of https://godoc.org/net/url#URL,
+			// in particular the EscapedPath method https://godoc.org/net/url#URL.EscapedPath,
+			// which is always used when computing url.URL.String(), whether we'd like it or not.
+			//
+			// Well, not *always*. We could circumvent this by using url.URL.Opaque. But
+			// that would present unusual difficulties when using an HTTP proxy: url.URL.Opaque
+			// is treated differently when HTTP_PROXY is set!
+			// See https://github.com/golang/go/issues/5684#issuecomment-66080888
+			//
+			// This means we are subject to the behavior of net/url's function `shouldEscape`
+			// (as invoked with mode=encodePath): https://github.com/golang/go/blob/go1.12.7/src/net/url/url.go#L101
+
+			if header.Value == "*" {
+				h1.URL.Path = "*"
+				continue
+			}
+			// Due to the behavior of validation.ValidateUrl, h1.URL may
+			// already have a partial value, with or without a trailing slash.
+			base := h1.URL.String()
+			base = strings.TrimRight(base, "/")
+			// But we know :path begins with '/', because we handled '*' above - see RFC7540
+			requestURL, err := url.Parse(base + header.Value)
+			if err != nil {
+				return errors.Wrap(err, fmt.Sprintf("invalid path '%v'", header.Value))
+			}
+			h1.URL = requestURL
+		case "content-length":
+			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
+			if err != nil {
+				return fmt.Errorf("unparseable content length")
+			}
+			h1.ContentLength = contentLength
+		case RequestUserHeaders:
+			// Do not forward the serialized headers to the origin -- deserialize them, and ditch the serialized version
+			// Find and parse user headers serialized into a single one
+			userHeaders, err := DeserializeHeaders(header.Value)
+			if err != nil {
+				return errors.Wrap(err, "Unable to parse user headers")
+			}
+			for _, userHeader := range userHeaders {
+				h1.Header.Add(userHeader.Name, userHeader.Value)
+			}
+		default:
+			// All other control headers shall just be proxied transparently
+			h1.Header.Add(header.Name, header.Value)
+		}
+	}
+
+	return nil
+}
+
+func H1ResponseToH2ResponseHeaders(status int, h1 http.Header) (h2 []h2mux.Header) {
+	h2 = []h2mux.Header{
+		{Name: ":status", Value: strconv.Itoa(status)},
+	}
+	userHeaders := make(http.Header, len(h1))
+	for header, values := range h1 {
+		h2name := strings.ToLower(header)
+		if h2name == "content-length" {
+			// This header has meaning in HTTP/2 and will be used by the edge,
+			// so it should be sent as an HTTP/2 response header.
+
+			// Since these are http2 headers, they're required to be lowercase
+			h2 = append(h2, h2mux.Header{Name: "content-length", Value: values[0]})
+		} else if !IsH2muxControlResponseHeader(h2name) || IsWebsocketClientHeader(h2name) {
+			// User headers, on the other hand, must all be serialized so that
+			// HTTP/2 header validation won't be applied to HTTP/1 header values
+			userHeaders[header] = values
+		}
+	}
+
+	// Perform user header serialization and set them in the single header
+	h2 = append(h2, h2mux.Header{Name: ResponseUserHeaders, Value: SerializeHeaders(userHeaders)})
+	return h2
+}
+
+// IsH2muxControlRequestHeader is called in the direction of eyeball -> origin.
+func IsH2muxControlRequestHeader(headerName string) bool {
+	return headerName == "content-length" ||
+		headerName == "connection" || headerName == "upgrade" || // Websocket request headers
+		strings.HasPrefix(headerName, ":") ||
+		strings.HasPrefix(headerName, "cf-")
+}
+
+// IsH2muxControlResponseHeader is called in the direction of eyeball <- origin.
+func IsH2muxControlResponseHeader(headerName string) bool {
+	return headerName == "content-length" ||
+		strings.HasPrefix(headerName, ":") ||
+		strings.HasPrefix(headerName, "cf-int-") ||
+		strings.HasPrefix(headerName, "cf-cloudflared-")
+}

connection/h2mux_header_test.go

@@ -0,0 +1,642 @@
+package connection
+
+import (
+	"fmt"
+	"math/rand"
+	"net/http"
+	"net/url"
+	"reflect"
+	"regexp"
+	"strings"
+	"testing"
+	"testing/quick"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+)
+
+type ByName []h2mux.Header
+
+func (a ByName) Len() int      { return len(a) }
+func (a ByName) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
+func (a ByName) Less(i, j int) bool {
+	if a[i].Name == a[j].Name {
+		return a[i].Value < a[j].Value
+	}
+
+	return a[i].Name < a[j].Name
+}
+
+func TestH2RequestHeadersToH1Request_RegularHeaders(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	mockHeaders := http.Header{
+		"Mock header 1": {"Mock value 1"},
+		"Mock header 2": {"Mock value 2"},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(createSerializedHeaders(RequestUserHeaders, mockHeaders), request)
+
+	assert.True(t, reflect.DeepEqual(mockHeaders, request.Header))
+	assert.NoError(t, headersConversionErr)
+}
+
+func createSerializedHeaders(headersField string, headers http.Header) []h2mux.Header {
+	return []h2mux.Header{{
+		Name:  headersField,
+		Value: SerializeHeaders(headers),
+	}}
+}
+
+func TestH2RequestHeadersToH1Request_NoHeaders(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	emptyHeaders := make(http.Header)
+	headersConversionErr := H2RequestHeadersToH1Request(
+		[]h2mux.Header{{
+			Name:  RequestUserHeaders,
+			Value: SerializeHeaders(emptyHeaders),
+		}},
+		request,
+	)
+
+	assert.True(t, reflect.DeepEqual(emptyHeaders, request.Header))
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_InvalidHostPath(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	mockRequestHeaders := []h2mux.Header{
+		{Name: ":path", Value: "//bad_path/"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com//bad_path/", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_HostPathWithQuery(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
+	assert.NoError(t, err)
+
+	mockRequestHeaders := []h2mux.Header{
+		{Name: ":path", Value: "/?query=mock%20value"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com/?query=mock%20value", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_HostPathWithURLEncoding(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
+	assert.NoError(t, err)
+
+	mockRequestHeaders := []h2mux.Header{
+		{Name: ":path", Value: "/mock%20path"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com/mock%20path", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_WeirdURLs(t *testing.T) {
+	type testCase struct {
+		path string
+		want string
+	}
+	testCases := []testCase{
+		{
+			path: "",
+			want: "",
+		},
+		{
+			path: "/",
+			want: "/",
+		},
+		{
+			path: "//",
+			want: "//",
+		},
+		{
+			path: "/test",
+			want: "/test",
+		},
+		{
+			path: "//test",
+			want: "//test",
+		},
+		{
+			// https://github.com/cloudflare/cloudflared/issues/81
+			path: "//test/",
+			want: "//test/",
+		},
+		{
+			path: "/%2Ftest",
+			want: "/%2Ftest",
+		},
+		{
+			path: "//%20test",
+			want: "//%20test",
+		},
+		{
+			// https://github.com/cloudflare/cloudflared/issues/124
+			path: "/test?get=somthing%20a",
+			want: "/test?get=somthing%20a",
+		},
+		{
+			path: "/%20",
+			want: "/%20",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode ' '
+			path: "/ ",
+			want: "/%20",
+		},
+		{
+			path: "/ a ",
+			want: "/%20a%20",
+		},
+		{
+			path: "/a%20b",
+			want: "/a%20b",
+		},
+		{
+			path: "/foo/bar;param?query#frag",
+			want: "/foo/bar;param?query#frag",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode non-ASCII chars
+			path: "/a␠b",
+			want: "/a%E2%90%A0b",
+		},
+		{
+			path: "/a-umlaut-ä",
+			want: "/a-umlaut-%C3%A4",
+		},
+		{
+			path: "/a-umlaut-%C3%A4",
+			want: "/a-umlaut-%C3%A4",
+		},
+		{
+			path: "/a-umlaut-%c3%a4",
+			want: "/a-umlaut-%c3%a4",
+		},
+		{
+			// here the second '#' is treated as part of the fragment
+			path: "/a#b#c",
+			want: "/a#b%23c",
+		},
+		{
+			path: "/a#b␠c",
+			want: "/a#b%E2%90%A0c",
+		},
+		{
+			path: "/a#b%20c",
+			want: "/a#b%20c",
+		},
+		{
+			path: "/a#b c",
+			want: "/a#b%20c",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode '\'
+			path: "/\\",
+			want: "/%5C",
+		},
+		{
+			path: "/a\\",
+			want: "/a%5C",
+		},
+		{
+			path: "/a,b.c.",
+			want: "/a,b.c.",
+		},
+		{
+			path: "/.",
+			want: "/.",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode '`'
+			path: "/a`",
+			want: "/a%60",
+		},
+		{
+			path: "/a[0]",
+			want: "/a[0]",
+		},
+		{
+			path: "/?a[0]=5 &b[]=",
+			want: "/?a[0]=5 &b[]=",
+		},
+		{
+			path: "/?a=%22b%20%22",
+			want: "/?a=%22b%20%22",
+		},
+	}
+
+	for index, testCase := range testCases {
+		requestURL := "https://example.com"
+
+		request, err := http.NewRequest(http.MethodGet, requestURL, nil)
+		assert.NoError(t, err)
+
+		mockRequestHeaders := []h2mux.Header{
+			{Name: ":path", Value: testCase.path},
+			{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+		}
+
+		headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+		assert.NoError(t, headersConversionErr)
+
+		assert.Equal(t,
+			http.Header{
+				"Mock header": []string{"Mock value"},
+			},
+			request.Header)
+
+		assert.Equal(t,
+			"https://example.com"+testCase.want,
+			request.URL.String(),
+			"Failed URL index: %v %#v", index, testCase)
+	}
+}
+
+func TestH2RequestHeadersToH1Request_QuickCheck(t *testing.T) {
+	config := &quick.Config{
+		Values: func(args []reflect.Value, rand *rand.Rand) {
+			args[0] = reflect.ValueOf(randomHTTP2Path(t, rand))
+		},
+	}
+
+	type testOrigin struct {
+		url string
+
+		expectedScheme   string
+		expectedBasePath string
+	}
+	testOrigins := []testOrigin{
+		{
+			url:              "http://origin.hostname.example.com:8080",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080",
+		},
+		{
+			url:              "http://origin.hostname.example.com:8080/",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080",
+		},
+		{
+			url:              "http://origin.hostname.example.com:8080/api",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080/api",
+		},
+		{
+			url:              "http://origin.hostname.example.com:8080/api/",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080/api",
+		},
+		{
+			url:              "https://origin.hostname.example.com:8080/api",
+			expectedScheme:   "https",
+			expectedBasePath: "https://origin.hostname.example.com:8080/api",
+		},
+	}
+
+	// use multiple schemes to demonstrate that the URL is based on the
+	// origin's scheme, not the :scheme header
+	for _, testScheme := range []string{"http", "https"} {
+		for _, testOrigin := range testOrigins {
+			assertion := func(testPath string) bool {
+				const expectedMethod = "POST"
+				const expectedHostname = "request.hostname.example.com"
+
+				h2 := []h2mux.Header{
+					{Name: ":method", Value: expectedMethod},
+					{Name: ":scheme", Value: testScheme},
+					{Name: ":authority", Value: expectedHostname},
+					{Name: ":path", Value: testPath},
+					{Name: RequestUserHeaders, Value: ""},
+				}
+				h1, err := http.NewRequest("GET", testOrigin.url, nil)
+				require.NoError(t, err)
+
+				err = H2RequestHeadersToH1Request(h2, h1)
+				return assert.NoError(t, err) &&
+					assert.Equal(t, expectedMethod, h1.Method) &&
+					assert.Equal(t, expectedHostname, h1.Host) &&
+					assert.Equal(t, testOrigin.expectedScheme, h1.URL.Scheme) &&
+					assert.Equal(t, testOrigin.expectedBasePath+testPath, h1.URL.String())
+			}
+			err := quick.Check(assertion, config)
+			assert.NoError(t, err)
+		}
+	}
+}
+
+func randomASCIIPrintableChar(rand *rand.Rand) int {
+	// smallest printable ASCII char is 32, largest is 126
+	const startPrintable = 32
+	const endPrintable = 127
+	return startPrintable + rand.Intn(endPrintable-startPrintable)
+}
+
+// randomASCIIText generates an ASCII string, some of whose characters may be
+// percent-encoded. Its "logical length" (ignoring percent-encoding) is
+// between 1 and `maxLength`.
+func randomASCIIText(rand *rand.Rand, minLength int, maxLength int) string {
+	length := minLength + rand.Intn(maxLength)
+	var result strings.Builder
+	for i := 0; i < length; i++ {
+		c := randomASCIIPrintableChar(rand)
+
+		// 1/4 chance of using percent encoding when not necessary
+		if c == '%' || rand.Intn(4) == 0 {
+			result.WriteString(fmt.Sprintf("%%%02X", c))
+		} else {
+			result.WriteByte(byte(c))
+		}
+	}
+	return result.String()
+}
+
+// Calls `randomASCIIText` and ensures the result is a valid URL path,
+// i.e. one that can pass unchanged through url.URL.String()
+func randomHTTP1Path(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
+	text := randomASCIIText(rand, minLength, maxLength)
+	re, err := regexp.Compile("[^/;,]*")
+	require.NoError(t, err)
+	return "/" + re.ReplaceAllStringFunc(text, url.PathEscape)
+}
+
+// Calls `randomASCIIText` and ensures the result is a valid URL query,
+// i.e. one that can pass unchanged through url.URL.String()
+func randomHTTP1Query(rand *rand.Rand, minLength int, maxLength int) string {
+	text := randomASCIIText(rand, minLength, maxLength)
+	return "?" + strings.ReplaceAll(text, "#", "%23")
+}
+
+// Calls `randomASCIIText` and ensures the result is a valid URL fragment,
+// i.e. one that can pass unchanged through url.URL.String()
+func randomHTTP1Fragment(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
+	text := randomASCIIText(rand, minLength, maxLength)
+	u, err := url.Parse("#" + text)
+	require.NoError(t, err)
+	return u.String()
+}
+
+// Assemble a random :path pseudoheader that is legal by Go stdlib standards
+// (i.e. all characters will satisfy "net/url".shouldEscape for their respective locations)
+func randomHTTP2Path(t *testing.T, rand *rand.Rand) string {
+	result := randomHTTP1Path(t, rand, 1, 64)
+	if rand.Intn(2) == 1 {
+		result += randomHTTP1Query(rand, 1, 32)
+	}
+	if rand.Intn(2) == 1 {
+		result += randomHTTP1Fragment(t, rand, 1, 16)
+	}
+	return result
+}
+
+func stdlibHeaderToH2muxHeader(headers http.Header) (h2muxHeaders []h2mux.Header) {
+	for name, values := range headers {
+		for _, value := range values {
+			h2muxHeaders = append(h2muxHeaders, h2mux.Header{Name: name, Value: value})
+		}
+	}
+
+	return h2muxHeaders
+}
+
+func TestParseRequestHeaders(t *testing.T) {
+	mockUserHeadersToSerialize := http.Header{
+		"Mock-Header-One":   {"1", "1.5"},
+		"Mock-Header-Two":   {"2"},
+		"Mock-Header-Three": {"3"},
+	}
+
+	mockHeaders := []h2mux.Header{
+		{Name: "One", Value: "1"}, // will be dropped
+		{Name: "Cf-Two", Value: "cf-value-1"},
+		{Name: "Cf-Two", Value: "cf-value-2"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(mockUserHeadersToSerialize)},
+	}
+
+	expectedHeaders := []h2mux.Header{
+		{Name: "Cf-Two", Value: "cf-value-1"},
+		{Name: "Cf-Two", Value: "cf-value-2"},
+		{Name: "Mock-Header-One", Value: "1"},
+		{Name: "Mock-Header-One", Value: "1.5"},
+		{Name: "Mock-Header-Two", Value: "2"},
+		{Name: "Mock-Header-Three", Value: "3"},
+	}
+	h1 := &http.Request{
+		Header: make(http.Header),
+	}
+	err := H2RequestHeadersToH1Request(mockHeaders, h1)
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expectedHeaders, stdlibHeaderToH2muxHeader(h1.Header))
+}
+
+func TestIsH2muxControlRequestHeader(t *testing.T) {
+	controlRequestHeaders := []string{
+		// Anything that begins with cf-
+		"cf-sample-header",
+
+		// Any http2 pseudoheader
+		":sample-pseudo-header",
+
+		// content-length is a special case, it has to be there
+		// for some requests to work (per the HTTP2 spec)
+		"content-length",
+
+		// Websocket request headers
+		"connection",
+		"upgrade",
+	}
+
+	for _, header := range controlRequestHeaders {
+		assert.True(t, IsH2muxControlRequestHeader(header))
+	}
+}
+
+func TestIsH2muxControlResponseHeader(t *testing.T) {
+	controlResponseHeaders := []string{
+		// Anything that begins with cf-int- or cf-cloudflared-
+		"cf-int-sample-header",
+		"cf-cloudflared-sample-header",
+
+		// Any http2 pseudoheader
+		":sample-pseudo-header",
+
+		// content-length is a special case, it has to be there
+		// for some requests to work (per the HTTP2 spec)
+		"content-length",
+	}
+
+	for _, header := range controlResponseHeaders {
+		assert.True(t, IsH2muxControlResponseHeader(header))
+	}
+}
+
+func TestIsNotH2muxControlRequestHeader(t *testing.T) {
+	notControlRequestHeaders := []string{
+		"mock-header",
+		"another-sample-header",
+	}
+
+	for _, header := range notControlRequestHeaders {
+		assert.False(t, IsH2muxControlRequestHeader(header))
+	}
+}
+
+func TestIsNotH2muxControlResponseHeader(t *testing.T) {
+	notControlResponseHeaders := []string{
+		"mock-header",
+		"another-sample-header",
+		"upgrade",
+		"connection",
+		"cf-whatever", // On the response path, we only want to filter cf-int- and cf-cloudflared-
+	}
+
+	for _, header := range notControlResponseHeaders {
+		assert.False(t, IsH2muxControlResponseHeader(header))
+	}
+}
+
+func TestH1ResponseToH2ResponseHeaders(t *testing.T) {
+	mockHeaders := http.Header{
+		"User-header-one":       {""},
+		"User-header-two":       {"1", "2"},
+		"cf-header":             {"cf-value"},
+		"cf-int-header":         {"cf-int-value"},
+		"cf-cloudflared-header": {"cf-cloudflared-value"},
+		"Content-Length":        {"123"},
+	}
+	mockResponse := http.Response{
+		StatusCode: 200,
+		Header:     mockHeaders,
+	}
+
+	headers := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
+
+	serializedHeadersIndex := -1
+	for i, header := range headers {
+		if header.Name == ResponseUserHeaders {
+			serializedHeadersIndex = i
+			break
+		}
+	}
+	assert.NotEqual(t, -1, serializedHeadersIndex)
+	actualControlHeaders := append(
+		headers[:serializedHeadersIndex],
+		headers[serializedHeadersIndex+1:]...,
+	)
+	expectedControlHeaders := []h2mux.Header{
+		{Name: ":status", Value: "200"},
+		{Name: "content-length", Value: "123"},
+	}
+
+	assert.ElementsMatch(t, expectedControlHeaders, actualControlHeaders)
+
+	actualUserHeaders, err := DeserializeHeaders(headers[serializedHeadersIndex].Value)
+	expectedUserHeaders := []h2mux.Header{
+		{Name: "User-header-one", Value: ""},
+		{Name: "User-header-two", Value: "1"},
+		{Name: "User-header-two", Value: "2"},
+		{Name: "cf-header", Value: "cf-value"},
+	}
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expectedUserHeaders, actualUserHeaders)
+}
+
+// The purpose of this test is to check that our code and the http.Header
+// implementation don't throw validation errors about header size
+func TestHeaderSize(t *testing.T) {
+	largeValue := randSeq(5 * 1024 * 1024) // 5Mb
+	largeHeaders := http.Header{
+		"User-header": {largeValue},
+	}
+	mockResponse := http.Response{
+		StatusCode: 200,
+		Header:     largeHeaders,
+	}
+
+	serializedHeaders := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
+	request, err := http.NewRequest(http.MethodGet, "https://example.com/", nil)
+	assert.NoError(t, err)
+	for _, header := range serializedHeaders {
+		request.Header.Set(header.Name, header.Value)
+	}
+
+	for _, header := range serializedHeaders {
+		if header.Name != ResponseUserHeaders {
+			continue
+		}
+
+		deserializedHeaders, err := DeserializeHeaders(header.Value)
+		assert.NoError(t, err)
+		assert.Equal(t, largeValue, deserializedHeaders[0].Value)
+	}
+}
+
+func randSeq(n int) string {
+	randomizer := rand.New(rand.NewSource(17))
+	var letters = []rune(":;,+/=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
+	b := make([]rune, n)
+	for i := range b {
+		b[i] = letters[randomizer.Intn(len(letters))]
+	}
+	return string(b)
+}
+
+func BenchmarkH1ResponseToH2ResponseHeaders(b *testing.B) {
+	ser := "eC1mb3J3YXJkZWQtcHJvdG8:aHR0cHM;dXBncmFkZS1pbnNlY3VyZS1yZXF1ZXN0cw:MQ;YWNjZXB0LWxhbmd1YWdl:ZW4tVVMsZW47cT0wLjkscnU7cT0wLjg;YWNjZXB0LWVuY29kaW5n:Z3ppcA;eC1mb3J3YXJkZWQtZm9y:MTczLjI0NS42MC42;dXNlci1hZ2VudA:TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNikgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg0LjAuNDE0Ny44OSBTYWZhcmkvNTM3LjM2;c2VjLWZldGNoLW1vZGU:bmF2aWdhdGU;Y2RuLWxvb3A:Y2xvdWRmbGFyZQ;c2VjLWZldGNoLWRlc3Q:ZG9jdW1lbnQ;c2VjLWZldGNoLXVzZXI:PzE;c2VjLWZldGNoLXNpdGU:bm9uZQ;Y29va2ll:X19jZmR1aWQ9ZGNkOWZjOGNjNWMxMzE0NTMyYTFkMjhlZDEyOWRhOTYwMTU2OTk1MTYzNDsgX19jZl9ibT1mYzY2MzMzYzAzZmM0MWFiZTZmOWEyYzI2ZDUwOTA0YzIxYzZhMTQ2LTE1OTU2MjIzNDEtMTgwMC1BZTVzS2pIU2NiWGVFM05mMUhrTlNQMG1tMHBLc2pQWkloVnM1Z2g1SkNHQkFhS1UxVDB2b003alBGN3FjMHVSR2NjZGcrWHdhL1EzbTJhQzdDVU4xZ2M9;YWNjZXB0:dGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuOQ"
+	h2, _ := DeserializeHeaders(ser)
+	h1 := make(http.Header)
+	for _, header := range h2 {
+		h1.Add(header.Name, header.Value)
+	}
+	h1.Add("Content-Length", "200")
+	h1.Add("Cf-Something", "Else")
+	h1.Add("Upgrade", "websocket")
+
+	h1resp := &http.Response{
+		StatusCode: 200,
+		Header:     h1,
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = H1ResponseToH2ResponseHeaders(h1resp.StatusCode, h1resp.Header)
+	}
+}

connection/header.go

@@ -4,8 +4,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/http"
-	"net/url"
-	"strconv"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -44,88 +42,11 @@ func mustInitRespMetaHeader(src string) string {
 
 var headerEncoding = base64.RawStdEncoding
 
-// note: all h2mux headers should be lower-case (http/2 style)
-const ()
-
-// H2RequestHeadersToH1Request converts the HTTP/2 headers coming from origintunneld
-// to an HTTP/1 Request object destined for the local origin web service.
-// This operation includes conversion of the pseudo-headers into their closest
-// HTTP/1 equivalents. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
-func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
-	for _, header := range h2 {
-		name := strings.ToLower(header.Name)
-		if !IsControlHeader(name) {
-			continue
-		}
-
-		switch name {
-		case ":method":
-			h1.Method = header.Value
-		case ":scheme":
-			// noop - use the preexisting scheme from h1.URL
-		case ":authority":
-			// Otherwise the host header will be based on the origin URL
-			h1.Host = header.Value
-		case ":path":
-			// We don't want to be an "opinionated" proxy, so ideally we would use :path as-is.
-			// However, this HTTP/1 Request object belongs to the Go standard library,
-			// whose URL package makes some opinionated decisions about the encoding of
-			// URL characters: see the docs of https://godoc.org/net/url#URL,
-			// in particular the EscapedPath method https://godoc.org/net/url#URL.EscapedPath,
-			// which is always used when computing url.URL.String(), whether we'd like it or not.
-			//
-			// Well, not *always*. We could circumvent this by using url.URL.Opaque. But
-			// that would present unusual difficulties when using an HTTP proxy: url.URL.Opaque
-			// is treated differently when HTTP_PROXY is set!
-			// See https://github.com/golang/go/issues/5684#issuecomment-66080888
-			//
-			// This means we are subject to the behavior of net/url's function `shouldEscape`
-			// (as invoked with mode=encodePath): https://github.com/golang/go/blob/go1.12.7/src/net/url/url.go#L101
-
-			if header.Value == "*" {
-				h1.URL.Path = "*"
-				continue
-			}
-			// Due to the behavior of validation.ValidateUrl, h1.URL may
-			// already have a partial value, with or without a trailing slash.
-			base := h1.URL.String()
-			base = strings.TrimRight(base, "/")
-			// But we know :path begins with '/', because we handled '*' above - see RFC7540
-			requestURL, err := url.Parse(base + header.Value)
-			if err != nil {
-				return errors.Wrap(err, fmt.Sprintf("invalid path '%v'", header.Value))
-			}
-			h1.URL = requestURL
-		case "content-length":
-			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
-			if err != nil {
-				return fmt.Errorf("unparseable content length")
-			}
-			h1.ContentLength = contentLength
-		case RequestUserHeaders:
-			// Do not forward the serialized headers to the origin -- deserialize them, and ditch the serialized version
-			// Find and parse user headers serialized into a single one
-			userHeaders, err := DeserializeHeaders(header.Value)
-			if err != nil {
-				return errors.Wrap(err, "Unable to parse user headers")
-			}
-			for _, userHeader := range userHeaders {
-				h1.Header.Add(userHeader.Name, userHeader.Value)
-			}
-		default:
-			// All other control headers shall just be proxied transparently
-			h1.Header.Add(header.Name, header.Value)
-		}
-	}
-
-	return nil
-}
-
-func IsControlHeader(headerName string) bool {
-	return headerName == "content-length" ||
-		headerName == "connection" || headerName == "upgrade" || // Websocket headers
-		strings.HasPrefix(headerName, ":") ||
-		strings.HasPrefix(headerName, "cf-")
+// IsControlResponseHeader is called in the direction of eyeball <- origin.
+func IsControlResponseHeader(headerName string) bool {
+	return strings.HasPrefix(headerName, ":") ||
+		strings.HasPrefix(headerName, "cf-int-") ||
+		strings.HasPrefix(headerName, "cf-cloudflared-")
 }
 
 // isWebsocketClientHeader returns true if the header name is required by the client to upgrade properly
@@ -135,31 +56,6 @@ func IsWebsocketClientHeader(headerName string) bool {
 		headerName == "upgrade"
 }
 
-func H1ResponseToH2ResponseHeaders(status int, h1 http.Header) (h2 []h2mux.Header) {
-	h2 = []h2mux.Header{
-		{Name: ":status", Value: strconv.Itoa(status)},
-	}
-	userHeaders := make(http.Header, len(h1))
-	for header, values := range h1 {
-		h2name := strings.ToLower(header)
-		if h2name == "content-length" {
-			// This header has meaning in HTTP/2 and will be used by the edge,
-			// so it should be sent as an HTTP/2 response header.
-
-			// Since these are http2 headers, they're required to be lowercase
-			h2 = append(h2, h2mux.Header{Name: "content-length", Value: values[0]})
-		} else if !IsControlHeader(h2name) || IsWebsocketClientHeader(h2name) {
-			// User headers, on the other hand, must all be serialized so that
-			// HTTP/2 header validation won't be applied to HTTP/1 header values
-			userHeaders[header] = values
-		}
-	}
-
-	// Perform user header serialization and set them in the single header
-	h2 = append(h2, h2mux.Header{Name: ResponseUserHeaders, Value: SerializeHeaders(userHeaders)})
-	return h2
-}
-
 // Serialize HTTP1.x headers by base64-encoding each header name and value,
 // and then joining them in the format of [key:value;]
 func SerializeHeaders(h1Headers http.Header) string {

connection/header_test.go

@@ -2,441 +2,14 @@ package connection
 
 import (
 	"fmt"
-	"math/rand"
 	"net/http"
-	"net/url"
 	"reflect"
-	"regexp"
 	"sort"
-	"strings"
 	"testing"
-	"testing/quick"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/cloudflare/cloudflared/h2mux"
 )
 
-type ByName []h2mux.Header
-
-func (a ByName) Len() int      { return len(a) }
-func (a ByName) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
-func (a ByName) Less(i, j int) bool {
-	if a[i].Name == a[j].Name {
-		return a[i].Value < a[j].Value
-	}
-
-	return a[i].Name < a[j].Name
-}
-
-func TestH2RequestHeadersToH1Request_RegularHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	mockHeaders := http.Header{
-		"Mock header 1": {"Mock value 1"},
-		"Mock header 2": {"Mock value 2"},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(createSerializedHeaders(RequestUserHeaders, mockHeaders), request)
-
-	assert.True(t, reflect.DeepEqual(mockHeaders, request.Header))
-	assert.NoError(t, headersConversionErr)
-}
-
-func createSerializedHeaders(headersField string, headers http.Header) []h2mux.Header {
-	return []h2mux.Header{{
-		Name:  headersField,
-		Value: SerializeHeaders(headers),
-	}}
-}
-
-func TestH2RequestHeadersToH1Request_NoHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	emptyHeaders := make(http.Header)
-	headersConversionErr := H2RequestHeadersToH1Request(
-		[]h2mux.Header{{
-			Name:  RequestUserHeaders,
-			Value: SerializeHeaders(emptyHeaders),
-		}},
-		request,
-	)
-
-	assert.True(t, reflect.DeepEqual(emptyHeaders, request.Header))
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_InvalidHostPath(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []h2mux.Header{
-		{Name: ":path", Value: "//bad_path/"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com//bad_path/", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_HostPathWithQuery(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []h2mux.Header{
-		{Name: ":path", Value: "/?query=mock%20value"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com/?query=mock%20value", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_HostPathWithURLEncoding(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []h2mux.Header{
-		{Name: ":path", Value: "/mock%20path"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com/mock%20path", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_WeirdURLs(t *testing.T) {
-	type testCase struct {
-		path string
-		want string
-	}
-	testCases := []testCase{
-		{
-			path: "",
-			want: "",
-		},
-		{
-			path: "/",
-			want: "/",
-		},
-		{
-			path: "//",
-			want: "//",
-		},
-		{
-			path: "/test",
-			want: "/test",
-		},
-		{
-			path: "//test",
-			want: "//test",
-		},
-		{
-			// https://github.com/cloudflare/cloudflared/issues/81
-			path: "//test/",
-			want: "//test/",
-		},
-		{
-			path: "/%2Ftest",
-			want: "/%2Ftest",
-		},
-		{
-			path: "//%20test",
-			want: "//%20test",
-		},
-		{
-			// https://github.com/cloudflare/cloudflared/issues/124
-			path: "/test?get=somthing%20a",
-			want: "/test?get=somthing%20a",
-		},
-		{
-			path: "/%20",
-			want: "/%20",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode ' '
-			path: "/ ",
-			want: "/%20",
-		},
-		{
-			path: "/ a ",
-			want: "/%20a%20",
-		},
-		{
-			path: "/a%20b",
-			want: "/a%20b",
-		},
-		{
-			path: "/foo/bar;param?query#frag",
-			want: "/foo/bar;param?query#frag",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode non-ASCII chars
-			path: "/a␠b",
-			want: "/a%E2%90%A0b",
-		},
-		{
-			path: "/a-umlaut-ä",
-			want: "/a-umlaut-%C3%A4",
-		},
-		{
-			path: "/a-umlaut-%C3%A4",
-			want: "/a-umlaut-%C3%A4",
-		},
-		{
-			path: "/a-umlaut-%c3%a4",
-			want: "/a-umlaut-%c3%a4",
-		},
-		{
-			// here the second '#' is treated as part of the fragment
-			path: "/a#b#c",
-			want: "/a#b%23c",
-		},
-		{
-			path: "/a#b␠c",
-			want: "/a#b%E2%90%A0c",
-		},
-		{
-			path: "/a#b%20c",
-			want: "/a#b%20c",
-		},
-		{
-			path: "/a#b c",
-			want: "/a#b%20c",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode '\'
-			path: "/\\",
-			want: "/%5C",
-		},
-		{
-			path: "/a\\",
-			want: "/a%5C",
-		},
-		{
-			path: "/a,b.c.",
-			want: "/a,b.c.",
-		},
-		{
-			path: "/.",
-			want: "/.",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode '`'
-			path: "/a`",
-			want: "/a%60",
-		},
-		{
-			path: "/a[0]",
-			want: "/a[0]",
-		},
-		{
-			path: "/?a[0]=5 &b[]=",
-			want: "/?a[0]=5 &b[]=",
-		},
-		{
-			path: "/?a=%22b%20%22",
-			want: "/?a=%22b%20%22",
-		},
-	}
-
-	for index, testCase := range testCases {
-		requestURL := "https://example.com"
-
-		request, err := http.NewRequest(http.MethodGet, requestURL, nil)
-		assert.NoError(t, err)
-
-		mockRequestHeaders := []h2mux.Header{
-			{Name: ":path", Value: testCase.path},
-			{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-		}
-
-		headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-		assert.NoError(t, headersConversionErr)
-
-		assert.Equal(t,
-			http.Header{
-				"Mock header": []string{"Mock value"},
-			},
-			request.Header)
-
-		assert.Equal(t,
-			"https://example.com"+testCase.want,
-			request.URL.String(),
-			"Failed URL index: %v %#v", index, testCase)
-	}
-}
-
-func TestH2RequestHeadersToH1Request_QuickCheck(t *testing.T) {
-	config := &quick.Config{
-		Values: func(args []reflect.Value, rand *rand.Rand) {
-			args[0] = reflect.ValueOf(randomHTTP2Path(t, rand))
-		},
-	}
-
-	type testOrigin struct {
-		url string
-
-		expectedScheme   string
-		expectedBasePath string
-	}
-	testOrigins := []testOrigin{
-		{
-			url:              "http://origin.hostname.example.com:8080",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/api",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080/api",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/api/",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080/api",
-		},
-		{
-			url:              "https://origin.hostname.example.com:8080/api",
-			expectedScheme:   "https",
-			expectedBasePath: "https://origin.hostname.example.com:8080/api",
-		},
-	}
-
-	// use multiple schemes to demonstrate that the URL is based on the
-	// origin's scheme, not the :scheme header
-	for _, testScheme := range []string{"http", "https"} {
-		for _, testOrigin := range testOrigins {
-			assertion := func(testPath string) bool {
-				const expectedMethod = "POST"
-				const expectedHostname = "request.hostname.example.com"
-
-				h2 := []h2mux.Header{
-					{Name: ":method", Value: expectedMethod},
-					{Name: ":scheme", Value: testScheme},
-					{Name: ":authority", Value: expectedHostname},
-					{Name: ":path", Value: testPath},
-					{Name: RequestUserHeaders, Value: ""},
-				}
-				h1, err := http.NewRequest("GET", testOrigin.url, nil)
-				require.NoError(t, err)
-
-				err = H2RequestHeadersToH1Request(h2, h1)
-				return assert.NoError(t, err) &&
-					assert.Equal(t, expectedMethod, h1.Method) &&
-					assert.Equal(t, expectedHostname, h1.Host) &&
-					assert.Equal(t, testOrigin.expectedScheme, h1.URL.Scheme) &&
-					assert.Equal(t, testOrigin.expectedBasePath+testPath, h1.URL.String())
-			}
-			err := quick.Check(assertion, config)
-			assert.NoError(t, err)
-		}
-	}
-}
-
-func randomASCIIPrintableChar(rand *rand.Rand) int {
-	// smallest printable ASCII char is 32, largest is 126
-	const startPrintable = 32
-	const endPrintable = 127
-	return startPrintable + rand.Intn(endPrintable-startPrintable)
-}
-
-// randomASCIIText generates an ASCII string, some of whose characters may be
-// percent-encoded. Its "logical length" (ignoring percent-encoding) is
-// between 1 and `maxLength`.
-func randomASCIIText(rand *rand.Rand, minLength int, maxLength int) string {
-	length := minLength + rand.Intn(maxLength)
-	var result strings.Builder
-	for i := 0; i < length; i++ {
-		c := randomASCIIPrintableChar(rand)
-
-		// 1/4 chance of using percent encoding when not necessary
-		if c == '%' || rand.Intn(4) == 0 {
-			result.WriteString(fmt.Sprintf("%%%02X", c))
-		} else {
-			result.WriteByte(byte(c))
-		}
-	}
-	return result.String()
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL path,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Path(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	re, err := regexp.Compile("[^/;,]*")
-	require.NoError(t, err)
-	return "/" + re.ReplaceAllStringFunc(text, url.PathEscape)
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL query,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Query(rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	return "?" + strings.ReplaceAll(text, "#", "%23")
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL fragment,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Fragment(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	u, err := url.Parse("#" + text)
-	require.NoError(t, err)
-	return u.String()
-}
-
-// Assemble a random :path pseudoheader that is legal by Go stdlib standards
-// (i.e. all characters will satisfy "net/url".shouldEscape for their respective locations)
-func randomHTTP2Path(t *testing.T, rand *rand.Rand) string {
-	result := randomHTTP1Path(t, rand, 1, 64)
-	if rand.Intn(2) == 1 {
-		result += randomHTTP1Query(rand, 1, 32)
-	}
-	if rand.Intn(2) == 1 {
-		result += randomHTTP1Fragment(t, rand, 1, 16)
-	}
-	return result
-}
-
-func stdlibHeaderToH2muxHeader(headers http.Header) (h2muxHeaders []h2mux.Header) {
-	for name, values := range headers {
-		for _, value := range values {
-			h2muxHeaders = append(h2muxHeaders, h2mux.Header{Name: name, Value: value})
-		}
-	}
-
-	return h2muxHeaders
-}
-
 func TestSerializeHeaders(t *testing.T) {
 	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
 	assert.NoError(t, err)
@@ -511,167 +84,30 @@ func TestDeserializeMalformed(t *testing.T) {
 	}
 }
 
-func TestParseHeaders(t *testing.T) {
-	mockUserHeadersToSerialize := http.Header{
-		"Mock-Header-One":   {"1", "1.5"},
-		"Mock-Header-Two":   {"2"},
-		"Mock-Header-Three": {"3"},
-	}
-
-	mockHeaders := []h2mux.Header{
-		{Name: "One", Value: "1"}, // will be dropped
-		{Name: "Cf-Two", Value: "cf-value-1"},
-		{Name: "Cf-Two", Value: "cf-value-2"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(mockUserHeadersToSerialize)},
-	}
-
-	expectedHeaders := []h2mux.Header{
-		{Name: "Cf-Two", Value: "cf-value-1"},
-		{Name: "Cf-Two", Value: "cf-value-2"},
-		{Name: "Mock-Header-One", Value: "1"},
-		{Name: "Mock-Header-One", Value: "1.5"},
-		{Name: "Mock-Header-Two", Value: "2"},
-		{Name: "Mock-Header-Three", Value: "3"},
-	}
-	h1 := &http.Request{
-		Header: make(http.Header),
-	}
-	err := H2RequestHeadersToH1Request(mockHeaders, h1)
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expectedHeaders, stdlibHeaderToH2muxHeader(h1.Header))
-}
-
-func TestIsControlHeader(t *testing.T) {
-	controlHeaders := []string{
-		// Anything that begins with cf-
-		"cf-sample-header",
-
+func TestIsControlResponseHeader(t *testing.T) {
+	controlResponseHeaders := []string{
+		// Anything that begins with cf-int- or cf-cloudflared-
+		"cf-int-sample-header",
+		"cf-cloudflared-sample-header",
 		// Any http2 pseudoheader
 		":sample-pseudo-header",
-
-		// content-length is a special case, it has to be there
-		// for some requests to work (per the HTTP2 spec)
-		"content-length",
 	}
 
-	for _, header := range controlHeaders {
-		assert.True(t, IsControlHeader(header))
+	for _, header := range controlResponseHeaders {
+		assert.True(t, IsControlResponseHeader(header))
 	}
 }
 
-func TestIsNotControlHeader(t *testing.T) {
-	notControlHeaders := []string{
+func TestIsNotControlResponseHeader(t *testing.T) {
+	notControlResponseHeaders := []string{
 		"mock-header",
 		"another-sample-header",
+		"upgrade",
+		"connection",
+		"cf-whatever", // On the response path, we only want to filter cf-int- and cf-cloudflared-
 	}
 
-	for _, header := range notControlHeaders {
-		assert.False(t, IsControlHeader(header))
-	}
-}
-
-func TestH1ResponseToH2ResponseHeaders(t *testing.T) {
-	mockHeaders := http.Header{
-		"User-header-one": {""},
-		"User-header-two": {"1", "2"},
-		"cf-header":       {"cf-value"},
-		"Content-Length":  {"123"},
-	}
-	mockResponse := http.Response{
-		StatusCode: 200,
-		Header:     mockHeaders,
-	}
-
-	headers := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
-
-	serializedHeadersIndex := -1
-	for i, header := range headers {
-		if header.Name == ResponseUserHeaders {
-			serializedHeadersIndex = i
-			break
-		}
-	}
-	assert.NotEqual(t, -1, serializedHeadersIndex)
-	actualControlHeaders := append(
-		headers[:serializedHeadersIndex],
-		headers[serializedHeadersIndex+1:]...,
-	)
-	expectedControlHeaders := []h2mux.Header{
-		{Name: ":status", Value: "200"},
-		{Name: "content-length", Value: "123"},
-	}
-
-	assert.ElementsMatch(t, expectedControlHeaders, actualControlHeaders)
-
-	actualUserHeaders, err := DeserializeHeaders(headers[serializedHeadersIndex].Value)
-	expectedUserHeaders := []h2mux.Header{
-		{Name: "User-header-one", Value: ""},
-		{Name: "User-header-two", Value: "1"},
-		{Name: "User-header-two", Value: "2"},
-	}
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expectedUserHeaders, actualUserHeaders)
-}
-
-// The purpose of this test is to check that our code and the http.Header
-// implementation don't throw validation errors about header size
-func TestHeaderSize(t *testing.T) {
-	largeValue := randSeq(5 * 1024 * 1024) // 5Mb
-	largeHeaders := http.Header{
-		"User-header": {largeValue},
-	}
-	mockResponse := http.Response{
-		StatusCode: 200,
-		Header:     largeHeaders,
-	}
-
-	serializedHeaders := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
-	request, err := http.NewRequest(http.MethodGet, "https://example.com/", nil)
-	assert.NoError(t, err)
-	for _, header := range serializedHeaders {
-		request.Header.Set(header.Name, header.Value)
-	}
-
-	for _, header := range serializedHeaders {
-		if header.Name != ResponseUserHeaders {
-			continue
-		}
-
-		deserializedHeaders, err := DeserializeHeaders(header.Value)
-		assert.NoError(t, err)
-		assert.Equal(t, largeValue, deserializedHeaders[0].Value)
-	}
-}
-
-func randSeq(n int) string {
-	randomizer := rand.New(rand.NewSource(17))
-	var letters = []rune(":;,+/=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
-	b := make([]rune, n)
-	for i := range b {
-		b[i] = letters[randomizer.Intn(len(letters))]
-	}
-	return string(b)
-}
-
-func BenchmarkH1ResponseToH2ResponseHeaders(b *testing.B) {
-	ser := "eC1mb3J3YXJkZWQtcHJvdG8:aHR0cHM;dXBncmFkZS1pbnNlY3VyZS1yZXF1ZXN0cw:MQ;YWNjZXB0LWxhbmd1YWdl:ZW4tVVMsZW47cT0wLjkscnU7cT0wLjg;YWNjZXB0LWVuY29kaW5n:Z3ppcA;eC1mb3J3YXJkZWQtZm9y:MTczLjI0NS42MC42;dXNlci1hZ2VudA:TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNikgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg0LjAuNDE0Ny44OSBTYWZhcmkvNTM3LjM2;c2VjLWZldGNoLW1vZGU:bmF2aWdhdGU;Y2RuLWxvb3A:Y2xvdWRmbGFyZQ;c2VjLWZldGNoLWRlc3Q:ZG9jdW1lbnQ;c2VjLWZldGNoLXVzZXI:PzE;c2VjLWZldGNoLXNpdGU:bm9uZQ;Y29va2ll:X19jZmR1aWQ9ZGNkOWZjOGNjNWMxMzE0NTMyYTFkMjhlZDEyOWRhOTYwMTU2OTk1MTYzNDsgX19jZl9ibT1mYzY2MzMzYzAzZmM0MWFiZTZmOWEyYzI2ZDUwOTA0YzIxYzZhMTQ2LTE1OTU2MjIzNDEtMTgwMC1BZTVzS2pIU2NiWGVFM05mMUhrTlNQMG1tMHBLc2pQWkloVnM1Z2g1SkNHQkFhS1UxVDB2b003alBGN3FjMHVSR2NjZGcrWHdhL1EzbTJhQzdDVU4xZ2M9;YWNjZXB0:dGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuOQ"
-	h2, _ := DeserializeHeaders(ser)
-	h1 := make(http.Header)
-	for _, header := range h2 {
-		h1.Add(header.Name, header.Value)
-	}
-	h1.Add("Content-Length", "200")
-	h1.Add("Cf-Something", "Else")
-	h1.Add("Upgrade", "websocket")
-
-	h1resp := &http.Response{
-		StatusCode: 200,
-		Header:     h1,
-	}
-
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_ = H1ResponseToH2ResponseHeaders(h1resp.StatusCode, h1resp.Header)
+	for _, header := range notControlResponseHeaders {
+		assert.False(t, IsControlResponseHeader(header))
 	}
 }

connection/http2.go

@@ -4,9 +4,9 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"math"
 	"net"
 	"net/http"
+	"runtime/debug"
 	"strings"
 	"sync"
 
@@ -59,7 +59,7 @@ func NewHTTP2Connection(
 	return &HTTP2Connection{
 		conn: conn,
 		server: &http2.Server{
-			MaxConcurrentStreams: math.MaxUint32,
+			MaxConcurrentStreams: MaxConcurrentStreams,
 		},
 		config:               config,
 		connOptions:          connOptions,
@@ -100,7 +100,7 @@ func (c *HTTP2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	connType := determineHTTP2Type(r)
 	handleMissingRequestParts(connType, r)
 
-	respWriter, err := newHTTP2RespWriter(r, w, connType)
+	respWriter, err := NewHTTP2RespWriter(r, w, connType)
 	if err != nil {
 		c.observer.log.Error().Msg(err.Error())
 		return
@@ -108,7 +108,7 @@ func (c *HTTP2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	switch connType {
 	case TypeControlStream:
-		if err := c.controlStreamHandler.ServeControlStream(r.Context(), respWriter, c.connOptions); err != nil {
+		if err := c.controlStreamHandler.ServeControlStream(r.Context(), respWriter, c.connOptions, true); err != nil {
 			c.controlStreamErr = err
 			c.log.Error().Err(err)
 			respWriter.WriteErrorResponse()
@@ -125,7 +125,7 @@ func (c *HTTP2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case TypeTCP:
 		host, err := getRequestHost(r)
 		if err != nil {
-			err := fmt.Errorf(`cloudflared recieved a warp-routing request with an empty host value: %w`, err)
+			err := fmt.Errorf(`cloudflared received a warp-routing request with an empty host value: %w`, err)
 			c.log.Error().Err(err)
 			respWriter.WriteErrorResponse()
 		}
@@ -159,7 +159,7 @@ type http2RespWriter struct {
 	shouldFlush bool
 }
 
-func newHTTP2RespWriter(r *http.Request, w http.ResponseWriter, connType Type) (*http2RespWriter, error) {
+func NewHTTP2RespWriter(r *http.Request, w http.ResponseWriter, connType Type) (*http2RespWriter, error) {
 	flusher, isFlusher := w.(http.Flusher)
 	if !isFlusher {
 		respWriter := &http2RespWriter{
@@ -184,12 +184,14 @@ func (rp *http2RespWriter) WriteRespHeaders(status int, header http.Header) erro
 	for name, values := range header {
 		// Since these are http2 headers, they're required to be lowercase
 		h2name := strings.ToLower(name)
+
 		if h2name == "content-length" {
 			// This header has meaning in HTTP/2 and will be used by the edge,
-			// so it should be sent as an HTTP/2 response header.
+			// so it should be sent *also* as an HTTP/2 response header.
 			dest[name] = values
-			// Since these are http2 headers, they're required to be lowercase
-		} else if !IsControlHeader(h2name) || IsWebsocketClientHeader(h2name) {
+		}
+
+		if !IsControlResponseHeader(h2name) || IsWebsocketClientHeader(h2name) {
 			// User headers, on the other hand, must all be serialized so that
 			// HTTP/2 header validation won't be applied to HTTP/1 header values
 			userHeaders[name] = values
@@ -231,7 +233,7 @@ func (rp *http2RespWriter) Write(p []byte) (n int, err error) {
 		// Implementer of OriginClient should make sure it doesn't write to the connection after Proxy returns
 		// Register a recover routine just in case.
 		if r := recover(); r != nil {
-			println("Recover from http2 response writer panic, error", r)
+			println(fmt.Sprintf("Recover from http2 response writer panic, error %s", debug.Stack()))
 		}
 	}()
 	n, err = rp.w.Write(p)

connection/protocol.go

@@ -7,10 +7,12 @@ import (
 	"time"
 
 	"github.com/rs/zerolog"
+
+	"github.com/cloudflare/cloudflared/edgediscovery"
 )
 
 const (
-	AvailableProtocolFlagMessage = "Available protocols: http2 - Go's implementation, h2mux - Cloudflare's implementation of HTTP/2, and auto - automatically select between http2 and h2mux"
+	AvailableProtocolFlagMessage = "Available protocols: 'auto' - automatically chooses the best protocol over time (the default; and also the recommended one); 'quic' - based on QUIC, relying on UDP egress to Cloudflare edge; 'http2' - using Go's HTTP2 library, relying on TCP egress to Cloudflare edge; 'h2mux' - Cloudflare's implementation of HTTP/2, deprecated"
 	// edgeH2muxTLSServerName is the server name to establish h2mux connection with edge
 	edgeH2muxTLSServerName = "cftunnel.com"
 	// edgeH2TLSServerName is the server name to establish http2 connection with edge
@@ -24,7 +26,7 @@ const (
 
 var (
 	// ProtocolList represents a list of supported protocols for communication with the edge.
-	ProtocolList = []Protocol{H2mux, HTTP2, QUIC}
+	ProtocolList = []Protocol{H2mux, HTTP2, HTTP2Warp, QUIC, QUICWarp}
 )
 
 type Protocol int64
@@ -36,6 +38,12 @@ const (
 	HTTP2
 	// QUIC is used only with named tunnels.
 	QUIC
+	// HTTP2Warp is used only with named tunnels. It's useful for warp-routing where we don't want to fallback to
+	// H2mux on HTTP2 failure to connect.
+	HTTP2Warp
+	//QUICWarp is used only with named tunnels. It's useful for warp-routing where we want to fallback to HTTP2 but
+	// don't want HTTP2 to fallback to H2mux
+	QUICWarp
 )
 
 // Fallback returns the fallback protocol and whether the protocol has a fallback
@@ -45,8 +53,12 @@ func (p Protocol) fallback() (Protocol, bool) {
 		return 0, false
 	case HTTP2:
 		return H2mux, true
+	case HTTP2Warp:
+		return 0, false
 	case QUIC:
 		return HTTP2, true
+	case QUICWarp:
+		return HTTP2Warp, true
 	default:
 		return 0, false
 	}
@@ -56,9 +68,9 @@ func (p Protocol) String() string {
 	switch p {
 	case H2mux:
 		return "h2mux"
-	case HTTP2:
+	case HTTP2, HTTP2Warp:
 		return "http2"
-	case QUIC:
+	case QUIC, QUICWarp:
 		return "quic"
 	default:
 		return fmt.Sprintf("unknown protocol")
@@ -71,11 +83,11 @@ func (p Protocol) TLSSettings() *TLSSettings {
 		return &TLSSettings{
 			ServerName: edgeH2muxTLSServerName,
 		}
-	case HTTP2:
+	case HTTP2, HTTP2Warp:
 		return &TLSSettings{
 			ServerName: edgeH2TLSServerName,
 		}
-	case QUIC:
+	case QUIC, QUICWarp:
 		return &TLSSettings{
 			ServerName: edgeQUICServerName,
 			NextProtos: []string{"argotunnel"},
@@ -108,29 +120,36 @@ func (s *staticProtocolSelector) Fallback() (Protocol, bool) {
 }
 
 type autoProtocolSelector struct {
-	lock           sync.RWMutex
-	current        Protocol
-	switchThrehold int32
-	fetchFunc      PercentageFetcher
-	refreshAfter   time.Time
-	ttl            time.Duration
-	log            *zerolog.Logger
+	lock sync.RWMutex
+
+	current Protocol
+
+	// protocolPool is desired protocols in the order of priority they should be picked in.
+	protocolPool []Protocol
+
+	switchThreshold int32
+	fetchFunc       PercentageFetcher
+	refreshAfter    time.Time
+	ttl             time.Duration
+	log             *zerolog.Logger
 }
 
 func newAutoProtocolSelector(
 	current Protocol,
-	switchThrehold int32,
+	protocolPool []Protocol,
+	switchThreshold int32,
 	fetchFunc PercentageFetcher,
 	ttl time.Duration,
 	log *zerolog.Logger,
 ) *autoProtocolSelector {
 	return &autoProtocolSelector{
-		current:        current,
-		switchThrehold: switchThrehold,
-		fetchFunc:      fetchFunc,
-		refreshAfter:   time.Now().Add(ttl),
-		ttl:            ttl,
-		log:            log,
+		current:         current,
+		protocolPool:    protocolPool,
+		switchThreshold: switchThreshold,
+		fetchFunc:       fetchFunc,
+		refreshAfter:    time.Now().Add(ttl),
+		ttl:             ttl,
+		log:             log,
 	}
 }
 
@@ -141,28 +160,39 @@ func (s *autoProtocolSelector) Current() Protocol {
 		return s.current
 	}
 
-	percentage, err := s.fetchFunc()
+	protocol, err := getProtocol(s.protocolPool, s.fetchFunc, s.switchThreshold)
 	if err != nil {
 		s.log.Err(err).Msg("Failed to refresh protocol")
 		return s.current
 	}
+	s.current = protocol
 
-	if s.switchThrehold < percentage {
-		s.current = HTTP2
-	} else {
-		s.current = H2mux
-	}
 	s.refreshAfter = time.Now().Add(s.ttl)
 	return s.current
 }
 
+func getProtocol(protocolPool []Protocol, fetchFunc PercentageFetcher, switchThreshold int32) (Protocol, error) {
+	protocolPercentages, err := fetchFunc()
+	if err != nil {
+		return 0, err
+	}
+	for _, protocol := range protocolPool {
+		protocolPercentage := protocolPercentages.GetPercentage(protocol.String())
+		if protocolPercentage > switchThreshold {
+			return protocol, nil
+		}
+	}
+
+	return protocolPool[len(protocolPool)-1], nil
+}
+
 func (s *autoProtocolSelector) Fallback() (Protocol, bool) {
 	s.lock.RLock()
 	defer s.lock.RUnlock()
 	return s.current.fallback()
 }
 
-type PercentageFetcher func() (int32, error)
+type PercentageFetcher func() (edgediscovery.ProtocolPercents, error)
 
 func NewProtocolSelector(
 	protocolFlag string,
@@ -179,22 +209,34 @@ func NewProtocolSelector(
 		}, nil
 	}
 
-	// warp routing cannot be served over h2mux connections
-	if warpRoutingEnabled {
-		if protocolFlag == H2mux.String() {
-			log.Warn().Msg("Warp routing is not supported in h2mux protocol. Upgrading to http2 to allow it.")
-		}
-
-		if protocolFlag == QUIC.String() {
-			return &staticProtocolSelector{
-				current: QUIC,
-			}, nil
-		}
+	threshold := switchThreshold(namedTunnel.Credentials.AccountTag)
+	fetchedProtocol, err := getProtocol([]Protocol{QUIC, HTTP2}, fetchFunc, threshold)
+	if err != nil {
+		log.Err(err).Msg("Unable to lookup protocol. Defaulting to `http2`. If this fails, you can set `--protocol h2mux` in your cloudflared command.")
 		return &staticProtocolSelector{
 			current: HTTP2,
 		}, nil
 	}
+	if warpRoutingEnabled {
+		if protocolFlag == H2mux.String() || fetchedProtocol == H2mux {
+			log.Warn().Msg("Warp routing is not supported in h2mux protocol. Upgrading to http2 to allow it.")
+			protocolFlag = HTTP2.String()
+			fetchedProtocol = HTTP2Warp
+		}
+		return selectWarpRoutingProtocols(protocolFlag, fetchFunc, ttl, log, threshold, fetchedProtocol)
+	}
 
+	return selectNamedTunnelProtocols(protocolFlag, fetchFunc, ttl, log, threshold, fetchedProtocol)
+}
+
+func selectNamedTunnelProtocols(
+	protocolFlag string,
+	fetchFunc PercentageFetcher,
+	ttl time.Duration,
+	log *zerolog.Logger,
+	threshold int32,
+	protocol Protocol,
+) (ProtocolSelector, error) {
 	if protocolFlag == H2mux.String() {
 		return &staticProtocolSelector{
 			current: H2mux,
@@ -202,31 +244,41 @@ func NewProtocolSelector(
 	}
 
 	if protocolFlag == QUIC.String() {
-		return newAutoProtocolSelector(QUIC, explicitHTTP2FallbackThreshold, fetchFunc, ttl, log), nil
+		return newAutoProtocolSelector(QUIC, []Protocol{QUIC, HTTP2, H2mux}, explicitHTTP2FallbackThreshold, fetchFunc, ttl, log), nil
 	}
 
-	http2Percentage, err := fetchFunc()
-	if err != nil {
-		log.Err(err).Msg("Unable to lookup protocol. Defaulting to `http2`. If this fails, you can set `--protocol h2mux` in your cloudflared command.")
-		return &staticProtocolSelector{
-			current: HTTP2,
-		}, nil
-	}
 	if protocolFlag == HTTP2.String() {
-		if http2Percentage < 0 {
-			return newAutoProtocolSelector(H2mux, explicitHTTP2FallbackThreshold, fetchFunc, ttl, log), nil
-		}
-		return newAutoProtocolSelector(HTTP2, explicitHTTP2FallbackThreshold, fetchFunc, ttl, log), nil
+		return newAutoProtocolSelector(HTTP2, []Protocol{HTTP2, H2mux}, explicitHTTP2FallbackThreshold, fetchFunc, ttl, log), nil
 	}
 
 	if protocolFlag != autoSelectFlag {
 		return nil, fmt.Errorf("Unknown protocol %s, %s", protocolFlag, AvailableProtocolFlagMessage)
 	}
-	threshold := switchThreshold(namedTunnel.Credentials.AccountTag)
-	if threshold < http2Percentage {
-		return newAutoProtocolSelector(HTTP2, threshold, fetchFunc, ttl, log), nil
+
+	return newAutoProtocolSelector(protocol, []Protocol{QUIC, HTTP2, H2mux}, threshold, fetchFunc, ttl, log), nil
+}
+
+func selectWarpRoutingProtocols(
+	protocolFlag string,
+	fetchFunc PercentageFetcher,
+	ttl time.Duration,
+	log *zerolog.Logger,
+	threshold int32,
+	protocol Protocol,
+) (ProtocolSelector, error) {
+	if protocolFlag == QUIC.String() {
+		return newAutoProtocolSelector(QUICWarp, []Protocol{QUICWarp, HTTP2Warp}, explicitHTTP2FallbackThreshold, fetchFunc, ttl, log), nil
 	}
-	return newAutoProtocolSelector(H2mux, threshold, fetchFunc, ttl, log), nil
+
+	if protocolFlag == HTTP2.String() {
+		return newAutoProtocolSelector(HTTP2Warp, []Protocol{HTTP2Warp}, explicitHTTP2FallbackThreshold, fetchFunc, ttl, log), nil
+	}
+
+	if protocolFlag != autoSelectFlag {
+		return nil, fmt.Errorf("Unknown protocol %s, %s", protocolFlag, AvailableProtocolFlagMessage)
+	}
+
+	return newAutoProtocolSelector(protocol, []Protocol{QUICWarp, HTTP2Warp}, threshold, fetchFunc, ttl, log), nil
 }
 
 func switchThreshold(accountTag string) int32 {

connection/protocol_test.go

@@ -6,6 +6,8 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+
+	"github.com/cloudflare/cloudflared/edgediscovery"
 )
 
 const (
@@ -21,29 +23,23 @@ var (
 	}
 )
 
-func mockFetcher(percentage int32) PercentageFetcher {
-	return func() (int32, error) {
-		return percentage, nil
-	}
-}
-
-func mockFetcherWithError() PercentageFetcher {
-	return func() (int32, error) {
-		return 0, fmt.Errorf("failed to fetch precentage")
+func mockFetcher(getError bool, protocolPercent ...edgediscovery.ProtocolPercent) PercentageFetcher {
+	return func() (edgediscovery.ProtocolPercents, error) {
+		if getError {
+			return nil, fmt.Errorf("failed to fetch percentage")
+		}
+		return protocolPercent, nil
 	}
 }
 
 type dynamicMockFetcher struct {
-	percentage int32
-	err        error
+	protocolPercents edgediscovery.ProtocolPercents
+	err              error
 }
 
 func (dmf *dynamicMockFetcher) fetch() PercentageFetcher {
-	return func() (int32, error) {
-		if dmf.err != nil {
-			return 0, dmf.err
-		}
-		return dmf.percentage, nil
+	return func() (edgediscovery.ProtocolPercents, error) {
+		return dmf.protocolPercents, dmf.err
 	}
 }
 
@@ -69,6 +65,7 @@ func TestNewProtocolSelector(t *testing.T) {
 			name:              "named tunnel over h2mux",
 			protocol:          "h2mux",
 			expectedProtocol:  H2mux,
+			fetchFunc:         func() (edgediscovery.ProtocolPercents, error) { return nil, nil },
 			namedTunnelConfig: testNamedTunnelConfig,
 		},
 		{
@@ -77,28 +74,38 @@ func TestNewProtocolSelector(t *testing.T) {
 			expectedProtocol:  HTTP2,
 			hasFallback:       true,
 			expectedFallback:  H2mux,
-			fetchFunc:         mockFetcher(0),
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}),
 			namedTunnelConfig: testNamedTunnelConfig,
 		},
 		{
 			name:              "named tunnel http2 disabled",
 			protocol:          "http2",
 			expectedProtocol:  H2mux,
-			fetchFunc:         mockFetcher(-1),
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}),
+			namedTunnelConfig: testNamedTunnelConfig,
+		},
+		{
+			name:             "named tunnel quic disabled",
+			protocol:         "quic",
+			expectedProtocol: HTTP2,
+			// Hasfallback true is because if http2 fails, then we further fallback to h2mux.
+			hasFallback:       true,
+			expectedFallback:  H2mux,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: -1}),
 			namedTunnelConfig: testNamedTunnelConfig,
 		},
 		{
 			name:              "named tunnel auto all http2 disabled",
 			protocol:          "auto",
 			expectedProtocol:  H2mux,
-			fetchFunc:         mockFetcher(-1),
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}),
 			namedTunnelConfig: testNamedTunnelConfig,
 		},
 		{
 			name:              "named tunnel auto to h2mux",
 			protocol:          "auto",
 			expectedProtocol:  H2mux,
-			fetchFunc:         mockFetcher(0),
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}),
 			namedTunnelConfig: testNamedTunnelConfig,
 		},
 		{
@@ -107,36 +114,71 @@ func TestNewProtocolSelector(t *testing.T) {
 			expectedProtocol:  HTTP2,
 			hasFallback:       true,
 			expectedFallback:  H2mux,
-			fetchFunc:         mockFetcher(100),
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			namedTunnelConfig: testNamedTunnelConfig,
+		},
+		{
+			name:              "named tunnel auto to quic",
+			protocol:          "auto",
+			expectedProtocol:  QUIC,
+			hasFallback:       true,
+			expectedFallback:  HTTP2,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}),
 			namedTunnelConfig: testNamedTunnelConfig,
 		},
 		{
 			name:               "warp routing requesting h2mux",
 			protocol:           "h2mux",
-			expectedProtocol:   HTTP2,
+			expectedProtocol:   HTTP2Warp,
 			hasFallback:        false,
-			expectedFallback:   H2mux,
-			fetchFunc:          mockFetcher(100),
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelConfig,
+		},
+		{
+			name:               "warp routing requesting h2mux picks HTTP2 even if http2 percent is -1",
+			protocol:           "h2mux",
+			expectedProtocol:   HTTP2Warp,
+			hasFallback:        false,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}),
 			warpRoutingEnabled: true,
 			namedTunnelConfig:  testNamedTunnelConfig,
 		},
 		{
 			name:               "warp routing http2",
 			protocol:           "http2",
-			expectedProtocol:   HTTP2,
+			expectedProtocol:   HTTP2Warp,
 			hasFallback:        false,
-			expectedFallback:   H2mux,
-			fetchFunc:          mockFetcher(100),
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelConfig,
+		},
+		{
+			name:               "warp routing quic",
+			protocol:           "quic",
+			expectedProtocol:   QUICWarp,
+			hasFallback:        true,
+			expectedFallback:   HTTP2Warp,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}),
 			warpRoutingEnabled: true,
 			namedTunnelConfig:  testNamedTunnelConfig,
 		},
 		{
 			name:               "warp routing auto",
 			protocol:           "auto",
-			expectedProtocol:   HTTP2,
+			expectedProtocol:   HTTP2Warp,
 			hasFallback:        false,
-			expectedFallback:   H2mux,
-			fetchFunc:          mockFetcher(100),
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelConfig,
+		},
+		{
+			name:               "warp routing auto- quic",
+			protocol:           "auto",
+			expectedProtocol:   QUICWarp,
+			hasFallback:        true,
+			expectedFallback:   HTTP2Warp,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}),
 			warpRoutingEnabled: true,
 			namedTunnelConfig:  testNamedTunnelConfig,
 		},
@@ -149,14 +191,14 @@ func TestNewProtocolSelector(t *testing.T) {
 		{
 			name:              "named tunnel unknown protocol",
 			protocol:          "unknown",
-			fetchFunc:         mockFetcher(100),
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
 			namedTunnelConfig: testNamedTunnelConfig,
 			wantErr:           true,
 		},
 		{
 			name:              "named tunnel fetch error",
-			protocol:          "unknown",
-			fetchFunc:         mockFetcherWithError(),
+			protocol:          "auto",
+			fetchFunc:         mockFetcher(true),
 			namedTunnelConfig: testNamedTunnelConfig,
 			expectedProtocol:  HTTP2,
 			wantErr:           false,
@@ -164,18 +206,20 @@ func TestNewProtocolSelector(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		selector, err := NewProtocolSelector(test.protocol, test.warpRoutingEnabled, test.namedTunnelConfig, test.fetchFunc, testNoTTL, &log)
-		if test.wantErr {
-			assert.Error(t, err, fmt.Sprintf("test %s failed", test.name))
-		} else {
-			assert.NoError(t, err, fmt.Sprintf("test %s failed", test.name))
-			assert.Equal(t, test.expectedProtocol, selector.Current(), fmt.Sprintf("test %s failed", test.name))
-			fallback, ok := selector.Fallback()
-			assert.Equal(t, test.hasFallback, ok, fmt.Sprintf("test %s failed", test.name))
-			if test.hasFallback {
-				assert.Equal(t, test.expectedFallback, fallback, fmt.Sprintf("test %s failed", test.name))
+		t.Run(test.name, func(t *testing.T) {
+			selector, err := NewProtocolSelector(test.protocol, test.warpRoutingEnabled, test.namedTunnelConfig, test.fetchFunc, testNoTTL, &log)
+			if test.wantErr {
+				assert.Error(t, err, fmt.Sprintf("test %s failed", test.name))
+			} else {
+				assert.NoError(t, err, fmt.Sprintf("test %s failed", test.name))
+				assert.Equal(t, test.expectedProtocol, selector.Current(), fmt.Sprintf("test %s failed", test.name))
+				fallback, ok := selector.Fallback()
+				assert.Equal(t, test.hasFallback, ok, fmt.Sprintf("test %s failed", test.name))
+				if test.hasFallback {
+					assert.Equal(t, test.expectedFallback, fallback, fmt.Sprintf("test %s failed", test.name))
+				}
 			}
-		}
+		})
 	}
 }
 
@@ -185,27 +229,27 @@ func TestAutoProtocolSelectorRefresh(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, H2mux, selector.Current())
 
-	fetcher.percentage = 100
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
 	assert.Equal(t, HTTP2, selector.Current())
 
-	fetcher.percentage = 0
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}}
 	assert.Equal(t, H2mux, selector.Current())
 
-	fetcher.percentage = 100
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
 	assert.Equal(t, HTTP2, selector.Current())
 
 	fetcher.err = fmt.Errorf("failed to fetch")
 	assert.Equal(t, HTTP2, selector.Current())
 
-	fetcher.percentage = -1
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}}
 	fetcher.err = nil
 	assert.Equal(t, H2mux, selector.Current())
 
-	fetcher.percentage = 0
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}}
 	assert.Equal(t, H2mux, selector.Current())
 
-	fetcher.percentage = 100
-	assert.Equal(t, HTTP2, selector.Current())
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}}
+	assert.Equal(t, QUIC, selector.Current())
 }
 
 func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
@@ -214,35 +258,36 @@ func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, HTTP2, selector.Current())
 
-	fetcher.percentage = 100
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
 	assert.Equal(t, HTTP2, selector.Current())
 
-	fetcher.percentage = 0
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}}
 	assert.Equal(t, HTTP2, selector.Current())
 
 	fetcher.err = fmt.Errorf("failed to fetch")
 	assert.Equal(t, HTTP2, selector.Current())
 
-	fetcher.percentage = -1
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}}
 	fetcher.err = nil
 	assert.Equal(t, H2mux, selector.Current())
 
-	fetcher.percentage = 0
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}}
 	assert.Equal(t, HTTP2, selector.Current())
 
-	fetcher.percentage = 100
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
 	assert.Equal(t, HTTP2, selector.Current())
 
-	fetcher.percentage = -1
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}}
 	assert.Equal(t, H2mux, selector.Current())
 }
 
 func TestProtocolSelectorRefreshTTL(t *testing.T) {
-	fetcher := dynamicMockFetcher{percentage: 100}
+	fetcher := dynamicMockFetcher{}
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}}
 	selector, err := NewProtocolSelector("auto", noWarpRoutingEnabled, testNamedTunnelConfig, fetcher.fetch(), time.Hour, &log)
 	assert.NoError(t, err)
-	assert.Equal(t, HTTP2, selector.Current())
+	assert.Equal(t, QUIC, selector.Current())
 
-	fetcher.percentage = 0
-	assert.Equal(t, HTTP2, selector.Current())
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 0}}
+	assert.Equal(t, QUIC, selector.Current())
 }

connection/quic.go

@@ -9,11 +9,16 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 
+	"github.com/google/uuid"
 	"github.com/lucas-clemente/quic-go"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
+	"golang.org/x/sync/errgroup"
 
+	"github.com/cloudflare/cloudflared/datagramsession"
+	"github.com/cloudflare/cloudflared/ingress"
 	quicpogs "github.com/cloudflare/cloudflared/quic"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
@@ -24,16 +29,16 @@ const (
 	// HTTPMethodKey is used to get or set http method in QUIC ALPN if the underlying proxy connection type is HTTP.
 	HTTPMethodKey = "HttpMethod"
 	// HTTPHostKey is used to get or set http Method in QUIC ALPN if the underlying proxy connection type is HTTP.
-	HTTPHostKey = "HttpHost"
+	HTTPHostKey          = "HttpHost"
+	MaxDatagramFrameSize = 1220
 )
 
 // QUICConnection represents the type that facilitates Proxying via QUIC streams.
 type QUICConnection struct {
-	session           quic.Session
-	logger            *zerolog.Logger
-	httpProxy         OriginProxy
-	gracefulShutdownC <-chan struct{}
-	stoppedGracefully bool
+	session        quic.Session
+	logger         *zerolog.Logger
+	httpProxy      OriginProxy
+	sessionManager datagramsession.Manager
 }
 
 // NewQUICConnection returns a new instance of QUICConnection.
@@ -49,32 +54,56 @@ func NewQUICConnection(
 ) (*QUICConnection, error) {
 	session, err := quic.DialAddr(edgeAddr.String(), tlsConfig, quicConfig)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to dial to edge")
+		return nil, fmt.Errorf("failed to dial to edge: %w", err)
 	}
 
 	registrationStream, err := session.OpenStream()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to open a registration stream")
+		return nil, fmt.Errorf("failed to open a registration stream: %w", err)
 	}
 
-	go controlStreamHandler.ServeControlStream(ctx, registrationStream, connOptions)
+	err = controlStreamHandler.ServeControlStream(ctx, registrationStream, connOptions, false)
+	if err != nil {
+		// Not wrapping error here to be consistent with the http2 message.
+		return nil, err
+	}
+
+	datagramMuxer, err := quicpogs.NewDatagramMuxer(session)
+	if err != nil {
+		return nil, err
+	}
+
+	sessionManager := datagramsession.NewManager(datagramMuxer, observer.log)
 
 	return &QUICConnection{
-		session:   session,
-		httpProxy: httpProxy,
-		logger:    observer.log,
+		session:        session,
+		httpProxy:      httpProxy,
+		logger:         observer.log,
+		sessionManager: sessionManager,
 	}, nil
 }
 
 // Serve starts a QUIC session that begins accepting streams.
 func (q *QUICConnection) Serve(ctx context.Context) error {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		return q.acceptStream(ctx)
+	})
+	errGroup.Go(func() error {
+		return q.sessionManager.Serve(ctx)
+	})
+	return errGroup.Wait()
+}
 
+func (q *QUICConnection) acceptStream(ctx context.Context) error {
 	for {
 		stream, err := q.session.AcceptStream(ctx)
 		if err != nil {
-			return errors.Wrap(err, "failed to accept QUIC stream")
+			// context.Canceled is usually a user ctrl+c. We don't want to log an error here as it's intentional.
+			if errors.Is(err, context.Canceled) {
+				return nil
+			}
+			return fmt.Errorf("failed to accept QUIC stream: %w", err)
 		}
 		go func() {
 			defer stream.Close()
@@ -91,7 +120,30 @@ func (q *QUICConnection) Close() {
 }
 
 func (q *QUICConnection) handleStream(stream quic.Stream) error {
-	connectRequest, err := quicpogs.ReadConnectRequestData(stream)
+	signature, err := quicpogs.DetermineProtocol(stream)
+	if err != nil {
+		return err
+	}
+	switch signature {
+	case quicpogs.DataStreamProtocolSignature:
+		reqServerStream, err := quicpogs.NewRequestServerStream(stream, signature)
+		if err != nil {
+			return nil
+		}
+		return q.handleDataStream(reqServerStream)
+	case quicpogs.RPCStreamProtocolSignature:
+		rpcStream, err := quicpogs.NewRPCServerStream(stream, signature)
+		if err != nil {
+			return err
+		}
+		return q.handleRPCStream(rpcStream)
+	default:
+		return fmt.Errorf("unknown protocol %v", signature)
+	}
+}
+
+func (q *QUICConnection) handleDataStream(stream *quicpogs.RequestServerStream) error {
+	connectRequest, err := stream.ReadConnectRequestData()
 	if err != nil {
 		return err
 	}
@@ -106,32 +158,101 @@ func (q *QUICConnection) handleStream(stream quic.Stream) error {
 		w := newHTTPResponseAdapter(stream)
 		return q.httpProxy.ProxyHTTP(w, req, connectRequest.Type == quicpogs.ConnectionTypeWebsocket)
 	case quicpogs.ConnectionTypeTCP:
-		rwa := &streamReadWriteAcker{
-			ReadWriter: stream,
-		}
+		rwa := &streamReadWriteAcker{stream}
 		return q.httpProxy.ProxyTCP(context.Background(), rwa, &TCPRequest{Dest: connectRequest.Dest})
 	}
 	return nil
 }
 
+func (q *QUICConnection) handleRPCStream(rpcStream *quicpogs.RPCServerStream) error {
+	return rpcStream.Serve(q, q.logger)
+}
+
+// RegisterUdpSession is the RPC method invoked by edge to register and run a session
+func (q *QUICConnection) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeAfterIdleHint time.Duration) error {
+	// Each session is a series of datagram from an eyeball to a dstIP:dstPort.
+	// (src port, dst IP, dst port) uniquely identifies a session, so it needs a dedicated connected socket.
+	originProxy, err := ingress.DialUDP(dstIP, dstPort)
+	if err != nil {
+		q.logger.Err(err).Msgf("Failed to create udp proxy to %s:%d", dstIP, dstPort)
+		return err
+	}
+	session, err := q.sessionManager.RegisterSession(ctx, sessionID, originProxy)
+	if err != nil {
+		q.logger.Err(err).Str("sessionID", sessionID.String()).Msgf("Failed to register udp session")
+		return err
+	}
+
+	go q.serveUDPSession(session, closeAfterIdleHint)
+
+	q.logger.Debug().Msgf("Registered session %v, %v, %v", sessionID, dstIP, dstPort)
+	return nil
+}
+
+func (q *QUICConnection) serveUDPSession(session *datagramsession.Session, closeAfterIdleHint time.Duration) {
+	ctx := q.session.Context()
+	closedByRemote, err := session.Serve(ctx, closeAfterIdleHint)
+	// If session is terminated by remote, then we know it has been unregistered from session manager and edge
+	if !closedByRemote {
+		if err != nil {
+			q.closeUDPSession(ctx, session.ID, err.Error())
+		} else {
+			q.closeUDPSession(ctx, session.ID, "terminated without error")
+		}
+		q.logger.Debug().Err(err).Str("sessionID", session.ID.String()).Msg("session terminated")
+		return
+	}
+	q.logger.Debug().Err(err).Msg("Session terminated by edge")
+}
+
+// closeUDPSession first unregisters the session from session manager, then it tries to unregister from edge
+func (q *QUICConnection) closeUDPSession(ctx context.Context, sessionID uuid.UUID, message string) {
+	q.sessionManager.UnregisterSession(ctx, sessionID, message, false)
+	stream, err := q.session.OpenStream()
+	if err != nil {
+		// Log this at debug because this is not an error if session was closed due to lost connection
+		// with edge
+		q.logger.Debug().Err(err).Str("sessionID", sessionID.String()).
+			Msgf("Failed to open quic stream to unregister udp session with edge")
+		return
+	}
+	rpcClientStream, err := quicpogs.NewRPCClientStream(ctx, stream, q.logger)
+	if err != nil {
+		// Log this at debug because this is not an error if session was closed due to lost connection
+		// with edge
+		q.logger.Err(err).Str("sessionID", sessionID.String()).
+			Msgf("Failed to open rpc stream to unregister udp session with edge")
+		return
+	}
+	if err := rpcClientStream.UnregisterUdpSession(ctx, sessionID, message); err != nil {
+		q.logger.Err(err).Str("sessionID", sessionID.String()).
+			Msgf("Failed to unregister udp session with edge")
+	}
+}
+
+// UnregisterUdpSession is the RPC method invoked by edge to unregister and terminate a sesssion
+func (q *QUICConnection) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID, message string) error {
+	return q.sessionManager.UnregisterSession(ctx, sessionID, message, true)
+}
+
 // streamReadWriteAcker is a light wrapper over QUIC streams with a callback to send response back to
 // the client.
 type streamReadWriteAcker struct {
-	io.ReadWriter
+	*quicpogs.RequestServerStream
 }
 
 // AckConnection acks response back to the proxy.
 func (s *streamReadWriteAcker) AckConnection() error {
-	return quicpogs.WriteConnectResponseData(s, nil)
+	return s.WriteConnectResponseData(nil)
 }
 
 // httpResponseAdapter translates responses written by the HTTP Proxy into ones that can be used in QUIC.
 type httpResponseAdapter struct {
-	io.Writer
+	*quicpogs.RequestServerStream
 }
 
-func newHTTPResponseAdapter(w io.Writer) httpResponseAdapter {
-	return httpResponseAdapter{w}
+func newHTTPResponseAdapter(s *quicpogs.RequestServerStream) httpResponseAdapter {
+	return httpResponseAdapter{s}
 }
 
 func (hrw httpResponseAdapter) WriteRespHeaders(status int, header http.Header) error {
@@ -143,18 +264,19 @@ func (hrw httpResponseAdapter) WriteRespHeaders(status int, header http.Header)
 			metadata = append(metadata, quicpogs.Metadata{Key: httpHeaderKey, Val: v})
 		}
 	}
-	return quicpogs.WriteConnectResponseData(hrw, nil, metadata...)
+	return hrw.WriteConnectResponseData(nil, metadata...)
 }
 
 func (hrw httpResponseAdapter) WriteErrorResponse(err error) {
-	quicpogs.WriteConnectResponseData(hrw, err, quicpogs.Metadata{Key: "HttpStatus", Val: strconv.Itoa(http.StatusBadGateway)})
+	hrw.WriteConnectResponseData(err, quicpogs.Metadata{Key: "HttpStatus", Val: strconv.Itoa(http.StatusBadGateway)})
 }
 
-func buildHTTPRequest(connectRequest *quicpogs.ConnectRequest, body io.Reader) (*http.Request, error) {
+func buildHTTPRequest(connectRequest *quicpogs.ConnectRequest, body io.ReadCloser) (*http.Request, error) {
 	metadata := connectRequest.MetadataMap()
 	dest := connectRequest.Dest
 	method := metadata[HTTPMethodKey]
 	host := metadata[HTTPHostKey]
+	isWebsocket := connectRequest.Type == quicpogs.ConnectionTypeWebsocket
 
 	req, err := http.NewRequest(method, dest, body)
 	if err != nil {
@@ -167,11 +289,42 @@ func buildHTTPRequest(connectRequest *quicpogs.ConnectRequest, body io.Reader) (
 			// metadata.Key is off the format httpHeaderKey:<HTTPHeader>
 			httpHeaderKey := strings.Split(metadata.Key, ":")
 			if len(httpHeaderKey) != 2 {
-				return nil, fmt.Errorf("Header Key: %s malformed", metadata.Key)
+				return nil, fmt.Errorf("header Key: %s malformed", metadata.Key)
 			}
 			req.Header.Add(httpHeaderKey[1], metadata.Val)
 		}
 	}
+	// Go's http.Client automatically sends chunked request body if this value is not set on the
+	// *http.Request struct regardless of header:
+	// https://go.googlesource.com/go/+/go1.8rc2/src/net/http/transfer.go#154.
+	if err := setContentLength(req); err != nil {
+		return nil, fmt.Errorf("Error setting content-length: %w", err)
+	}
+
+	// Go's client defaults to chunked encoding after a 200ms delay if the following cases are true:
+	//   * the request body blocks
+	//   * the content length is not set (or set to -1)
+	//   * the method doesn't usually have a body (GET, HEAD, DELETE, ...)
+	//   * there is no transfer-encoding=chunked already set.
+	// So, if transfer cannot be chunked and content length is 0, we dont set a request body.
+	if !isWebsocket && !isTransferEncodingChunked(req) && req.ContentLength == 0 {
+		req.Body = nil
+	}
 	stripWebsocketUpgradeHeader(req)
 	return req, err
 }
+
+func setContentLength(req *http.Request) error {
+	var err error
+	if contentLengthStr := req.Header.Get("Content-Length"); contentLengthStr != "" {
+		req.ContentLength, err = strconv.ParseInt(contentLengthStr, 10, 64)
+	}
+	return err
+}
+
+func isTransferEncodingChunked(req *http.Request) bool {
+	transferEncodingVal := req.Header.Get("Transfer-Encoding")
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Transfer-Encoding suggests that this can be a comma
+	// separated value as well.
+	return strings.Contains(strings.ToLower(transferEncodingVal), "chunked")
+}

connection/quic_test.go

@@ -13,32 +13,36 @@ import (
 	"math/big"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"sync"
 	"testing"
 	"time"
 
 	"github.com/gobwas/ws/wsutil"
+	"github.com/google/uuid"
 	"github.com/lucas-clemente/quic-go"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/cloudflare/cloudflared/datagramsession"
 	quicpogs "github.com/cloudflare/cloudflared/quic"
-	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
+	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
+)
+
+var (
+	testTLSServerConfig = generateTLSConfig()
+	testQUICConfig      = &quic.Config{
+		KeepAlive:       true,
+		EnableDatagrams: true,
+	}
 )
 
 // TestQUICServer tests if a quic server accepts and responds to a quic client with the acceptance protocol.
 // It also serves as a demonstration for communication with the QUIC connection started by a cloudflared.
 func TestQUICServer(t *testing.T) {
-	quicConfig := &quic.Config{
-		KeepAlive: true,
-	}
-
-	// Setup test.
-	log := zerolog.New(os.Stdout)
-
 	// Start a UDP Listener for QUIC.
 	udpAddr, err := net.ResolveUDPAddr("udp", "127.0.0.1:0")
 	require.NoError(t, err)
@@ -46,18 +50,6 @@ func TestQUICServer(t *testing.T) {
 	require.NoError(t, err)
 	defer udpListener.Close()
 
-	// Create a simple tls config.
-	tlsConfig := generateTLSConfig()
-
-	// Create a client config
-	tlsClientConfig := &tls.Config{
-		InsecureSkipVerify: true,
-		NextProtos:         []string{"argotunnel"},
-	}
-
-	// Start a mock httpProxy
-	originProxy := &mockOriginProxyWithRequest{}
-
 	// This is simply a sample websocket frame message.
 	wsBuf := &bytes.Buffer{}
 	wsutil.WriteClientText(wsBuf, []byte("Hello"))
@@ -75,15 +67,15 @@ func TestQUICServer(t *testing.T) {
 			dest:           "/ok",
 			connectionType: quicpogs.ConnectionTypeHTTP,
 			metadata: []quicpogs.Metadata{
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Cf-Ray",
 					Val: "123123123",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHost",
 					Val: "cf.host",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpMethod",
 					Val: "GET",
 				},
@@ -95,18 +87,22 @@ func TestQUICServer(t *testing.T) {
 			dest:           "/echo_body",
 			connectionType: quicpogs.ConnectionTypeHTTP,
 			metadata: []quicpogs.Metadata{
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Cf-Ray",
 					Val: "123123123",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHost",
 					Val: "cf.host",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpMethod",
 					Val: "POST",
 				},
+				{
+					Key: "HttpHeader:Content-Length",
+					Val: "24",
+				},
 			},
 			message:          []byte("This is the message body"),
 			expectedResponse: []byte("This is the message body"),
@@ -116,19 +112,19 @@ func TestQUICServer(t *testing.T) {
 			dest:           "/ok",
 			connectionType: quicpogs.ConnectionTypeWebsocket,
 			metadata: []quicpogs.Metadata{
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Cf-Cloudflared-Proxy-Connection-Upgrade",
 					Val: "Websocket",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Another-Header",
 					Val: "Misc",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHost",
 					Val: "cf.host",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpMethod",
 					Val: "get",
 				},
@@ -149,56 +145,33 @@ func TestQUICServer(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			ctx, cancel := context.WithCancel(context.Background())
 			var wg sync.WaitGroup
+			wg.Add(1)
 			go func() {
-				wg.Add(1)
 				defer wg.Done()
 				quicServer(
-					t, udpListener, tlsConfig, quicConfig,
+					t, udpListener, testTLSServerConfig, testQUICConfig,
 					test.dest, test.connectionType, test.metadata, test.message, test.expectedResponse,
 				)
 			}()
 
-			rpcClientFactory := mockRPCClientFactory{
-				registered:   make(chan struct{}),
-				unregistered: make(chan struct{}),
-			}
-
-			obs := NewObserver(&log, &log, false)
-			controlStream := NewControlStream(
-				obs,
-				mockConnectedFuse{},
-				&NamedTunnelConfig{},
-				1,
-				rpcClientFactory.newMockRPCClient,
-				nil,
-				1*time.Second,
-			)
-
-			qC, err := NewQUICConnection(
-				ctx,
-				quicConfig,
-				udpListener.LocalAddr(),
-				tlsClientConfig,
-				originProxy,
-				&pogs.ConnectionOptions{},
-				controlStream,
-				NewObserver(&log, &log, false),
-			)
-			require.NoError(t, err)
-			go qC.Serve(ctx)
+			qc := testQUICConnection(ctx, udpListener.LocalAddr(), t)
+			go qc.Serve(ctx)
 
 			wg.Wait()
-
-			select {
-			case <-rpcClientFactory.registered:
-				break //ok
-			case <-time.Tick(time.Second):
-				t.Fatal("timeout out waiting for registration")
-			}
 			cancel()
 		})
 	}
+}
 
+type fakeControlStream struct {
+	ControlStreamHandler
+}
+
+func (fakeControlStream) ServeControlStream(ctx context.Context, rw io.ReadWriteCloser, connOptions *tunnelpogs.ConnectionOptions, shouldWaitForUnregister bool) error {
+	return nil
+}
+func (fakeControlStream) IsStopped() bool {
+	return true
 }
 
 func quicServer(
@@ -224,10 +197,11 @@ func quicServer(
 	stream, err := session.OpenStreamSync(context.Background())
 	require.NoError(t, err)
 
-	err = quicpogs.WriteConnectRequestData(stream, dest, connectionType, metadata...)
+	reqClientStream := quicpogs.RequestClientStream{ReadWriteCloser: stream}
+	err = reqClientStream.WriteConnectRequestData(dest, connectionType, metadata...)
 	require.NoError(t, err)
 
-	_, err = quicpogs.ReadConnectResponseData(stream)
+	_, err = reqClientStream.ReadConnectResponseData()
 	require.NoError(t, err)
 
 	if message != nil {
@@ -303,8 +277,392 @@ func (moc *mockOriginProxyWithRequest) ProxyHTTP(w ResponseWriter, r *http.Reque
 	return nil
 }
 
+func TestBuildHTTPRequest(t *testing.T) {
+	var tests = []struct {
+		name           string
+		connectRequest *quicpogs.ConnectRequest
+		body           io.ReadCloser
+		req            *http.Request
+	}{
+		{
+			name: "check if http.Request is built correctly with content length",
+			connectRequest: &quicpogs.ConnectRequest{
+				Dest: "http://test.com",
+				Metadata: []quicpogs.Metadata{
+					{
+						Key: "HttpHeader:Cf-Cloudflared-Proxy-Connection-Upgrade",
+						Val: "Websocket",
+					},
+					{
+						Key: "HttpHeader:Content-Length",
+						Val: "514",
+					},
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "get",
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "get",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header": []string{"Misc"},
+					"Content-Length": []string{"514"},
+				},
+				ContentLength: 514,
+				Host:          "cf.host",
+				Body:          io.NopCloser(&bytes.Buffer{}),
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
+		{
+			name: "if content length isn't part of request headers, then it's not set",
+			connectRequest: &quicpogs.ConnectRequest{
+				Dest: "http://test.com",
+				Metadata: []quicpogs.Metadata{
+					{
+						Key: "HttpHeader:Cf-Cloudflared-Proxy-Connection-Upgrade",
+						Val: "Websocket",
+					},
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "get",
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "get",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header": []string{"Misc"},
+				},
+				ContentLength: 0,
+				Host:          "cf.host",
+				Body:          nil,
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
+		{
+			name: "if content length is 0, but transfer-encoding is chunked, body is not nil",
+			connectRequest: &quicpogs.ConnectRequest{
+				Dest: "http://test.com",
+				Metadata: []quicpogs.Metadata{
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHeader:Transfer-Encoding",
+						Val: "chunked",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "get",
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "get",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header":    []string{"Misc"},
+					"Transfer-Encoding": []string{"chunked"},
+				},
+				ContentLength: 0,
+				Host:          "cf.host",
+				Body:          io.NopCloser(&bytes.Buffer{}),
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
+		{
+			name: "if content length is 0, but transfer-encoding is gzip,chunked, body is not nil",
+			connectRequest: &quicpogs.ConnectRequest{
+				Dest: "http://test.com",
+				Metadata: []quicpogs.Metadata{
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHeader:Transfer-Encoding",
+						Val: "gzip,chunked",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "get",
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "get",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header":    []string{"Misc"},
+					"Transfer-Encoding": []string{"gzip,chunked"},
+				},
+				ContentLength: 0,
+				Host:          "cf.host",
+				Body:          io.NopCloser(&bytes.Buffer{}),
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
+		{
+			name: "if content length is 0, and connect request is a websocket, body is not nil",
+			connectRequest: &quicpogs.ConnectRequest{
+				Type: quicpogs.ConnectionTypeWebsocket,
+				Dest: "http://test.com",
+				Metadata: []quicpogs.Metadata{
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "get",
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "get",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header": []string{"Misc"},
+				},
+				ContentLength: 0,
+				Host:          "cf.host",
+				Body:          io.NopCloser(&bytes.Buffer{}),
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req, err := buildHTTPRequest(test.connectRequest, test.body)
+			assert.NoError(t, err)
+			test.req = test.req.WithContext(req.Context())
+			assert.Equal(t, test.req, req)
+		})
+	}
+}
+
 func (moc *mockOriginProxyWithRequest) ProxyTCP(ctx context.Context, rwa ReadWriteAcker, tcpRequest *TCPRequest) error {
 	rwa.AckConnection()
 	io.Copy(rwa, rwa)
 	return nil
 }
+
+func TestServeUDPSession(t *testing.T) {
+	// Start a UDP Listener for QUIC.
+	udpAddr, err := net.ResolveUDPAddr("udp", "127.0.0.1:0")
+	require.NoError(t, err)
+	udpListener, err := net.ListenUDP(udpAddr.Network(), udpAddr)
+	require.NoError(t, err)
+	defer udpListener.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	// Establish QUIC connection with edge
+	edgeQUICSessionChan := make(chan quic.Session)
+	go func() {
+		earlyListener, err := quic.Listen(udpListener, testTLSServerConfig, testQUICConfig)
+		require.NoError(t, err)
+
+		edgeQUICSession, err := earlyListener.Accept(ctx)
+		require.NoError(t, err)
+		edgeQUICSessionChan <- edgeQUICSession
+	}()
+
+	qc := testQUICConnection(ctx, udpListener.LocalAddr(), t)
+	go qc.Serve(ctx)
+
+	edgeQUICSession := <-edgeQUICSessionChan
+	serveSession(ctx, qc, edgeQUICSession, closedByOrigin, io.EOF.Error(), t)
+	serveSession(ctx, qc, edgeQUICSession, closedByTimeout, datagramsession.SessionIdleErr(time.Millisecond*50).Error(), t)
+	serveSession(ctx, qc, edgeQUICSession, closedByRemote, "eyeball closed connection", t)
+	cancel()
+}
+
+func serveSession(ctx context.Context, qc *QUICConnection, edgeQUICSession quic.Session, closeType closeReason, expectedReason string, t *testing.T) {
+	var (
+		payload = []byte(t.Name())
+	)
+	sessionID := uuid.New()
+	cfdConn, originConn := net.Pipe()
+	// Registers and run a new session
+	session, err := qc.sessionManager.RegisterSession(ctx, sessionID, cfdConn)
+	require.NoError(t, err)
+
+	sessionDone := make(chan struct{})
+	go func() {
+		qc.serveUDPSession(session, time.Millisecond*50)
+		close(sessionDone)
+	}()
+
+	// Send a message to the quic session on edge side, it should be deumx to this datagram session
+	muxedPayload, err := quicpogs.SuffixSessionID(sessionID, payload)
+	require.NoError(t, err)
+	err = edgeQUICSession.SendMessage(muxedPayload)
+	require.NoError(t, err)
+
+	readBuffer := make([]byte, len(payload)+1)
+	n, err := originConn.Read(readBuffer)
+	require.NoError(t, err)
+	require.Equal(t, len(payload), n)
+	require.True(t, bytes.Equal(payload, readBuffer[:n]))
+
+	// Close connection to terminate session
+	switch closeType {
+	case closedByOrigin:
+		originConn.Close()
+	case closedByRemote:
+		err = qc.UnregisterUdpSession(ctx, sessionID, expectedReason)
+		require.NoError(t, err)
+	case closedByTimeout:
+	}
+
+	if closeType != closedByRemote {
+		// Session was not closed by remote, so closeUDPSession should be invoked to unregister from remote
+		unregisterFromEdgeChan := make(chan struct{})
+		rpcServer := &mockSessionRPCServer{
+			sessionID:            sessionID,
+			unregisterReason:     expectedReason,
+			calledUnregisterChan: unregisterFromEdgeChan,
+		}
+		go runMockSessionRPCServer(ctx, edgeQUICSession, rpcServer, t)
+
+		<-unregisterFromEdgeChan
+	}
+
+	<-sessionDone
+}
+
+type closeReason uint8
+
+const (
+	closedByOrigin closeReason = iota
+	closedByRemote
+	closedByTimeout
+)
+
+func runMockSessionRPCServer(ctx context.Context, session quic.Session, rpcServer *mockSessionRPCServer, t *testing.T) {
+	stream, err := session.AcceptStream(ctx)
+	require.NoError(t, err)
+
+	if stream.StreamID() == 0 {
+		// Skip the first stream, it's the control stream of the QUIC connection
+		stream, err = session.AcceptStream(ctx)
+		require.NoError(t, err)
+	}
+	protocol, err := quicpogs.DetermineProtocol(stream)
+	assert.NoError(t, err)
+	rpcServerStream, err := quicpogs.NewRPCServerStream(stream, protocol)
+	assert.NoError(t, err)
+
+	log := zerolog.New(os.Stdout)
+	err = rpcServerStream.Serve(rpcServer, &log)
+	assert.NoError(t, err)
+}
+
+type mockSessionRPCServer struct {
+	sessionID            uuid.UUID
+	unregisterReason     string
+	calledUnregisterChan chan struct{}
+}
+
+func (s mockSessionRPCServer) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeIdleAfter time.Duration) error {
+	return fmt.Errorf("mockSessionRPCServer doesn't implement RegisterUdpSession")
+}
+
+func (s mockSessionRPCServer) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID, reason string) error {
+	if s.sessionID != sessionID {
+		return fmt.Errorf("expect session ID %s, got %s", s.sessionID, sessionID)
+	}
+	if s.unregisterReason != reason {
+		return fmt.Errorf("expect unregister reason %s, got %s", s.unregisterReason, reason)
+	}
+	close(s.calledUnregisterChan)
+	fmt.Println("unregister from edge")
+	return nil
+}
+
+func testQUICConnection(ctx context.Context, udpListenerAddr net.Addr, t *testing.T) *QUICConnection {
+	tlsClientConfig := &tls.Config{
+		InsecureSkipVerify: true,
+		NextProtos:         []string{"argotunnel"},
+	}
+	// Start a mock httpProxy
+	originProxy := &mockOriginProxyWithRequest{}
+	log := zerolog.New(os.Stdout)
+	qc, err := NewQUICConnection(
+		ctx,
+		testQUICConfig,
+		udpListenerAddr,
+		tlsClientConfig,
+		originProxy,
+		&tunnelpogs.ConnectionOptions{},
+		fakeControlStream{},
+		NewObserver(&log, &log, false),
+	)
+	require.NoError(t, err)
+	return qc
+}

datagramsession/event.go

@@ -0,0 +1,50 @@
+package datagramsession
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/google/uuid"
+)
+
+// registerSessionEvent is an event to start tracking a new session
+type registerSessionEvent struct {
+	sessionID   uuid.UUID
+	originProxy io.ReadWriteCloser
+	resultChan  chan *Session
+}
+
+func newRegisterSessionEvent(sessionID uuid.UUID, originProxy io.ReadWriteCloser) *registerSessionEvent {
+	return &registerSessionEvent{
+		sessionID:   sessionID,
+		originProxy: originProxy,
+		resultChan:  make(chan *Session, 1),
+	}
+}
+
+// unregisterSessionEvent is an event to stop tracking and terminate the session.
+type unregisterSessionEvent struct {
+	sessionID uuid.UUID
+	err       *errClosedSession
+}
+
+// ClosedSessionError represent a condition that closes the session other than I/O
+// I/O error is not included, because the side that closes the session is ambiguous.
+type errClosedSession struct {
+	message  string
+	byRemote bool
+}
+
+func (sc *errClosedSession) Error() string {
+	if sc.byRemote {
+		return fmt.Sprintf("session closed by remote due to %s", sc.message)
+	} else {
+		return fmt.Sprintf("session closed by local due to %s", sc.message)
+	}
+}
+
+// newDatagram is an event when transport receives new datagram
+type newDatagram struct {
+	sessionID uuid.UUID
+	payload   []byte
+}

datagramsession/manager.go

@@ -0,0 +1,139 @@
+package datagramsession
+
+import (
+	"context"
+	"io"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	requestChanCapacity = 16
+)
+
+// Manager defines the APIs to manage sessions from the same transport.
+type Manager interface {
+	// Serve starts the event loop
+	Serve(ctx context.Context) error
+	// RegisterSession starts tracking a session. Caller is responsible for starting the session
+	RegisterSession(ctx context.Context, sessionID uuid.UUID, dstConn io.ReadWriteCloser) (*Session, error)
+	// UnregisterSession stops tracking the session and terminates it
+	UnregisterSession(ctx context.Context, sessionID uuid.UUID, message string, byRemote bool) error
+}
+
+type manager struct {
+	registrationChan   chan *registerSessionEvent
+	unregistrationChan chan *unregisterSessionEvent
+	datagramChan       chan *newDatagram
+	transport          transport
+	sessions           map[uuid.UUID]*Session
+	log                *zerolog.Logger
+}
+
+func NewManager(transport transport, log *zerolog.Logger) Manager {
+	return &manager{
+		registrationChan:   make(chan *registerSessionEvent),
+		unregistrationChan: make(chan *unregisterSessionEvent),
+		// datagramChan is buffered, so it can read more datagrams from transport while the event loop is processing other events
+		datagramChan: make(chan *newDatagram, requestChanCapacity),
+		transport:    transport,
+		sessions:     make(map[uuid.UUID]*Session),
+		log:          log,
+	}
+}
+
+func (m *manager) Serve(ctx context.Context) error {
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		for {
+			sessionID, payload, err := m.transport.ReceiveFrom()
+			if err != nil {
+				return err
+			}
+			datagram := &newDatagram{
+				sessionID: sessionID,
+				payload:   payload,
+			}
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			// Only the event loop routine can update/lookup the sessions map to avoid concurrent access
+			// Send the datagram to the event loop. It will find the session to send to
+			case m.datagramChan <- datagram:
+			}
+		}
+	})
+	errGroup.Go(func() error {
+		for {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case datagram := <-m.datagramChan:
+				m.sendToSession(datagram)
+			case registration := <-m.registrationChan:
+				m.registerSession(ctx, registration)
+			// TODO: TUN-5422: Unregister inactive session upon timeout
+			case unregistration := <-m.unregistrationChan:
+				m.unregisterSession(unregistration)
+			}
+		}
+	})
+	return errGroup.Wait()
+}
+
+func (m *manager) RegisterSession(ctx context.Context, sessionID uuid.UUID, originProxy io.ReadWriteCloser) (*Session, error) {
+	event := newRegisterSessionEvent(sessionID, originProxy)
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case m.registrationChan <- event:
+		session := <-event.resultChan
+		return session, nil
+	}
+}
+
+func (m *manager) registerSession(ctx context.Context, registration *registerSessionEvent) {
+	session := newSession(registration.sessionID, m.transport, registration.originProxy)
+	m.sessions[registration.sessionID] = session
+	registration.resultChan <- session
+}
+
+func (m *manager) UnregisterSession(ctx context.Context, sessionID uuid.UUID, message string, byRemote bool) error {
+	event := &unregisterSessionEvent{
+		sessionID: sessionID,
+		err: &errClosedSession{
+			message:  message,
+			byRemote: byRemote,
+		},
+	}
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case m.unregistrationChan <- event:
+		return nil
+	}
+}
+
+func (m *manager) unregisterSession(unregistration *unregisterSessionEvent) {
+	session, ok := m.sessions[unregistration.sessionID]
+	if ok {
+		delete(m.sessions, unregistration.sessionID)
+		session.close(unregistration.err)
+	}
+}
+
+func (m *manager) sendToSession(datagram *newDatagram) {
+	session, ok := m.sessions[datagram.sessionID]
+	if !ok {
+		m.log.Error().Str("sessionID", datagram.sessionID.String()).Msg("session not found")
+		return
+	}
+	// session writes to destination over a connected UDP socket, which should not be blocking, so this call doesn't
+	// need to run in another go routine
+	_, err := session.transportToDst(datagram.payload)
+	if err != nil {
+		m.log.Err(err).Str("sessionID", datagram.sessionID.String()).Msg("Failed to write payload to session")
+	}
+}

datagramsession/manager_test.go

@@ -0,0 +1,222 @@
+package datagramsession
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+func TestManagerServe(t *testing.T) {
+	const (
+		sessions            = 20
+		msgs                = 50
+		remoteUnregisterMsg = "eyeball closed connection"
+	)
+	log := zerolog.Nop()
+	transport := &mockQUICTransport{
+		reqChan:  newDatagramChannel(1),
+		respChan: newDatagramChannel(1),
+	}
+	mg := NewManager(transport, &log)
+
+	eyeballTracker := make(map[uuid.UUID]*datagramChannel)
+	for i := 0; i < sessions; i++ {
+		sessionID := uuid.New()
+		eyeballTracker[sessionID] = newDatagramChannel(1)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	serveDone := make(chan struct{})
+	go func(ctx context.Context) {
+		mg.Serve(ctx)
+		close(serveDone)
+	}(ctx)
+
+	go func(ctx context.Context) {
+		for {
+			sessionID, payload, err := transport.respChan.Receive(ctx)
+			if err != nil {
+				require.Equal(t, context.Canceled, err)
+				return
+			}
+			respChan := eyeballTracker[sessionID]
+			require.NoError(t, respChan.Send(ctx, sessionID, payload))
+		}
+	}(ctx)
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+	for sID, receiver := range eyeballTracker {
+		// Assign loop variables to local variables
+		sessionID := sID
+		eyeballRespReceiver := receiver
+		errGroup.Go(func() error {
+			payload := testPayload(sessionID)
+			expectResp := testResponse(payload)
+
+			cfdConn, originConn := net.Pipe()
+
+			origin := mockOrigin{
+				expectMsgCount: msgs,
+				expectedMsg:    payload,
+				expectedResp:   expectResp,
+				conn:           originConn,
+			}
+			eyeball := mockEyeball{
+				expectMsgCount:  msgs,
+				expectedMsg:     expectResp,
+				expectSessionID: sessionID,
+				respReceiver:    eyeballRespReceiver,
+			}
+
+			reqErrGroup, reqCtx := errgroup.WithContext(ctx)
+			reqErrGroup.Go(func() error {
+				return origin.serve()
+			})
+			reqErrGroup.Go(func() error {
+				return eyeball.serve(reqCtx)
+			})
+
+			session, err := mg.RegisterSession(ctx, sessionID, cfdConn)
+			require.NoError(t, err)
+
+			sessionDone := make(chan struct{})
+			go func() {
+				closedByRemote, err := session.Serve(ctx, time.Minute*2)
+				closeSession := &errClosedSession{
+					message:  remoteUnregisterMsg,
+					byRemote: true,
+				}
+				require.Equal(t, closeSession, err)
+				require.True(t, closedByRemote)
+				close(sessionDone)
+			}()
+
+			for i := 0; i < msgs; i++ {
+				require.NoError(t, transport.newRequest(ctx, sessionID, testPayload(sessionID)))
+			}
+
+			// Make sure eyeball and origin have received all messages before unregistering the session
+			require.NoError(t, reqErrGroup.Wait())
+
+			require.NoError(t, mg.UnregisterSession(ctx, sessionID, remoteUnregisterMsg, true))
+			<-sessionDone
+
+			return nil
+		})
+	}
+
+	require.NoError(t, errGroup.Wait())
+	cancel()
+	transport.close()
+	<-serveDone
+}
+
+type mockOrigin struct {
+	expectMsgCount int
+	expectedMsg    []byte
+	expectedResp   []byte
+	conn           io.ReadWriteCloser
+}
+
+func (mo *mockOrigin) serve() error {
+	expectedMsgLen := len(mo.expectedMsg)
+	readBuffer := make([]byte, expectedMsgLen+1)
+	for i := 0; i < mo.expectMsgCount; i++ {
+		n, err := mo.conn.Read(readBuffer)
+		if err != nil {
+			return err
+		}
+		if n != expectedMsgLen {
+			return fmt.Errorf("Expect to read %d bytes, read %d", expectedMsgLen, n)
+		}
+		if !bytes.Equal(readBuffer[:n], mo.expectedMsg) {
+			return fmt.Errorf("Expect %v, read %v", mo.expectedMsg, readBuffer[:n])
+		}
+
+		_, err = mo.conn.Write(mo.expectedResp)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func testPayload(sessionID uuid.UUID) []byte {
+	return []byte(fmt.Sprintf("Message from %s", sessionID))
+}
+
+func testResponse(msg []byte) []byte {
+	return []byte(fmt.Sprintf("Response to %v", msg))
+}
+
+type mockEyeball struct {
+	expectMsgCount  int
+	expectedMsg     []byte
+	expectSessionID uuid.UUID
+	respReceiver    *datagramChannel
+}
+
+func (me *mockEyeball) serve(ctx context.Context) error {
+	for i := 0; i < me.expectMsgCount; i++ {
+		sessionID, msg, err := me.respReceiver.Receive(ctx)
+		if err != nil {
+			return err
+		}
+		if sessionID != me.expectSessionID {
+			return fmt.Errorf("Expect session %s, got %s", me.expectSessionID, sessionID)
+		}
+		if !bytes.Equal(msg, me.expectedMsg) {
+			return fmt.Errorf("Expect %v, read %v", me.expectedMsg, msg)
+		}
+	}
+	return nil
+}
+
+// datagramChannel is a channel for Datagram with wrapper to send/receive with context
+type datagramChannel struct {
+	datagramChan chan *newDatagram
+	closedChan   chan struct{}
+}
+
+func newDatagramChannel(capacity uint) *datagramChannel {
+	return &datagramChannel{
+		datagramChan: make(chan *newDatagram, capacity),
+		closedChan:   make(chan struct{}),
+	}
+}
+
+func (rc *datagramChannel) Send(ctx context.Context, sessionID uuid.UUID, payload []byte) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-rc.closedChan:
+		return fmt.Errorf("datagram channel closed")
+	case rc.datagramChan <- &newDatagram{sessionID: sessionID, payload: payload}:
+		return nil
+	}
+}
+
+func (rc *datagramChannel) Receive(ctx context.Context) (uuid.UUID, []byte, error) {
+	select {
+	case <-ctx.Done():
+		return uuid.Nil, nil, ctx.Err()
+	case <-rc.closedChan:
+		return uuid.Nil, nil, fmt.Errorf("datagram channel closed")
+	case msg := <-rc.datagramChan:
+		return msg.sessionID, msg.payload, nil
+	}
+}
+
+func (rc *datagramChannel) Close() {
+	// No need to close msgChan, it will be garbage collect once there is no reference to it
+	close(rc.closedChan)
+}

datagramsession/session.go

@@ -0,0 +1,129 @@
+package datagramsession
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const (
+	defaultCloseIdleAfter = time.Second * 210
+)
+
+func SessionIdleErr(timeout time.Duration) error {
+	return fmt.Errorf("session idle for %v", timeout)
+}
+
+// Each Session is a bidirectional pipe of datagrams between transport and dstConn
+// Currently the only implementation of transport is quic DatagramMuxer
+// Destination can be a connection with origin or with eyeball
+// When the destination is origin:
+// - Datagrams from edge are read by Manager from the transport. Manager finds the corresponding Session and calls the
+//   write method of the Session to send to origin
+// - Datagrams from origin are read from conn and SentTo transport. Transport will return them to eyeball
+// When the destination is eyeball:
+// - Datagrams from eyeball are read from conn and SentTo transport. Transport will send them to cloudflared
+// - Datagrams from cloudflared are read by Manager from the transport. Manager finds the corresponding Session and calls the
+//   write method of the Session to send to eyeball
+type Session struct {
+	ID        uuid.UUID
+	transport transport
+	dstConn   io.ReadWriteCloser
+	// activeAtChan is used to communicate the last read/write time
+	activeAtChan chan time.Time
+	closeChan    chan error
+}
+
+func newSession(id uuid.UUID, transport transport, dstConn io.ReadWriteCloser) *Session {
+	return &Session{
+		ID:        id,
+		transport: transport,
+		dstConn:   dstConn,
+		// activeAtChan has low capacity. It can be full when there are many concurrent read/write. markActive() will
+		// drop instead of blocking because last active time only needs to be an approximation
+		activeAtChan: make(chan time.Time, 2),
+		// capacity is 2 because close() and dstToTransport routine in Serve() can write to this channel
+		closeChan: make(chan error, 2),
+	}
+}
+
+func (s *Session) Serve(ctx context.Context, closeAfterIdle time.Duration) (closedByRemote bool, err error) {
+	go func() {
+		// QUIC implementation copies data to another buffer before returning https://github.com/lucas-clemente/quic-go/blob/v0.24.0/session.go#L1967-L1975
+		// This makes it safe to share readBuffer between iterations
+		readBuffer := make([]byte, s.transport.MTU())
+		for {
+			if err := s.dstToTransport(readBuffer); err != nil {
+				s.closeChan <- err
+				return
+			}
+		}
+	}()
+	err = s.waitForCloseCondition(ctx, closeAfterIdle)
+	if closeSession, ok := err.(*errClosedSession); ok {
+		closedByRemote = closeSession.byRemote
+	}
+	return closedByRemote, err
+}
+
+func (s *Session) waitForCloseCondition(ctx context.Context, closeAfterIdle time.Duration) error {
+	// Closing dstConn cancels read so dstToTransport routine in Serve() can return
+	defer s.dstConn.Close()
+	if closeAfterIdle == 0 {
+		// provide deafult is caller doesn't specify one
+		closeAfterIdle = defaultCloseIdleAfter
+	}
+
+	checkIdleFreq := closeAfterIdle / 8
+	checkIdleTicker := time.NewTicker(checkIdleFreq)
+	defer checkIdleTicker.Stop()
+
+	activeAt := time.Now()
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case reason := <-s.closeChan:
+			return reason
+		// TODO: TUN-5423 evaluate if using atomic is more efficient
+		case now := <-checkIdleTicker.C:
+			// The session is considered inactive if current time is after (last active time + allowed idle time)
+			if now.After(activeAt.Add(closeAfterIdle)) {
+				return SessionIdleErr(closeAfterIdle)
+			}
+		case activeAt = <-s.activeAtChan: // Update last active time
+		}
+	}
+}
+
+func (s *Session) dstToTransport(buffer []byte) error {
+	n, err := s.dstConn.Read(buffer)
+	s.markActive()
+	if n > 0 {
+		if err := s.transport.SendTo(s.ID, buffer[:n]); err != nil {
+			return err
+		}
+	}
+	return err
+}
+
+func (s *Session) transportToDst(payload []byte) (int, error) {
+	s.markActive()
+	return s.dstConn.Write(payload)
+}
+
+// Sends the last active time to the idle checker loop without blocking. activeAtChan will only be full when there
+// are many concurrent read/write. It is fine to lose some precision
+func (s *Session) markActive() {
+	select {
+	case s.activeAtChan <- time.Now():
+	default:
+	}
+}
+
+func (s *Session) close(err *errClosedSession) {
+	s.closeChan <- err
+}

datagramsession/session_test.go

@@ -0,0 +1,194 @@
+package datagramsession
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+// TestCloseSession makes sure a session will stop after context is done
+func TestSessionCtxDone(t *testing.T) {
+	testSessionReturns(t, closeByContext, time.Minute*2)
+}
+
+// TestCloseSession makes sure a session will stop after close method is called
+func TestCloseSession(t *testing.T) {
+	testSessionReturns(t, closeByCallingClose, time.Minute*2)
+}
+
+// TestCloseIdle makess sure a session will stop after there is no read/write for a period defined by closeAfterIdle
+func TestCloseIdle(t *testing.T) {
+	testSessionReturns(t, closeByTimeout, time.Millisecond*100)
+}
+
+func testSessionReturns(t *testing.T, closeBy closeMethod, closeAfterIdle time.Duration) {
+	var (
+		localCloseReason = &errClosedSession{
+			message:  "connection closed by origin",
+			byRemote: false,
+		}
+	)
+	sessionID := uuid.New()
+	cfdConn, originConn := net.Pipe()
+	payload := testPayload(sessionID)
+	transport := &mockQUICTransport{
+		reqChan:  newDatagramChannel(1),
+		respChan: newDatagramChannel(1),
+	}
+	session := newSession(sessionID, transport, cfdConn)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	sessionDone := make(chan struct{})
+	go func() {
+		closedByRemote, err := session.Serve(ctx, closeAfterIdle)
+		switch closeBy {
+		case closeByContext:
+			require.Equal(t, context.Canceled, err)
+			require.False(t, closedByRemote)
+		case closeByCallingClose:
+			require.Equal(t, localCloseReason, err)
+			require.Equal(t, localCloseReason.byRemote, closedByRemote)
+		case closeByTimeout:
+			require.Equal(t, SessionIdleErr(closeAfterIdle), err)
+			require.False(t, closedByRemote)
+		}
+		close(sessionDone)
+	}()
+
+	go func() {
+		n, err := session.transportToDst(payload)
+		require.NoError(t, err)
+		require.Equal(t, len(payload), n)
+	}()
+
+	readBuffer := make([]byte, len(payload)+1)
+	n, err := originConn.Read(readBuffer)
+	require.NoError(t, err)
+	require.Equal(t, len(payload), n)
+
+	lastRead := time.Now()
+
+	switch closeBy {
+	case closeByContext:
+		cancel()
+	case closeByCallingClose:
+		session.close(localCloseReason)
+	}
+
+	<-sessionDone
+	if closeBy == closeByTimeout {
+		require.True(t, time.Now().After(lastRead.Add(closeAfterIdle)))
+	}
+	// call cancelled again otherwise the linter will warn about possible context leak
+	cancel()
+}
+
+type closeMethod int
+
+const (
+	closeByContext closeMethod = iota
+	closeByCallingClose
+	closeByTimeout
+)
+
+func TestWriteToDstSessionPreventClosed(t *testing.T) {
+	testActiveSessionNotClosed(t, false, true)
+}
+
+func TestReadFromDstSessionPreventClosed(t *testing.T) {
+	testActiveSessionNotClosed(t, true, false)
+}
+
+func testActiveSessionNotClosed(t *testing.T, readFromDst bool, writeToDst bool) {
+	const closeAfterIdle = time.Millisecond * 100
+	const activeTime = time.Millisecond * 500
+
+	sessionID := uuid.New()
+	cfdConn, originConn := net.Pipe()
+	payload := testPayload(sessionID)
+	transport := &mockQUICTransport{
+		reqChan:  newDatagramChannel(100),
+		respChan: newDatagramChannel(100),
+	}
+	session := newSession(sessionID, transport, cfdConn)
+
+	startTime := time.Now()
+	activeUntil := startTime.Add(activeTime)
+	ctx, cancel := context.WithCancel(context.Background())
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		session.Serve(ctx, closeAfterIdle)
+		if time.Now().Before(startTime.Add(activeTime)) {
+			return fmt.Errorf("session closed while it's still active")
+		}
+		return nil
+	})
+
+	if readFromDst {
+		errGroup.Go(func() error {
+			for {
+				if time.Now().After(activeUntil) {
+					return nil
+				}
+				if _, err := originConn.Write(payload); err != nil {
+					return err
+				}
+				time.Sleep(closeAfterIdle / 2)
+			}
+		})
+	}
+	if writeToDst {
+		errGroup.Go(func() error {
+			readBuffer := make([]byte, len(payload))
+			for {
+				n, err := originConn.Read(readBuffer)
+				if err != nil {
+					if err == io.EOF || err == io.ErrClosedPipe {
+						return nil
+					}
+					return err
+				}
+				if !bytes.Equal(payload, readBuffer[:n]) {
+					return fmt.Errorf("payload %v is not equal to %v", readBuffer[:n], payload)
+				}
+			}
+		})
+		errGroup.Go(func() error {
+			for {
+				if time.Now().After(activeUntil) {
+					return nil
+				}
+				if _, err := session.transportToDst(payload); err != nil {
+					return err
+				}
+				time.Sleep(closeAfterIdle / 2)
+			}
+		})
+	}
+
+	require.NoError(t, errGroup.Wait())
+	cancel()
+}
+
+func TestMarkActiveNotBlocking(t *testing.T) {
+	const concurrentCalls = 50
+	session := newSession(uuid.New(), nil, nil)
+	var wg sync.WaitGroup
+	wg.Add(concurrentCalls)
+	for i := 0; i < concurrentCalls; i++ {
+		go func() {
+			session.markActive()
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+}

datagramsession/transport.go

@@ -0,0 +1,13 @@
+package datagramsession
+
+import "github.com/google/uuid"
+
+// Transport is a connection between cloudflared and edge that can multiplex datagrams from multiple sessions
+type transport interface {
+	// SendTo writes payload for a session to the transport
+	SendTo(sessionID uuid.UUID, payload []byte) error
+	// ReceiveFrom reads the next datagram from the transport
+	ReceiveFrom() (uuid.UUID, []byte, error)
+	// Max transmission unit of the transport
+	MTU() uint
+}

datagramsession/transport_test.go

@@ -0,0 +1,36 @@
+package datagramsession
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+type mockQUICTransport struct {
+	reqChan  *datagramChannel
+	respChan *datagramChannel
+}
+
+func (mt *mockQUICTransport) SendTo(sessionID uuid.UUID, payload []byte) error {
+	buf := make([]byte, len(payload))
+	// The QUIC implementation copies data to another buffer before returning https://github.com/lucas-clemente/quic-go/blob/v0.24.0/session.go#L1967-L1975
+	copy(buf, payload)
+	return mt.respChan.Send(context.Background(), sessionID, buf)
+}
+
+func (mt *mockQUICTransport) ReceiveFrom() (uuid.UUID, []byte, error) {
+	return mt.reqChan.Receive(context.Background())
+}
+
+func (mt *mockQUICTransport) MTU() uint {
+	return 1220
+}
+
+func (mt *mockQUICTransport) newRequest(ctx context.Context, sessionID uuid.UUID, payload []byte) error {
+	return mt.reqChan.Send(ctx, sessionID, payload)
+}
+
+func (mt *mockQUICTransport) close() {
+	mt.reqChan.Close()
+	mt.respChan.Close()
+}

edgediscovery/allregions/discovery.go

@@ -91,7 +91,7 @@ func edgeDiscovery(log *zerolog.Logger, srvService string) ([][]*EdgeAddr, error
 	return resolvedAddrPerCNAME, nil
 }
 
-func lookupSRVWithDOT(string, string, string) (cname string, addrs []*net.SRV, err error) {
+func lookupSRVWithDOT(srvService string, srvProto string, srvName string) (cname string, addrs []*net.SRV, err error) {
 	// Inspiration: https://github.com/artyom/dot/blob/master/dot.go
 	r := &net.Resolver{
 		PreferGo: true,

edgediscovery/protocol.go

@@ -1,45 +1,50 @@
 package edgediscovery
 
 import (
+	"encoding/json"
 	"fmt"
 	"net"
-	"strconv"
 	"strings"
 )
 
 const (
-	protocolRecord = "protocol.argotunnel.com"
+	protocolRecord = "protocol-v2.argotunnel.com"
 )
 
 var (
 	errNoProtocolRecord = fmt.Errorf("No TXT record found for %s to determine connection protocol", protocolRecord)
 )
 
-func HTTP2Percentage() (int32, error) {
+// ProtocolPercent represents a single Protocol Percentage combination.
+type ProtocolPercent struct {
+	Protocol   string `json:"protocol"`
+	Percentage int32  `json:"percentage"`
+}
+
+// ProtocolPercents represents the preferred distribution ratio of protocols when protocol isn't specified.
+type ProtocolPercents []ProtocolPercent
+
+// GetPercentage returns the threshold percentage of a single protocol.
+func (p ProtocolPercents) GetPercentage(protocol string) int32 {
+	for _, protocolPercent := range p {
+		if strings.ToLower(protocolPercent.Protocol) == strings.ToLower(protocol) {
+			return protocolPercent.Percentage
+		}
+	}
+	return 0
+}
+
+// ProtocolPercentage returns the ratio of protocols and a specification ratio for their selection.
+func ProtocolPercentage() (ProtocolPercents, error) {
 	records, err := net.LookupTXT(protocolRecord)
 	if err != nil {
-		return 0, err
+		return nil, err
 	}
 	if len(records) == 0 {
-		return 0, errNoProtocolRecord
+		return nil, errNoProtocolRecord
 	}
-	return parseHTTP2Precentage(records[0])
-}
-
-// The record looks like http2=percentage
-func parseHTTP2Precentage(record string) (int32, error) {
-	const key = "http2"
-	slices := strings.Split(record, "=")
-	if len(slices) != 2 {
-		return 0, fmt.Errorf("Malformed TXT record %s, expect http2=percentage", record)
-	}
-	if slices[0] != key {
-		return 0, fmt.Errorf("Incorrect key %s, expect %s", slices[0], key)
-	}
-	percentage, err := strconv.ParseInt(slices[1], 10, 32)
-	if err != nil {
-		return 0, err
-	}
-	return int32(percentage), nil
 
+	var protocolsWithPercent ProtocolPercents
+	err = json.Unmarshal([]byte(records[0]), &protocolsWithPercent)
+	return protocolsWithPercent, err
 }

edgediscovery/protocol_test.go

@@ -6,75 +6,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestHTTP2Percentage(t *testing.T) {
-	_, err := HTTP2Percentage()
+func TestProtocolPercentage(t *testing.T) {
+	_, err := ProtocolPercentage()
 	assert.NoError(t, err)
 }
-
-func TestParseHTTP2Precentage(t *testing.T) {
-	tests := []struct {
-		record     string
-		percentage int32
-		wantErr    bool
-	}{
-		{
-			record:     "http2=-1",
-			percentage: -1,
-			wantErr:    false,
-		},
-		{
-			record:     "http2=0",
-			percentage: 0,
-			wantErr:    false,
-		},
-		{
-			record:     "http2=50",
-			percentage: 50,
-			wantErr:    false,
-		},
-		{
-			record:     "http2=100",
-			percentage: 100,
-			wantErr:    false,
-		},
-		{
-			record:     "http2=1000",
-			percentage: 1000,
-			wantErr:    false,
-		},
-		{
-			record:  "http2=10.5",
-			wantErr: true,
-		},
-		{
-			record:  "http2=10 h2mux=90",
-			wantErr: true,
-		},
-		{
-			record:  "http2=ten",
-			wantErr: true,
-		},
-
-		{
-			record:  "h2mux=100",
-			wantErr: true,
-		},
-		{
-			record:  "http2",
-			wantErr: true,
-		},
-		{
-			record:  "http2=",
-			wantErr: true,
-		},
-	}
-
-	for _, test := range tests {
-		p, err := parseHTTP2Precentage(test.record)
-		if test.wantErr {
-			assert.Error(t, err)
-		} else {
-			assert.Equal(t, test.percentage, p)
-		}
-	}
-}

github_release.py

@@ -72,7 +72,7 @@ def get_or_create_release(repo, version, dry_run=False):
     except UnknownObjectException:
         logging.info("Release %s not found", version)
 
-    # We dont want to create a new release tag if one doesnt already exist
+    # We don't want to create a new release tag if one doesn't already exist
     assert_tag_exists(repo, version)
 
     if dry_run:
@@ -198,7 +198,7 @@ def upload_asset(release, filepath, filename, release_version, kv_account_id, na
         pass # the macOS release copy fails with being the same file (already in the artifacts directory)
 
 def main():
-    """ Attempts to upload Asset to Github Release. Creates Release if it doesnt exist """
+    """ Attempts to upload Asset to Github Release. Creates Release if it doesn't exist """
     try:
         args = parse_args()
         client = Github(args.api_key)

go.mod

@@ -1,6 +1,6 @@
 module github.com/cloudflare/cloudflared
 
-go 1.15
+go 1.17
 
 require (
 	github.com/certifi/gocertifi v0.0.0-20200211180108-c7c1fbc02894 // indirect
@@ -28,7 +28,7 @@ require (
 	github.com/json-iterator/go v1.1.10
 	github.com/kr/text v0.2.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lucas-clemente/quic-go v0.23.0
+	github.com/lucas-clemente/quic-go v0.24.0
 	github.com/mattn/go-colorable v0.1.8
 	github.com/miekg/dns v1.1.31
 	github.com/mitchellh/go-homedir v1.1.0
@@ -45,11 +45,11 @@ require (
 	github.com/stretchr/testify v1.6.0
 	github.com/urfave/cli/v2 v2.2.0
 	go.uber.org/automaxprocs v1.4.0
-	golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a
-	golang.org/x/net v0.0.0-20210428140749-89ef3d95e781
+	golang.org/x/crypto v0.0.0-20210921155107-089bfa567519
+	golang.org/x/net v0.0.0-20211109214657-ef0fda0de508
 	golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
-	golang.org/x/sys v0.0.0-20210510120138-977fb7262007
+	golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1
 	golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf
 	google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d // indirect
 	google.golang.org/grpc v1.32.0 // indirect
@@ -62,4 +62,39 @@ require (
 	zombiezen.com/go/capnproto2 v2.18.0+incompatible
 )
 
+require (
+	github.com/BurntSushi/toml v0.3.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/caddyserver/caddy v1.0.5 // indirect
+	github.com/cespare/xxhash/v2 v2.1.1 // indirect
+	github.com/cheekybits/genny v1.0.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 // indirect
+	github.com/francoispqt/gojay v1.2.13 // indirect
+	github.com/gdamore/encoding v1.0.0 // indirect
+	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
+	github.com/lucasb-eyer/go-colorful v1.0.3 // indirect
+	github.com/marten-seemann/qtls-go1-16 v0.1.4 // indirect
+	github.com/marten-seemann/qtls-go1-17 v0.1.0 // indirect
+	github.com/mattn/go-isatty v0.0.12 // indirect
+	github.com/mattn/go-runewidth v0.0.8 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.1 // indirect
+	github.com/nxadm/tail v1.4.8 // indirect
+	github.com/onsi/ginkgo v1.16.4 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/procfs v0.1.3 // indirect
+	github.com/rivo/uniseg v0.1.0 // indirect
+	golang.org/x/mod v0.4.2 // indirect
+	golang.org/x/text v0.3.6 // indirect
+	golang.org/x/tools v0.1.1 // indirect
+	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
+	google.golang.org/appengine v1.6.6 // indirect
+	google.golang.org/protobuf v1.26.0 // indirect
+	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
+)
+
 replace github.com/urfave/cli/v2 => github.com/ipostelnik/cli/v2 v2.3.1-0.20210324024421-b6ea8234fe3d

go.sum

@@ -197,6 +197,7 @@ github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5Kwzbycv
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
+github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJnXKk=
 github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
@@ -265,8 +266,7 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0 h1:jlYHihg//f7RRwuPfptm04yp4s7O6Kw8EZiVYIGcH0g=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
+github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -282,7 +282,6 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
@@ -297,8 +296,7 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2 h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
@@ -422,10 +420,10 @@ github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0U
 github.com/linode/linodego v0.10.0/go.mod h1:cziNP7pbvE3mXIPneHj0oRY8L1WtGEIKlZ8LANE4eXA=
 github.com/liquidweb/liquidweb-go v1.6.0/go.mod h1:UDcVnAMDkZxpw4Y7NOHkqoeiGacVLEIG/i5J9cyixzQ=
 github.com/lucas-clemente/quic-go v0.13.1/go.mod h1:Vn3/Fb0/77b02SGhQk36KzOUmXgVpFfizUfW5WMaqyU=
-github.com/lucas-clemente/quic-go v0.20.0 h1:FSU3YN5VnLafHR27Ejs1r1CYMS7XMyIVDzRewkDLNBw=
-github.com/lucas-clemente/quic-go v0.20.0/go.mod h1:fZq/HUDIM+mW6X6wtzORjC0E/WDBMKe5Hf9bgjISwLk=
 github.com/lucas-clemente/quic-go v0.23.0 h1:5vFnKtZ6nHDFsc/F3uuiF4T3y/AXaQdxjUqiVw26GZE=
 github.com/lucas-clemente/quic-go v0.23.0/go.mod h1:paZuzjXCE5mj6sikVLMvqXk8lJV2AsqtJ6bDhjEfxx0=
+github.com/lucas-clemente/quic-go v0.24.0 h1:ToR7SIIEdrgOhgVTHvPgdVRJfgVy+N0wQAagH7L4d5g=
+github.com/lucas-clemente/quic-go v0.24.0/go.mod h1:paZuzjXCE5mj6sikVLMvqXk8lJV2AsqtJ6bDhjEfxx0=
 github.com/lucasb-eyer/go-colorful v1.0.2/go.mod h1:0MS4r+7BZKSJ5mw4/S5MPN+qHFF1fYclkSPilDOKW0s=
 github.com/lucasb-eyer/go-colorful v1.0.3 h1:QIbQXiugsb+q10B+MI+7DI1oQLdmnep86tWFlaaUAac=
 github.com/lucasb-eyer/go-colorful v1.0.3/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
@@ -437,10 +435,7 @@ github.com/marten-seemann/chacha20 v0.2.0/go.mod h1:HSdjFau7GzYRj+ahFNwsO3ouVJr1
 github.com/marten-seemann/qpack v0.1.0/go.mod h1:LFt1NU/Ptjip0C2CPkhimBz5CGE3WGDAUWqna+CNTrI=
 github.com/marten-seemann/qpack v0.2.1/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
 github.com/marten-seemann/qtls v0.4.1/go.mod h1:pxVXcHHw1pNIt8Qo0pwSYQEoZ8yYOOPXTCZLQQunvRc=
-github.com/marten-seemann/qtls-go1-15 v0.1.4 h1:RehYMOyRW8hPVEja1KBVsFVNSm35Jj9Mvs5yNoZZ28A=
 github.com/marten-seemann/qtls-go1-15 v0.1.4/go.mod h1:GyFwywLKkRt+6mfU99csTEY1joMZz5vmB1WNZH3P81I=
-github.com/marten-seemann/qtls-go1-16 v0.1.3 h1:XEZ1xGorVy9u+lJq+WXNE+hiqRYLNvJGYmwfwKQN2gU=
-github.com/marten-seemann/qtls-go1-16 v0.1.3/go.mod h1:gNpI2Ol+lRS3WwSOtIUUtRwZEQMXjYK+dQSBFbethAk=
 github.com/marten-seemann/qtls-go1-16 v0.1.4 h1:xbHbOGGhrenVtII6Co8akhLEdrawwB2iHl5yhJRpnco=
 github.com/marten-seemann/qtls-go1-16 v0.1.4/go.mod h1:gNpI2Ol+lRS3WwSOtIUUtRwZEQMXjYK+dQSBFbethAk=
 github.com/marten-seemann/qtls-go1-17 v0.1.0 h1:P9ggrs5xtwiqXv/FHNwntmuLMNq3KaSIG93AtAZ48xk=
@@ -504,7 +499,6 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLA
 github.com/nrdcg/auroradns v1.0.0/go.mod h1:6JPXKzIRzZzMqtTDgueIhTi6rFf1QvYE/HzqidhOhjw=
 github.com/nrdcg/goinwx v0.6.1/go.mod h1:XPiut7enlbEdntAqalBIqcYcTEVhpv/dKWgDCX2SwKQ=
 github.com/nrdcg/namesilo v0.2.1/go.mod h1:lwMvfQTyYq+BbjJd30ylEG4GPSS6PII0Tia4rRpRiyw=
-github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
@@ -517,7 +511,6 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
 github.com/onsi/ginkgo v1.16.2/go.mod h1:CObGmKUOKaSC0RjmoAK7tKyn4Azo5P2IWuoMnvwxz1E=
 github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
@@ -526,8 +519,8 @@ github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGV
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.13.0 h1:7lLHu94wT9Ij0o6EWWclhu0aOh32VxhkwEJvzuWPeak=
 github.com/onsi/gomega v1.13.0/go.mod h1:lRk9szgn8TxENtWd0Tp4c3wjlRfMTMH27I+3Je41yGY=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
@@ -742,6 +735,8 @@ golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a h1:vclmkQCjlDX5OydZ9wv8rBCcS0QyQY66Mpf/7BZbInM=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 h1:7I4JAnoQBe7ZtJcBaYHi5UtiO8tQHbUSXxL+pnGRANg=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -821,13 +816,12 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200904194848-62affa334b73 h1:MXfv8rhZWmFeqX3GNZRsd6vOLoaCHjYEX3qkRo3YBUA=
-golang.org/x/net v0.0.0-20200904194848-62affa334b73/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4 h1:4nGaVu0QrbjT/AK2PRLuQfQuh6DJve+pELhqTdAj3x0=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781 h1:DzZ89McO9/gWPsQXS/FVKAlG02ZjaQ6AlZRBimEYOd0=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20211109214657-ef0fda0de508 h1:v3NKo+t/Kc3EASxaKZ82lwK6mCf4ZeObQBduYFZHo7c=
+golang.org/x/net v0.0.0-20211109214657-ef0fda0de508/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -845,7 +839,6 @@ golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 h1:qwRHBd0NqMbJxfbotnDhm2ByMI1Shq4Y6oRJo21SGJA=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
@@ -908,12 +901,13 @@ golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201231184435-2d18734c6014/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf h1:MZ2shdL+ZM/XzY3ZGOnh4Nlpnxz5GSOhOmtHo3iPU6M=
 golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -922,7 +916,6 @@ golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fq
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -1088,7 +1081,6 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0 h1:Ejskq+SyPohKW+1uil0JJMtmHCgJPJ/qWTxr8qp+R4c=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk=
@@ -1130,7 +1122,6 @@ gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

h2mux/activestreammap.go

@@ -93,7 +93,7 @@ func (m *activeStreamMap) Set(newStream *MuxedStream) bool {
 	return true
 }
 
-// Delete stops tracking the stream. It should be called only after it is closed and resetted.
+// Delete stops tracking the stream. It should be called only after it is closed and reset.
 func (m *activeStreamMap) Delete(streamID uint32) {
 	m.Lock()
 	defer m.Unlock()

h2mux/h2_compressor_brotli.go

@@ -1,3 +1,4 @@
+//go:build cgo
 // +build cgo
 
 package h2mux

h2mux/h2_compressor_none.go

@@ -1,3 +1,4 @@
+//go:build !cgo
 // +build !cgo
 
 package h2mux

h2mux/h2_dictionaries.go

@@ -12,7 +12,7 @@ import (
 /* This is an implementation of https://github.com/vkrasnov/h2-compression-dictionaries
 but modified for tunnels in a few key ways:
 Since tunnels is a server-to-server service, some aspects of the spec would cause
-unnessasary head-of-line blocking on the CPU and on the network, hence this implementation
+unnecessary head-of-line blocking on the CPU and on the network, hence this implementation
 allows for parallel compression on the "client", and buffering on the "server" to solve
 this problem. */
 
@@ -67,7 +67,7 @@ var compressionPresets = map[CompressionSetting]CompressionPreset{
 }
 
 func compressionSettingVal(version, fmt, sz, nd uint8) uint32 {
-	// Currently the compression settings are inlcude:
+	// Currently the compression settings are include:
 	// * version: only 1 is supported
 	// * fmt: only 2 for brotli is supported
 	// * sz: log2 of the maximal allowed dictionary size
@@ -438,7 +438,7 @@ func assignDictToStream(s *MuxedStream, p []byte) bool {
 	h2d.dictLock.Lock()
 
 	if w.comp != nil {
-		// Check again with lock, in therory the inteface allows for unordered writes
+		// Check again with lock, in therory the interface allows for unordered writes
 		h2d.dictLock.Unlock()
 		return false
 	}
@@ -468,7 +468,7 @@ func assignDictToStream(s *MuxedStream, p []byte) bool {
 		}
 	} else {
 		// Use the overflow dictionary as last resort
-		// If slots are availabe generate new dictioanries for path and content-type
+		// If slots are available generate new dictionaries for path and content-type
 		useID, _ = h2d.getGenericDictID()
 		pathID, pathFound = h2d.getNextDictID()
 		if pathFound {

h2mux/h2mux.go

@@ -174,7 +174,7 @@ func Handshake(
 	pingTimestamp := NewPingTimestamp()
 	connActive := NewSignal()
 	idleDuration := config.HeartbeatInterval
-	// Sanity check to enusre idelDuration is sane
+	// Sanity check to ensure idelDuration is sane
 	if idleDuration == 0 || idleDuration < defaultTimeout {
 		idleDuration = defaultTimeout
 		config.Log.Info().Msgf("muxer: Minimum idle time has been adjusted to %d", defaultTimeout)
@@ -274,7 +274,7 @@ func (m *Muxer) readPeerSettings(magic uint32) error {
 		m.compressionQuality = compressionPresets[CompressionNone]
 		return nil
 	}
-	// Values used for compression are the mimimum between the two peers
+	// Values used for compression are the minimum between the two peers
 	if sz < m.compressionQuality.dictSize {
 		m.compressionQuality.dictSize = sz
 	}

h2mux/muxmetrics_test.go

@@ -130,7 +130,7 @@ func TestMuxMetricsUpdater(t *testing.T) {
 			m.updateReceiveWindow(uint32(j))
 			m.updateSendWindow(uint32(j))
 
-			// should always be disgarded since the send time is before readerSend
+			// should always be discarded since the send time is before readerSend
 			rm := &roundTripMeasurement{receiveTime: readerStart, sendTime: readerStart.Add(-time.Duration(j*dataPoints) * time.Millisecond)}
 			m.updateRTT(rm)
 

hello/hello.go

@@ -37,7 +37,7 @@ type OriginUpTime struct {
 	UpTime    string    `json:"uptime"`
 }
 
-const defaultServerName = "the Argo Tunnel test server"
+const defaultServerName = "the Cloudflare Tunnel test server"
 const indexTemplate = `
 <!DOCTYPE html>
 <html lang="en">
@@ -45,10 +45,10 @@ const indexTemplate = `
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=Edge">
     <title>
-      Argo Tunnel Connection
+      Cloudflare Tunnel Connection
     </title>
     <meta name="author" content="">
-    <meta name="description" content="Argo Tunnel Connection">
+    <meta name="description" content="Cloudflare Tunnel Connection">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <style>
       html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}section{display:block}h1{font-size:2em;margin:.67em 0}a{background-color:transparent;-webkit-text-decoration-skip:objects}/* 1 */::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}/* 1 */a,body,dd,div,dl,dt,h1,h4,html,p,section{box-sizing:border-box}.bt{border-top-style:solid;border-top-width:1px}.bl{border-left-style:solid;border-left-width:1px}.b--orange{border-color:#f38020}.br1{border-radius:.125rem}.bw2{border-width:.25rem}.dib{display:inline-block}.sans-serif{font-family:open sans,-apple-system,BlinkMacSystemFont,avenir next,avenir,helvetica neue,helvetica,ubuntu,roboto,noto,segoe ui,arial,sans-serif}.overflow-x-auto{overflow-x:auto}.code{font-family:Consolas,monaco,monospace}.b{font-weight:700}.fw3{font-weight:300}.fw4{font-weight:400}.fw5{font-weight:500}.fw6{font-weight:600}.lh-copy{line-height:1.5}.link{text-decoration:none}.link,.link:active,.link:focus,.link:hover,.link:link,.link:visited{transition:color .15s ease-in}.link:focus{outline:1px dotted currentColor}.mw-100{max-width:100%}.mw4{max-width:8rem}.mw7{max-width:48rem}.bg-light-gray{background-color:#f7f7f7}.link-hover:hover{background-color:#1f679e}.white{color:#fff}.bg-white{background-color:#fff}.bg-blue{background-color:#408bc9}.pb2{padding-bottom:.5rem}.pb6{padding-bottom:8rem}.pt3{padding-top:1rem}.pt5{padding-top:4rem}.pv2{padding-top:.5rem;padding-bottom:.5rem}.ph3{padding-left:1rem;padding-right:1rem}.ph4{padding-left:2rem;padding-right:2rem}.ml0{margin-left:0}.mb1{margin-bottom:.25rem}.mb2{margin-bottom:.5rem}.mb3{margin-bottom:1rem}.mt5{margin-top:4rem}.ttu{text-transform:uppercase}.f4{font-size:1.25rem}.f5{font-size:1rem}.f6{font-size:.875rem}.f7{font-size:.75rem}.measure{max-width:30em}.center{margin-left:auto}.center{margin-right:auto}@media screen and (min-width:30em){.f2-ns{font-size:2.25rem}}@media screen and (min-width:30em) and (max-width:60em){.f5-m{font-size:1rem}}@media screen and (min-width:60em){.f4-l{font-size:1.25rem}}
@@ -66,7 +66,7 @@ const indexTemplate = `
         </svg>
         <h1 class="f4 f2-ns mt5 fw5">Congrats! You created a tunnel!</h1>
         <p class="f6 f5-m f4-l measure lh-copy fw3">
-          Argo Tunnel exposes locally running applications to the internet by
+          Cloudflare Tunnel exposes locally running applications to the internet by
           running an encrypted, virtual tunnel from your laptop or server to
           Cloudflare's edge network.
         </p>
@@ -74,7 +74,7 @@ const indexTemplate = `
         <a
           class="fw6 link white bg-blue ph4 pv2 br1 dib f5 link-hover"
           style="border-bottom: 1px solid #1f679e"
-          href="https://developers.cloudflare.com/argo-tunnel/">
+          href="https://developers.cloudflare.com/cloudflare-one/connections/connect-apps">
           Get started here
         </a>
        <section>

ingress/origin_connection.go

@@ -48,7 +48,12 @@ type tcpOverWSConnection struct {
 }
 
 func (wc *tcpOverWSConnection) Stream(ctx context.Context, tunnelConn io.ReadWriter, log *zerolog.Logger) {
-	wc.streamHandler(websocket.NewConn(ctx, tunnelConn, log), wc.conn, log)
+	wsCtx, cancel := context.WithCancel(ctx)
+	wsConn := websocket.NewConn(wsCtx, tunnelConn, log)
+	wc.streamHandler(wsConn, wc.conn, log)
+	cancel()
+	// Makes sure wsConn stops sending ping before terminating the stream
+	wsConn.WaitForShutdown()
 }
 
 func (wc *tcpOverWSConnection) Close() {
@@ -63,7 +68,12 @@ type socksProxyOverWSConnection struct {
 }
 
 func (sp *socksProxyOverWSConnection) Stream(ctx context.Context, tunnelConn io.ReadWriter, log *zerolog.Logger) {
-	socks.StreamNetHandler(websocket.NewConn(ctx, tunnelConn, log), sp.accessPolicy, log)
+	wsCtx, cancel := context.WithCancel(ctx)
+	wsConn := websocket.NewConn(wsCtx, tunnelConn, log)
+	socks.StreamNetHandler(wsConn, sp.accessPolicy, log)
+	cancel()
+	// Makes sure wsConn stops sending ping before terminating the stream
+	wsConn.WaitForShutdown()
 }
 
 func (sp *socksProxyOverWSConnection) Close() {

ingress/origin_connection_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net"
 	"net/http"
@@ -96,7 +97,7 @@ func TestDefaultStreamWSOverTCPConnection(t *testing.T) {
 }
 
 // TestSocksStreamWSOverTCPConnection simulates proxying in socks mode.
-// Eyeball side runs cloudflared accesss tcp with --url flag to start a websocket forwarder which
+// Eyeball side runs cloudflared access tcp with --url flag to start a websocket forwarder which
 // wraps SOCKS5 traffic in websocket
 // Origin side runs a tcpOverWSConnection with socks.StreamHandler
 func TestSocksStreamWSOverTCPConnection(t *testing.T) {
@@ -189,6 +190,55 @@ func TestSocksStreamWSOverTCPConnection(t *testing.T) {
 	}
 }
 
+func TestWsConnReturnsBeforeStreamReturns(t *testing.T) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		eyeballConn := &readWriter{
+			w: w,
+			r: r.Body,
+		}
+
+		cfdConn, originConn := net.Pipe()
+		tcpOverWSConn := tcpOverWSConnection{
+			conn:          cfdConn,
+			streamHandler: DefaultStreamHandler,
+		}
+		go func() {
+			time.Sleep(time.Millisecond * 10)
+			// Simulate losing connection to origin
+			originConn.Close()
+		}()
+		ctx := context.WithValue(r.Context(), websocket.PingPeriodContextKey, time.Microsecond)
+		tcpOverWSConn.Stream(ctx, eyeballConn, testLogger)
+	})
+	server := httptest.NewServer(handler)
+	defer server.Close()
+	client := server.Client()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+	defer cancel()
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+	for i := 0; i < 50; i++ {
+		eyeballConn, edgeConn := net.Pipe()
+		req, err := http.NewRequestWithContext(ctx, http.MethodConnect, server.URL, edgeConn)
+		assert.NoError(t, err)
+
+		resp, err := client.Transport.RoundTrip(req)
+		assert.NoError(t, err)
+		assert.Equal(t, resp.StatusCode, http.StatusOK)
+
+		errGroup.Go(func() error {
+			for {
+				if err := wsutil.WriteClientBinary(eyeballConn, testMessage); err != nil {
+					return nil
+				}
+			}
+		})
+	}
+
+	assert.NoError(t, errGroup.Wait())
+}
+
 type wsEyeball struct {
 	conn net.Conn
 }
@@ -271,3 +321,16 @@ func echoTCPOrigin(t *testing.T, conn net.Conn) {
 	_, err = conn.Write(testResponse)
 	assert.NoError(t, err)
 }
+
+type readWriter struct {
+	w io.Writer
+	r io.Reader
+}
+
+func (r *readWriter) Read(p []byte) (n int, err error) {
+	return r.r.Read(p)
+}
+
+func (r *readWriter) Write(p []byte) (n int, err error) {
+	return r.w.Write(p)
+}

ingress/origin_udp_proxy.go

@@ -0,0 +1,27 @@
+package ingress
+
+import (
+	"fmt"
+	"io"
+	"net"
+)
+
+type UDPProxy struct {
+	io.ReadWriteCloser
+}
+
+func DialUDP(dstIP net.IP, dstPort uint16) (*UDPProxy, error) {
+	dstAddr := &net.UDPAddr{
+		IP:   dstIP,
+		Port: int(dstPort),
+	}
+
+	// We use nil as local addr to force runtime to find the best suitable local address IP given the destination
+	// address as context.
+	udpConn, err := net.DialUDP("udp", nil, dstAddr)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create UDP proxy to origin (%v:%v): %w", dstIP, dstPort, err)
+	}
+
+	return &UDPProxy{udpConn}, nil
+}

jet.yaml

@@ -1,6 +1,6 @@
 ---
 basename: "cloudflared"
-comment: "Cloudflare Argo Tunnel"
+comment: "Cloudflare Tunnel"
 copyright: "Cloudflare, Inc"
 arch: "x86"
 abi: "64"

metrics/readiness.go

@@ -4,46 +4,32 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"sync"
 
 	conn "github.com/cloudflare/cloudflared/connection"
+	"github.com/cloudflare/cloudflared/tunnelstate"
 
 	"github.com/rs/zerolog"
 )
 
 // ReadyServer serves HTTP 200 if the tunnel can serve traffic. Intended for k8s readiness checks.
 type ReadyServer struct {
-	sync.RWMutex
-	isConnected map[int]bool
-	log         *zerolog.Logger
+	tracker *tunnelstate.ConnTracker
 }
 
 // NewReadyServer initializes a ReadyServer and starts listening for dis/connection events.
 func NewReadyServer(log *zerolog.Logger) *ReadyServer {
 	return &ReadyServer{
-		isConnected: make(map[int]bool, 0),
-		log:         log,
+		tracker: tunnelstate.NewConnTracker(log),
 	}
 }
 
 func (rs *ReadyServer) OnTunnelEvent(c conn.Event) {
-	switch c.EventType {
-	case conn.Connected:
-		rs.Lock()
-		rs.isConnected[int(c.Index)] = true
-		rs.Unlock()
-	case conn.Disconnected, conn.Reconnecting, conn.RegisteringTunnel, conn.Unregistering:
-		rs.Lock()
-		rs.isConnected[int(c.Index)] = false
-		rs.Unlock()
-	default:
-		rs.log.Error().Msgf("Unknown connection event case %v", c)
-	}
+	rs.tracker.OnTunnelEvent(c)
 }
 
 type body struct {
-	Status           int `json:"status"`
-	ReadyConnections int `json:"readyConnections"`
+	Status           int  `json:"status"`
+	ReadyConnections uint `json:"readyConnections"`
 }
 
 // ServeHTTP responds with HTTP 200 if the tunnel is connected to the edge.
@@ -63,15 +49,11 @@ func (rs *ReadyServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // This is the bulk of the logic for ServeHTTP, broken into its own pure function
 // to make unit testing easy.
-func (rs *ReadyServer) makeResponse() (statusCode, readyConnections int) {
-	statusCode = http.StatusServiceUnavailable
-	rs.RLock()
-	defer rs.RUnlock()
-	for _, connected := range rs.isConnected {
-		if connected {
-			statusCode = http.StatusOK
-			readyConnections++
-		}
+func (rs *ReadyServer) makeResponse() (statusCode int, readyConnections uint) {
+	readyConnections = rs.tracker.CountActiveConns()
+	if readyConnections > 0 {
+		return http.StatusOK, readyConnections
+	} else {
+		return http.StatusServiceUnavailable, readyConnections
 	}
-	return statusCode, readyConnections
 }

metrics/readiness_test.go

@@ -7,6 +7,8 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 
+	"github.com/cloudflare/cloudflared/tunnelstate"
+
 	"github.com/cloudflare/cloudflared/connection"
 )
 
@@ -18,7 +20,7 @@ func TestReadyServer_makeResponse(t *testing.T) {
 		name                 string
 		fields               fields
 		wantOK               bool
-		wantReadyConnections int
+		wantReadyConnections uint
 	}{
 		{
 			name: "One connection online => HTTP 200",
@@ -49,7 +51,7 @@ func TestReadyServer_makeResponse(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			rs := &ReadyServer{
-				isConnected: tt.fields.isConnected,
+				tracker: tunnelstate.MockedConnTracker(tt.fields.isConnected),
 			}
 			gotStatusCode, gotReadyConnections := rs.makeResponse()
 			if tt.wantOK && gotStatusCode != http.StatusOK {

origin/conn_aware_logger.go

@@ -0,0 +1,42 @@
+package origin
+
+import (
+	"github.com/rs/zerolog"
+
+	"github.com/cloudflare/cloudflared/connection"
+	"github.com/cloudflare/cloudflared/tunnelstate"
+)
+
+type ConnAwareLogger struct {
+	tracker *tunnelstate.ConnTracker
+	logger  *zerolog.Logger
+}
+
+func NewConnAwareLogger(logger *zerolog.Logger, observer *connection.Observer) *ConnAwareLogger {
+	connAwareLogger := &ConnAwareLogger{
+		tracker: tunnelstate.NewConnTracker(logger),
+		logger:  logger,
+	}
+
+	observer.RegisterSink(connAwareLogger.tracker)
+
+	return connAwareLogger
+}
+
+func (c *ConnAwareLogger) ReplaceLogger(logger *zerolog.Logger) *ConnAwareLogger {
+	return &ConnAwareLogger{
+		tracker: c.tracker,
+		logger:  logger,
+	}
+}
+
+func (c *ConnAwareLogger) ConnAwareLogger() *zerolog.Event {
+	if c.tracker.CountActiveConns() == 0 {
+		return c.logger.Error()
+	}
+	return c.logger.Warn()
+}
+
+func (c *ConnAwareLogger) Logger() *zerolog.Logger {
+	return c.logger
+}

origin/proxy.go

@@ -177,6 +177,11 @@ func (p *Proxy) proxyHTTPRequest(
 		roundTripReq.Header.Set("Connection", "keep-alive")
 	}
 
+	// Set the User-Agent as an empty string if not provided to avoid inserting golang default UA
+	if roundTripReq.Header.Get("User-Agent") == "" {
+		roundTripReq.Header.Set("User-Agent", "")
+	}
+
 	resp, err := httpService.RoundTrip(roundTripReq)
 	if err != nil {
 		return errors.Wrap(err, "Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared")

origin/proxy_posix_test.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package origin

origin/proxy_test.go

@@ -767,7 +767,7 @@ func newWSRespWriter(w io.Writer) *wsRespWriter {
 func (w *wsRespWriter) Write(p []byte) (int, error) {
 	returnedMsg, err := wsutil.ReadServerBinary(bytes.NewBuffer(p))
 	if err != nil {
-		// The data was not returned by a websocket connecton.
+		// The data was not returned by a websocket connection.
 		if err != io.ErrUnexpectedEOF {
 			return w.w.Write(p)
 		}

origin/reconnect.go

@@ -91,7 +91,7 @@ func (cm *reconnectCredentialManager) ConnDigest(connID uint8) ([]byte, error) {
 	defer cm.mu.RUnlock()
 	digest, ok := cm.connDigest[connID]
 	if !ok {
-		return nil, fmt.Errorf("no conneciton digest for connection %v", connID)
+		return nil, fmt.Errorf("no connection digest for connection %v", connID)
 	}
 	return digest, nil
 }

origin/supervisor.go

@@ -46,7 +46,7 @@ type Supervisor struct {
 	nextConnectedIndex  int
 	nextConnectedSignal chan struct{}
 
-	log          *zerolog.Logger
+	log          *ConnAwareLogger
 	logTransport *zerolog.Logger
 
 	reconnectCredentialManager *reconnectCredentialManager
@@ -91,7 +91,7 @@ func NewSupervisor(config *TunnelConfig, reconnectCh chan ReconnectSignal, grace
 		edgeIPs:                    edgeIPs,
 		tunnelErrors:               make(chan tunnelError),
 		tunnelsConnecting:          map[int]chan struct{}{},
-		log:                        config.Log,
+		log:                        NewConnAwareLogger(config.Log, config.Observer),
 		logTransport:               config.LogTransport,
 		reconnectCredentialManager: newReconnectCredentialManager(connection.MetricsNamespace, connection.TunnelSubsystem, config.HAConnections),
 		useReconnectToken:          useReconnectToken,
@@ -123,7 +123,7 @@ func (s *Supervisor) Run(
 		if timer, err := s.reconnectCredentialManager.RefreshAuth(ctx, refreshAuthBackoff, s.authenticate); err == nil {
 			refreshAuthBackoffTimer = timer
 		} else {
-			s.log.Err(err).
+			s.log.Logger().Err(err).
 				Dur("refreshAuthRetryDuration", refreshAuthRetryDuration).
 				Msgf("supervisor: initial refreshAuth failed, retrying in %v", refreshAuthRetryDuration)
 			refreshAuthBackoffTimer = time.After(refreshAuthRetryDuration)
@@ -145,7 +145,7 @@ func (s *Supervisor) Run(
 		case tunnelError := <-s.tunnelErrors:
 			tunnelsActive--
 			if tunnelError.err != nil && !shuttingDown {
-				s.log.Err(tunnelError.err).Int(connection.LogFieldConnIndex, tunnelError.index).Msg("Connection terminated")
+				s.log.ConnAwareLogger().Err(tunnelError.err).Int(connection.LogFieldConnIndex, tunnelError.index).Msg("Connection terminated")
 				tunnelsWaiting = append(tunnelsWaiting, tunnelError.index)
 				s.waitForNextTunnel(tunnelError.index)
 
@@ -170,7 +170,7 @@ func (s *Supervisor) Run(
 		case <-refreshAuthBackoffTimer:
 			newTimer, err := s.reconnectCredentialManager.RefreshAuth(ctx, refreshAuthBackoff, s.authenticate)
 			if err != nil {
-				s.log.Err(err).Msg("supervisor: Authentication failed")
+				s.log.Logger().Err(err).Msg("supervisor: Authentication failed")
 				// Permanent failure. Leave the `select` without setting the
 				// channel to be non-null, so we'll never hit this case of the `select` again.
 				continue
@@ -195,7 +195,7 @@ func (s *Supervisor) initialize(
 ) error {
 	availableAddrs := s.edgeIPs.AvailableAddrs()
 	if s.config.HAConnections > availableAddrs {
-		s.log.Info().Msgf("You requested %d HA connections but I can give you at most %d.", s.config.HAConnections, availableAddrs)
+		s.log.Logger().Info().Msgf("You requested %d HA connections but I can give you at most %d.", s.config.HAConnections, availableAddrs)
 		s.config.HAConnections = availableAddrs
 	}
 
@@ -244,6 +244,7 @@ func (s *Supervisor) startFirstTunnel(
 		s.reconnectCredentialManager,
 		s.config,
 		addr,
+		s.log,
 		firstConnIndex,
 		connectedSignal,
 		s.cloudflaredUUID,
@@ -277,6 +278,7 @@ func (s *Supervisor) startFirstTunnel(
 			s.reconnectCredentialManager,
 			s.config,
 			addr,
+			s.log,
 			firstConnIndex,
 			connectedSignal,
 			s.cloudflaredUUID,
@@ -310,6 +312,7 @@ func (s *Supervisor) startTunnel(
 		s.reconnectCredentialManager,
 		s.config,
 		addr,
+		s.log,
 		uint8(index),
 		connectedSignal,
 		s.cloudflaredUUID,
@@ -373,7 +376,7 @@ func (s *Supervisor) authenticate(ctx context.Context, numPreviousAttempts int)
 	if err != nil {
 		return nil, err
 	}
-	rpcClient := connection.NewTunnelServerClient(ctx, stream, s.log)
+	rpcClient := connection.NewTunnelServerClient(ctx, stream, s.log.Logger())
 	defer rpcClient.Close()
 
 	const arbitraryConnectionID = uint8(0)

origin/tunnel.go

@@ -20,6 +20,7 @@ import (
 	"github.com/cloudflare/cloudflared/edgediscovery"
 	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
 	"github.com/cloudflare/cloudflared/h2mux"
+	quicpogs "github.com/cloudflare/cloudflared/quic"
 	"github.com/cloudflare/cloudflared/retry"
 	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -30,6 +31,8 @@ const (
 	dialTimeout              = 15 * time.Second
 	FeatureSerializedHeaders = "serialized_headers"
 	FeatureQuickReconnects   = "quick_reconnects"
+	quicHandshakeIdleTimeout = 5 * time.Second
+	quicMaxIdleTimeout       = 15 * time.Second
 )
 
 type rpcName string
@@ -128,6 +131,7 @@ func ServeTunnelLoop(
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	addr *allregions.EdgeAddr,
+	connAwareLogger *ConnAwareLogger,
 	connIndex uint8,
 	connectedSignal *signal.Signal,
 	cloudflaredUUID uuid.UUID,
@@ -137,7 +141,8 @@ func ServeTunnelLoop(
 	haConnections.Inc()
 	defer haConnections.Dec()
 
-	connLog := config.Log.With().Uint8(connection.LogFieldConnIndex, connIndex).Logger()
+	logger := config.Log.With().Uint8(connection.LogFieldConnIndex, connIndex).Logger()
+	connLog := connAwareLogger.ReplaceLogger(&logger)
 
 	protocolFallback := &protocolFallback{
 		retry.BackoffHandler{MaxRetries: config.Retries},
@@ -157,7 +162,7 @@ func ServeTunnelLoop(
 	for {
 		err, recoverable := ServeTunnel(
 			ctx,
-			&connLog,
+			connLog,
 			credentialManager,
 			config,
 			addr,
@@ -179,7 +184,7 @@ func ServeTunnelLoop(
 		if !ok {
 			return err
 		}
-		connLog.Info().Msgf("Retrying connection in up to %s seconds", duration)
+		connLog.Logger().Info().Msgf("Retrying connection in up to %s seconds", duration)
 
 		select {
 		case <-ctx.Done():
@@ -187,7 +192,13 @@ func ServeTunnelLoop(
 		case <-gracefulShutdownC:
 			return nil
 		case <-protocolFallback.BackoffTimer():
-			if !selectNextProtocol(&connLog, protocolFallback, config.ProtocolSelector) {
+			var idleTimeoutError *quic.IdleTimeoutError
+			if !selectNextProtocol(
+				connLog.Logger(),
+				protocolFallback,
+				config.ProtocolSelector,
+				errors.As(err, &idleTimeoutError),
+			) {
 				return err
 			}
 		}
@@ -219,8 +230,9 @@ func selectNextProtocol(
 	connLog *zerolog.Logger,
 	protocolBackoff *protocolFallback,
 	selector connection.ProtocolSelector,
+	isNetworkActivityTimeout bool,
 ) bool {
-	if protocolBackoff.ReachedMaxRetries() {
+	if protocolBackoff.ReachedMaxRetries() || isNetworkActivityTimeout {
 		fallback, hasFallback := selector.Fallback()
 		if !hasFallback {
 			return false
@@ -245,7 +257,7 @@ func selectNextProtocol(
 // on error returns a flag indicating if error can be retried
 func ServeTunnel(
 	ctx context.Context,
-	connLog *zerolog.Logger,
+	connLog *ConnAwareLogger,
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	addr *allregions.EdgeAddr,
@@ -271,12 +283,73 @@ func ServeTunnel(
 	}()
 
 	defer config.Observer.SendDisconnect(connIndex)
+	err, recoverable = serveTunnel(
+		ctx,
+		connLog,
+		credentialManager,
+		config,
+		addr,
+		connIndex,
+		fuse,
+		backoff,
+		cloudflaredUUID,
+		reconnectCh,
+		protocol,
+		gracefulShutdownC,
+	)
+
+	if err != nil {
+		switch err := err.(type) {
+		case connection.DupConnRegisterTunnelError:
+			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection.")
+			// don't retry this connection anymore, let supervisor pick a new address
+			return err, false
+		case connection.ServerRegisterTunnelError:
+			connLog.ConnAwareLogger().Err(err).Msg("Register tunnel error from server side")
+			// Don't send registration error return from server to Sentry. They are
+			// logged on server side
+			if incidents := config.IncidentLookup.ActiveIncidents(); len(incidents) > 0 {
+				connLog.ConnAwareLogger().Msg(activeIncidentsMsg(incidents))
+			}
+			return err.Cause, !err.Permanent
+		case ReconnectSignal:
+			connLog.Logger().Info().
+				Uint8(connection.LogFieldConnIndex, connIndex).
+				Msgf("Restarting connection due to reconnect signal in %s", err.Delay)
+			err.DelayBeforeReconnect()
+			return err, true
+		default:
+			if err == context.Canceled {
+				connLog.Logger().Debug().Err(err).Msgf("Serve tunnel error")
+				return err, false
+			}
+			connLog.ConnAwareLogger().Err(err).Msgf("Serve tunnel error")
+			_, permanent := err.(unrecoverableError)
+			return err, !permanent
+		}
+	}
+	return nil, false
+}
+
+func serveTunnel(
+	ctx context.Context,
+	connLog *ConnAwareLogger,
+	credentialManager *reconnectCredentialManager,
+	config *TunnelConfig,
+	addr *allregions.EdgeAddr,
+	connIndex uint8,
+	fuse *h2mux.BooleanFuse,
+	backoff *protocolFallback,
+	cloudflaredUUID uuid.UUID,
+	reconnectCh chan ReconnectSignal,
+	protocol connection.Protocol,
+	gracefulShutdownC <-chan struct{},
+) (err error, recoverable bool) {
 
 	connectedFuse := &connectedFuse{
 		fuse:    fuse,
 		backoff: backoff,
 	}
-
 	controlStream := connection.NewControlStream(
 		config.Observer,
 		connectedFuse,
@@ -287,27 +360,28 @@ func ServeTunnel(
 		config.ConnectionConfig.GracePeriod,
 	)
 
-	if protocol == connection.QUIC {
+	switch protocol {
+	case connection.QUIC, connection.QUICWarp:
 		connOptions := config.ConnectionOptions(addr.UDP.String(), uint8(backoff.Retries()))
 		return ServeQUIC(ctx,
 			addr.UDP,
 			config,
+			connLog,
 			connOptions,
 			controlStream,
-			connectedFuse,
+			connIndex,
 			reconnectCh,
 			gracefulShutdownC)
-	}
 
-	edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, config.EdgeTLSConfigs[protocol], addr.TCP)
-	if err != nil {
-		connLog.Err(err).Msg("Unable to establish connection with Cloudflare edge")
-		return err, true
-	}
+	case connection.HTTP2, connection.HTTP2Warp:
+		edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, config.EdgeTLSConfigs[protocol], addr.TCP)
+		if err != nil {
+			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection with Cloudflare edge")
+			return err, true
+		}
 
-	if protocol == connection.HTTP2 {
 		connOptions := config.ConnectionOptions(edgeConn.LocalAddr().String(), uint8(backoff.Retries()))
-		err = ServeHTTP2(
+		if err := ServeHTTP2(
 			ctx,
 			connLog,
 			config,
@@ -317,9 +391,18 @@ func ServeTunnel(
 			connIndex,
 			gracefulShutdownC,
 			reconnectCh,
-		)
-	} else {
-		err = ServeH2mux(
+		); err != nil {
+			return err, false
+		}
+
+	default:
+		edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, config.EdgeTLSConfigs[protocol], addr.TCP)
+		if err != nil {
+			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection with Cloudflare edge")
+			return err, true
+		}
+
+		if err := ServeH2mux(
 			ctx,
 			connLog,
 			credentialManager,
@@ -330,40 +413,11 @@ func ServeTunnel(
 			cloudflaredUUID,
 			reconnectCh,
 			gracefulShutdownC,
-		)
-	}
-
-	if err != nil {
-		switch err := err.(type) {
-		case connection.DupConnRegisterTunnelError:
-			connLog.Err(err).Msg("Unable to establish connection.")
-			// don't retry this connection anymore, let supervisor pick a new address
+		); err != nil {
 			return err, false
-		case connection.ServerRegisterTunnelError:
-			connLog.Err(err).Msg("Register tunnel error from server side")
-			// Don't send registration error return from server to Sentry. They are
-			// logged on server side
-			if incidents := config.IncidentLookup.ActiveIncidents(); len(incidents) > 0 {
-				connLog.Error().Msg(activeIncidentsMsg(incidents))
-			}
-			return err.Cause, !err.Permanent
-		case ReconnectSignal:
-			connLog.Info().
-				Uint8(connection.LogFieldConnIndex, connIndex).
-				Msgf("Restarting connection due to reconnect signal in %s", err.Delay)
-			err.DelayBeforeReconnect()
-			return err, true
-		default:
-			if err == context.Canceled {
-				connLog.Debug().Err(err).Msgf("Serve tunnel error")
-				return err, false
-			}
-			connLog.Err(err).Msgf("Serve tunnel error")
-			_, permanent := err.(unrecoverableError)
-			return err, !permanent
 		}
 	}
-	return nil, false
+	return
 }
 
 type unrecoverableError struct {
@@ -376,7 +430,7 @@ func (r unrecoverableError) Error() string {
 
 func ServeH2mux(
 	ctx context.Context,
-	connLog *zerolog.Logger,
+	connLog *ConnAwareLogger,
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	edgeConn net.Conn,
@@ -386,7 +440,7 @@ func ServeH2mux(
 	reconnectCh chan ReconnectSignal,
 	gracefulShutdownC <-chan struct{},
 ) error {
-	connLog.Debug().Msgf("Connecting via h2mux")
+	connLog.Logger().Debug().Msgf("Connecting via h2mux")
 	// Returns error from parsing the origin URL or handshake errors
 	handler, err, recoverable := connection.NewH2muxConnection(
 		config.ConnectionConfig,
@@ -423,7 +477,7 @@ func ServeH2mux(
 
 func ServeHTTP2(
 	ctx context.Context,
-	connLog *zerolog.Logger,
+	connLog *ConnAwareLogger,
 	config *TunnelConfig,
 	tlsServerConn net.Conn,
 	connOptions *tunnelpogs.ConnectionOptions,
@@ -432,7 +486,7 @@ func ServeHTTP2(
 	gracefulShutdownC <-chan struct{},
 	reconnectCh chan ReconnectSignal,
 ) error {
-	connLog.Debug().Msgf("Connecting via http2")
+	connLog.Logger().Debug().Msgf("Connecting via http2")
 	h2conn := connection.NewHTTP2Connection(
 		tlsServerConn,
 		config.ConnectionConfig,
@@ -464,16 +518,22 @@ func ServeQUIC(
 	ctx context.Context,
 	edgeAddr *net.UDPAddr,
 	config *TunnelConfig,
+	connLogger *ConnAwareLogger,
 	connOptions *tunnelpogs.ConnectionOptions,
 	controlStreamHandler connection.ControlStreamHandler,
-	connectedFuse connection.ConnectedFuse,
+	connIndex uint8,
 	reconnectCh chan ReconnectSignal,
 	gracefulShutdownC <-chan struct{},
 ) (err error, recoverable bool) {
 	tlsConfig := config.EdgeTLSConfigs[connection.QUIC]
 	quicConfig := &quic.Config{
-		HandshakeIdleTimeout: time.Second * 10,
-		KeepAlive:            true,
+		HandshakeIdleTimeout:  quicHandshakeIdleTimeout,
+		MaxIdleTimeout:        quicMaxIdleTimeout,
+		MaxIncomingStreams:    connection.MaxConcurrentStreams,
+		MaxIncomingUniStreams: connection.MaxConcurrentStreams,
+		KeepAlive:             true,
+		EnableDatagrams:       true,
+		Tracer:                quicpogs.NewClientTracer(connLogger.Logger(), connIndex),
 	}
 	for {
 		select {
@@ -490,7 +550,7 @@ func ServeQUIC(
 				controlStreamHandler,
 				config.Observer)
 			if err != nil {
-				config.Log.Error().Msgf("Failed to create new quic connection, err: %v", err)
+				connLogger.ConnAwareLogger().Err(err).Msgf("Failed to create new quic connection")
 				return err, true
 			}
 
@@ -498,7 +558,7 @@ func ServeQUIC(
 			errGroup.Go(func() error {
 				err := quicConn.Serve(ctx)
 				if err != nil {
-					config.Log.Error().Msgf("Failed to serve quic connection, err: %v", err)
+					connLogger.ConnAwareLogger().Err(err).Msg("Failed to serve quic connection")
 				}
 				return fmt.Errorf("Connection with edge closed")
 			})
@@ -511,24 +571,10 @@ func ServeQUIC(
 			if err == nil {
 				return nil, false
 			}
-			config.Log.Info().Msg("Reconnecting with the same udp conn")
 		}
 	}
 }
 
-type quicLogger struct {
-	*zerolog.Logger
-}
-
-func (ql *quicLogger) Write(p []byte) (n int, err error) {
-	ql.Debug().Msgf("quic log: %v", string(p))
-	return len(p), nil
-}
-
-func (ql *quicLogger) Close() error {
-	return nil
-}
-
 func listenReconnect(ctx context.Context, reconnectCh <-chan ReconnectSignal, gracefulShutdownCh <-chan struct{}) error {
 	select {
 	case reconnect := <-reconnectCh:

origin/tunnel_test.go

@@ -8,20 +8,18 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/cloudflare/cloudflared/connection"
+	"github.com/cloudflare/cloudflared/edgediscovery"
 	"github.com/cloudflare/cloudflared/retry"
 )
 
 type dynamicMockFetcher struct {
-	percentage int32
-	err        error
+	protocolPercents edgediscovery.ProtocolPercents
+	err              error
 }
 
 func (dmf *dynamicMockFetcher) fetch() connection.PercentageFetcher {
-	return func() (int32, error) {
-		if dmf.err != nil {
-			return 0, dmf.err
-		}
-		return dmf.percentage, nil
+	return func() (edgediscovery.ProtocolPercents, error) {
+		return dmf.protocolPercents, dmf.err
 	}
 }
 
@@ -39,7 +37,7 @@ func TestWaitForBackoffFallback(t *testing.T) {
 		},
 	}
 	mockFetcher := dynamicMockFetcher{
-		percentage: 0,
+		protocolPercents: edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}},
 	}
 	warpRoutingEnabled := false
 	protocolSelector, err := connection.NewProtocolSelector(
@@ -64,7 +62,7 @@ func TestWaitForBackoffFallback(t *testing.T) {
 	// Retry #0 and #1. At retry #2, we switch protocol, so the fallback loop has one more retry than this
 	for i := 0; i < int(maxRetries-1); i++ {
 		protocolFallback.BackoffTimer() // simulate retry
-		ok := selectNextProtocol(&log, protocolFallback, protocolSelector)
+		ok := selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 		assert.True(t, ok)
 		assert.Equal(t, initProtocol, protocolFallback.protocol)
 	}
@@ -72,7 +70,7 @@ func TestWaitForBackoffFallback(t *testing.T) {
 	// Retry fallback protocol
 	for i := 0; i < int(maxRetries); i++ {
 		protocolFallback.BackoffTimer() // simulate retry
-		ok := selectNextProtocol(&log, protocolFallback, protocolSelector)
+		ok := selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 		assert.True(t, ok)
 		fallback, ok := protocolSelector.Fallback()
 		assert.True(t, ok)
@@ -84,12 +82,19 @@ func TestWaitForBackoffFallback(t *testing.T) {
 
 	// No protocol to fallback, return error
 	protocolFallback.BackoffTimer() // simulate retry
-	ok := selectNextProtocol(&log, protocolFallback, protocolSelector)
+	ok := selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 	assert.False(t, ok)
 
 	protocolFallback.reset()
 	protocolFallback.BackoffTimer() // simulate retry
-	ok = selectNextProtocol(&log, protocolFallback, protocolSelector)
+	ok = selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 	assert.True(t, ok)
 	assert.Equal(t, initProtocol, protocolFallback.protocol)
+
+	protocolFallback.reset()
+	protocolFallback.BackoffTimer() // simulate retry
+	ok = selectNextProtocol(&log, protocolFallback, protocolSelector, true)
+	// Check that we get a true after the first try itself when this flag is true. This allows us to immediately
+	// switch protocols.
+	assert.True(t, ok)
 }

quic/conversion.go

@@ -0,0 +1,99 @@
+package quic
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/logging"
+)
+
+func perspectiveString(p logging.Perspective) string {
+	switch p {
+	case logging.PerspectiveClient:
+		return "client"
+	case logging.PerspectiveServer:
+		return "server"
+	default:
+		return ""
+	}
+}
+
+// Helper to convert logging.ByteCount(alias for int64) to float64 used in prometheus
+func byteCountToPromCount(count logging.ByteCount) float64 {
+	return float64(count)
+}
+
+// Helper to convert Duration to float64 used in prometheus
+func durationToPromGauge(duration time.Duration) float64 {
+	return float64(duration.Milliseconds())
+}
+
+// Helper to convert https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/logging#PacketType into string
+func packetTypeString(pt logging.PacketType) string {
+	switch pt {
+	case logging.PacketTypeInitial:
+		return "initial"
+	case logging.PacketTypeHandshake:
+		return "handshake"
+	case logging.PacketTypeRetry:
+		return "retry"
+	case logging.PacketType0RTT:
+		return "0_rtt"
+	case logging.PacketTypeVersionNegotiation:
+		return "version_negotiation"
+	case logging.PacketType1RTT:
+		return "1_rtt"
+	case logging.PacketTypeStatelessReset:
+		return "stateless_reset"
+	case logging.PacketTypeNotDetermined:
+		return "undetermined"
+	default:
+		return "unknown_packet_type"
+	}
+}
+
+// Helper to convert https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/logging#PacketDropReason into string
+func packetDropReasonString(reason logging.PacketDropReason) string {
+	switch reason {
+	case logging.PacketDropKeyUnavailable:
+		return "key_unavailable"
+	case logging.PacketDropUnknownConnectionID:
+		return "unknown_conn_id"
+	case logging.PacketDropHeaderParseError:
+		return "header_parse_err"
+	case logging.PacketDropPayloadDecryptError:
+		return "payload_decrypt_err"
+	case logging.PacketDropProtocolViolation:
+		return "protocol_violation"
+	case logging.PacketDropDOSPrevention:
+		return "dos_prevention"
+	case logging.PacketDropUnsupportedVersion:
+		return "unsupported_version"
+	case logging.PacketDropUnexpectedPacket:
+		return "unexpected_packet"
+	case logging.PacketDropUnexpectedSourceConnectionID:
+		return "unexpected_src_conn_id"
+	case logging.PacketDropUnexpectedVersion:
+		return "unexpected_version"
+	case logging.PacketDropDuplicate:
+		return "duplicate"
+	default:
+		return "unknown_reason"
+	}
+}
+
+// Helper to convert https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/logging#PacketLossReason into string
+func packetLossReasonString(reason logging.PacketLossReason) string {
+	switch reason {
+	case logging.PacketLossReorderingThreshold:
+		return "reordering"
+	case logging.PacketLossTimeThreshold:
+		return "timeout"
+	default:
+		return "unknown_loss_reason"
+	}
+}
+
+func uint8ToString(input uint8) string {
+	return strconv.FormatUint(uint64(input), 10)
+}

quic/datagram.go

@@ -0,0 +1,88 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/lucas-clemente/quic-go"
+	"github.com/pkg/errors"
+)
+
+const (
+	MaxDatagramFrameSize = 1220
+	sessionIDLen         = len(uuid.UUID{})
+)
+
+type DatagramMuxer struct {
+	ID      uuid.UUID
+	session quic.Session
+}
+
+func NewDatagramMuxer(quicSession quic.Session) (*DatagramMuxer, error) {
+	muxerID, err := uuid.NewRandom()
+	if err != nil {
+		return nil, err
+	}
+	return &DatagramMuxer{
+		ID:      muxerID,
+		session: quicSession,
+	}, nil
+}
+
+// SendTo suffix the session ID to the payload so the other end of the QUIC session can demultiplex
+// the payload from multiple datagram sessions
+func (dm *DatagramMuxer) SendTo(sessionID uuid.UUID, payload []byte) error {
+	if len(payload) > MaxDatagramFrameSize-sessionIDLen {
+		// TODO: TUN-5302 return ICMP packet too big message
+		return fmt.Errorf("origin UDP payload has %d bytes, which exceeds transport MTU %d", len(payload), MaxDatagramFrameSize-sessionIDLen)
+	}
+	msgWithID, err := SuffixSessionID(sessionID, payload)
+	if err != nil {
+		return errors.Wrap(err, "Failed to suffix session ID to datagram, it will be dropped")
+	}
+	if err := dm.session.SendMessage(msgWithID); err != nil {
+		return errors.Wrap(err, "Failed to send datagram back to edge")
+	}
+	return nil
+}
+
+// ReceiveFrom extracts datagram session ID, then sends the session ID and payload to session manager
+// which determines how to proxy to the origin. It assumes the datagram session has already been
+// registered with session manager through other side channel
+func (dm *DatagramMuxer) ReceiveFrom() (uuid.UUID, []byte, error) {
+	msg, err := dm.session.ReceiveMessage()
+	if err != nil {
+		return uuid.Nil, nil, err
+	}
+	return ExtractSessionID(msg)
+}
+
+func (dm *DatagramMuxer) MTU() uint {
+	return MaxDatagramFrameSize
+}
+
+// Each QUIC datagram should be suffixed with session ID.
+// ExtractSessionID extracts the session ID and a slice with only the payload
+func ExtractSessionID(b []byte) (uuid.UUID, []byte, error) {
+	msgLen := len(b)
+	if msgLen < sessionIDLen {
+		return uuid.Nil, nil, fmt.Errorf("session ID has %d bytes, but data only has %d", sessionIDLen, len(b))
+	}
+	// Parse last 16 bytess as UUID and remove it from slice
+	sessionID, err := uuid.FromBytes(b[len(b)-sessionIDLen:])
+	if err != nil {
+		return uuid.Nil, nil, err
+	}
+	b = b[:len(b)-sessionIDLen]
+	return sessionID, b, nil
+}
+
+// SuffixSessionID appends the session ID at the end of the payload. Suffix is more performant than prefix because
+// the payload slice might already have enough capacity to append the session ID at the end
+func SuffixSessionID(sessionID uuid.UUID, b []byte) ([]byte, error) {
+	if len(b)+len(sessionID) > MaxDatagramFrameSize {
+		return nil, fmt.Errorf("datagram size exceed %d", MaxDatagramFrameSize)
+	}
+	b = append(b, sessionID[:]...)
+	return b, nil
+}

quic/datagram_test.go

@@ -0,0 +1,41 @@
+package quic
+
+import (
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	testSessionID = uuid.New()
+)
+
+func TestSuffixThenRemoveSessionID(t *testing.T) {
+	msg := []byte(t.Name())
+	msgWithID, err := SuffixSessionID(testSessionID, msg)
+	require.NoError(t, err)
+	require.Len(t, msgWithID, len(msg)+sessionIDLen)
+
+	sessionID, msgWithoutID, err := ExtractSessionID(msgWithID)
+	require.NoError(t, err)
+	require.Equal(t, msg, msgWithoutID)
+	require.Equal(t, testSessionID, sessionID)
+}
+
+func TestRemoveSessionIDError(t *testing.T) {
+	// message is too short to contain session ID
+	msg := []byte("test")
+	_, _, err := ExtractSessionID(msg)
+	require.Error(t, err)
+}
+
+func TestSuffixSessionIDError(t *testing.T) {
+	msg := make([]byte, MaxDatagramFrameSize-sessionIDLen)
+	_, err := SuffixSessionID(testSessionID, msg)
+	require.NoError(t, err)
+
+	msg = make([]byte, MaxDatagramFrameSize-sessionIDLen+1)
+	_, err = SuffixSessionID(testSessionID, msg)
+	require.Error(t, err)
+}

quic/metrics.go

@@ -0,0 +1,373 @@
+package quic
+
+import (
+	"sync"
+
+	"github.com/lucas-clemente/quic-go/logging"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+const (
+	namespace = "quic"
+)
+
+var (
+	clientConnLabels = []string{"conn_index"}
+	clientMetrics    = struct {
+		totalConnections  prometheus.Counter
+		closedConnections *prometheus.CounterVec
+		sentPackets       *prometheus.CounterVec
+		sentBytes         *prometheus.CounterVec
+		receivePackets    *prometheus.CounterVec
+		receiveBytes      *prometheus.CounterVec
+		bufferedPackets   *prometheus.CounterVec
+		droppedPackets    *prometheus.CounterVec
+		lostPackets       *prometheus.CounterVec
+		minRTT            *prometheus.GaugeVec
+		latestRTT         *prometheus.GaugeVec
+		smoothedRTT       *prometheus.GaugeVec
+	}{
+		totalConnections: prometheus.NewCounter(
+			totalConnectionsOpts(logging.PerspectiveClient),
+		),
+		closedConnections: prometheus.NewCounterVec(
+			closedConnectionsOpts(logging.PerspectiveClient),
+			[]string{"error"},
+		),
+		sentPackets: prometheus.NewCounterVec(
+			sentPacketsOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		sentBytes: prometheus.NewCounterVec(
+			sentBytesOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		receivePackets: prometheus.NewCounterVec(
+			receivePacketsOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		receiveBytes: prometheus.NewCounterVec(
+			receiveBytesOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		bufferedPackets: prometheus.NewCounterVec(
+			bufferedPacketsOpts(logging.PerspectiveClient),
+			append(clientConnLabels, "packet_type"),
+		),
+		droppedPackets: prometheus.NewCounterVec(
+			droppedPacketsOpts(logging.PerspectiveClient),
+			append(clientConnLabels, "packet_type", "reason"),
+		),
+		lostPackets: prometheus.NewCounterVec(
+			lostPacketsOpts(logging.PerspectiveClient),
+			append(clientConnLabels, "reason"),
+		),
+		minRTT: prometheus.NewGaugeVec(
+			prometheus.GaugeOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveClient),
+				Name:      "min_rtt",
+				Help:      "Lowest RTT measured on a connection in millisec",
+			},
+			clientConnLabels,
+		),
+		latestRTT: prometheus.NewGaugeVec(
+			prometheus.GaugeOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveClient),
+				Name:      "latest_rtt",
+				Help:      "Latest RTT measured on a connection",
+			},
+			clientConnLabels,
+		),
+		smoothedRTT: prometheus.NewGaugeVec(
+			prometheus.GaugeOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveClient),
+				Name:      "smoothed_rtt",
+				Help:      "Calculated smoothed RTT measured on a connection in millisec",
+			},
+			clientConnLabels,
+		),
+	}
+	// The server has many QUIC connections. Adding per connection label incurs high memory cost
+	serverMetrics = struct {
+		totalConnections  prometheus.Counter
+		closedConnections prometheus.Counter
+		sentPackets       prometheus.Counter
+		sentBytes         prometheus.Counter
+		receivePackets    prometheus.Counter
+		receiveBytes      prometheus.Counter
+		bufferedPackets   *prometheus.CounterVec
+		droppedPackets    *prometheus.CounterVec
+		lostPackets       *prometheus.CounterVec
+		rtt               prometheus.Histogram
+	}{
+		totalConnections: prometheus.NewCounter(
+			totalConnectionsOpts(logging.PerspectiveServer),
+		),
+		closedConnections: prometheus.NewCounter(
+			closedConnectionsOpts(logging.PerspectiveServer),
+		),
+		sentPackets: prometheus.NewCounter(
+			sentPacketsOpts(logging.PerspectiveServer),
+		),
+		sentBytes: prometheus.NewCounter(
+			sentBytesOpts(logging.PerspectiveServer),
+		),
+		receivePackets: prometheus.NewCounter(
+			receivePacketsOpts(logging.PerspectiveServer),
+		),
+		receiveBytes: prometheus.NewCounter(
+			receiveBytesOpts(logging.PerspectiveServer),
+		),
+		bufferedPackets: prometheus.NewCounterVec(
+			bufferedPacketsOpts(logging.PerspectiveServer),
+			[]string{"packet_type"},
+		),
+		droppedPackets: prometheus.NewCounterVec(
+			droppedPacketsOpts(logging.PerspectiveServer),
+			[]string{"packet_type", "reason"},
+		),
+		lostPackets: prometheus.NewCounterVec(
+			lostPacketsOpts(logging.PerspectiveServer),
+			[]string{"reason"},
+		),
+		rtt: prometheus.NewHistogram(
+			prometheus.HistogramOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveServer),
+				Name:      "rtt",
+				Buckets:   []float64{5, 10, 20, 30, 40, 50, 75, 100},
+			},
+		),
+	}
+	registerClient = sync.Once{}
+	registerServer = sync.Once{}
+)
+
+// MetricsCollector abstracts the difference between client and server metrics from connTracer
+type MetricsCollector interface {
+	startedConnection()
+	closedConnection(err error)
+	sentPackets(logging.ByteCount)
+	receivedPackets(logging.ByteCount)
+	bufferedPackets(logging.PacketType)
+	droppedPackets(logging.PacketType, logging.ByteCount, logging.PacketDropReason)
+	lostPackets(logging.PacketLossReason)
+	updatedRTT(*logging.RTTStats)
+}
+
+func totalConnectionsOpts(p logging.Perspective) prometheus.CounterOpts {
+	var help string
+	if p == logging.PerspectiveClient {
+		help = "Number of connections initiated. For all quic metrics, client means the side initiating the connection"
+	} else {
+		help = "Number of connections accepted. For all quic metrics, server means the side accepting connections"
+	}
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "total_connections",
+		Help:      help,
+	}
+}
+
+func closedConnectionsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "closed_connections",
+		Help:      "Number of connections that has been closed",
+	}
+}
+
+func sentPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "sent_packets",
+		Help:      "Number of packets that have been sent through a connection",
+	}
+}
+
+func sentBytesOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "sent_bytes",
+		Help:      "Number of bytes that have been sent through a connection",
+	}
+}
+
+func receivePacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "receive_packets",
+		Help:      "Number of packets that have been received through a connection",
+	}
+}
+
+func receiveBytesOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "receive_bytes",
+		Help:      "Number of bytes that have been received through a connection",
+	}
+}
+
+func bufferedPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "buffered_packets",
+		Help:      "Number of bytes that have been buffered on a connection",
+	}
+}
+
+func droppedPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "dropped_packets",
+		Help:      "Number of bytes that have been dropped on a connection",
+	}
+}
+
+func lostPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "lost_packets",
+		Help:      "Number of packets that have been lost from a connection",
+	}
+}
+
+type clientCollector struct {
+	index string
+}
+
+func newClientCollector(index uint8) MetricsCollector {
+	registerClient.Do(func() {
+		prometheus.MustRegister(
+			clientMetrics.totalConnections,
+			clientMetrics.closedConnections,
+			clientMetrics.sentPackets,
+			clientMetrics.sentBytes,
+			clientMetrics.receivePackets,
+			clientMetrics.receiveBytes,
+			clientMetrics.bufferedPackets,
+			clientMetrics.droppedPackets,
+			clientMetrics.lostPackets,
+			clientMetrics.minRTT,
+			clientMetrics.latestRTT,
+			clientMetrics.smoothedRTT,
+		)
+	})
+	return &clientCollector{
+		index: uint8ToString(index),
+	}
+}
+
+func (cc *clientCollector) startedConnection() {
+	clientMetrics.totalConnections.Inc()
+}
+
+func (cc *clientCollector) closedConnection(err error) {
+	clientMetrics.closedConnections.WithLabelValues(err.Error()).Inc()
+}
+
+func (cc *clientCollector) sentPackets(size logging.ByteCount) {
+	clientMetrics.sentPackets.WithLabelValues(cc.index).Inc()
+	clientMetrics.sentBytes.WithLabelValues(cc.index).Add(byteCountToPromCount(size))
+}
+
+func (cc *clientCollector) receivedPackets(size logging.ByteCount) {
+	clientMetrics.receivePackets.WithLabelValues(cc.index).Inc()
+	clientMetrics.receiveBytes.WithLabelValues(cc.index).Add(byteCountToPromCount(size))
+}
+
+func (cc *clientCollector) bufferedPackets(packetType logging.PacketType) {
+	clientMetrics.bufferedPackets.WithLabelValues(cc.index, packetTypeString(packetType)).Inc()
+}
+
+func (cc *clientCollector) droppedPackets(packetType logging.PacketType, size logging.ByteCount, reason logging.PacketDropReason) {
+	clientMetrics.droppedPackets.WithLabelValues(
+		cc.index,
+		packetTypeString(packetType),
+		packetDropReasonString(reason),
+	).Add(byteCountToPromCount(size))
+}
+
+func (cc *clientCollector) lostPackets(reason logging.PacketLossReason) {
+	clientMetrics.lostPackets.WithLabelValues(cc.index, packetLossReasonString(reason)).Inc()
+}
+
+func (cc *clientCollector) updatedRTT(rtt *logging.RTTStats) {
+	clientMetrics.minRTT.WithLabelValues(cc.index).Set(durationToPromGauge(rtt.MinRTT()))
+	clientMetrics.latestRTT.WithLabelValues(cc.index).Set(durationToPromGauge(rtt.LatestRTT()))
+	clientMetrics.smoothedRTT.WithLabelValues(cc.index).Set(durationToPromGauge(rtt.SmoothedRTT()))
+}
+
+type serverCollector struct{}
+
+func newServiceCollector() MetricsCollector {
+	registerServer.Do(func() {
+		prometheus.MustRegister(
+			serverMetrics.totalConnections,
+			serverMetrics.closedConnections,
+			serverMetrics.sentPackets,
+			serverMetrics.sentBytes,
+			serverMetrics.receivePackets,
+			serverMetrics.receiveBytes,
+			serverMetrics.bufferedPackets,
+			serverMetrics.droppedPackets,
+			serverMetrics.lostPackets,
+			serverMetrics.rtt,
+		)
+	})
+	return &serverCollector{}
+}
+
+func (sc *serverCollector) startedConnection() {
+	serverMetrics.totalConnections.Inc()
+}
+
+func (sc *serverCollector) closedConnection(err error) {
+	serverMetrics.closedConnections.Inc()
+}
+
+func (sc *serverCollector) sentPackets(size logging.ByteCount) {
+	serverMetrics.sentPackets.Inc()
+	serverMetrics.sentBytes.Add(byteCountToPromCount(size))
+}
+
+func (sc *serverCollector) receivedPackets(size logging.ByteCount) {
+	serverMetrics.receivePackets.Inc()
+	serverMetrics.receiveBytes.Add(byteCountToPromCount(size))
+}
+
+func (sc *serverCollector) bufferedPackets(packetType logging.PacketType) {
+	serverMetrics.bufferedPackets.WithLabelValues(packetTypeString(packetType)).Inc()
+}
+
+func (sc *serverCollector) droppedPackets(packetType logging.PacketType, size logging.ByteCount, reason logging.PacketDropReason) {
+	serverMetrics.droppedPackets.WithLabelValues(
+		packetTypeString(packetType),
+		packetDropReasonString(reason),
+	).Add(byteCountToPromCount(size))
+}
+
+func (sc *serverCollector) lostPackets(reason logging.PacketLossReason) {
+	serverMetrics.lostPackets.WithLabelValues(packetLossReasonString(reason)).Inc()
+}
+
+func (sc *serverCollector) updatedRTT(rtt *logging.RTTStats) {
+	latestRTT := rtt.LatestRTT()
+	// May return 0 if no valid updates have occurred
+	if latestRTT > 0 {
+		serverMetrics.rtt.Observe(durationToPromGauge(latestRTT))
+	}
+}

quic/quic_protocol.go

@@ -1,16 +1,33 @@
 package quic
 
 import (
-	"bytes"
+	"context"
 	"fmt"
 	"io"
+	"net"
+	"time"
 
 	capnp "zombiezen.com/go/capnproto2"
+	"zombiezen.com/go/capnproto2/rpc"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
+
+	"github.com/cloudflare/cloudflared/tunnelrpc"
+	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 
-// protocolSignature is a custom protocol signature to ensure that whoever performs a handshake does not write data
-// before writing the metadata.
-var protocolSignature = []byte{0x0A, 0x36, 0xCD, 0x12, 0xA1, 0x3E}
+// The first 6 bytes of the stream is used to distinguish the type of stream. It ensures whoever performs a handshake does
+// not write data before writing the metadata.
+type ProtocolSignature [6]byte
+
+var (
+	// DataStreamProtocolSignature is a custom protocol signature for data stream
+	DataStreamProtocolSignature = ProtocolSignature{0x0A, 0x36, 0xCD, 0x12, 0xA1, 0x3E}
+
+	// RPCStreamProtocolSignature is a custom protocol signature for RPC stream
+	RPCStreamProtocolSignature = ProtocolSignature{0x52, 0xBB, 0x82, 0x5C, 0xDB, 0x65}
+)
 
 const protocolVersionLength = 2
 
@@ -20,18 +37,26 @@ const (
 	protocolV1 protocolVersion = "01"
 )
 
+// RequestServerStream is a stream to serve requests
+type RequestServerStream struct {
+	io.ReadWriteCloser
+}
+
+func NewRequestServerStream(stream io.ReadWriteCloser, signature ProtocolSignature) (*RequestServerStream, error) {
+	if signature != DataStreamProtocolSignature {
+		return nil, fmt.Errorf("RequestClientStream can only be created from data stream")
+	}
+	return &RequestServerStream{stream}, nil
+}
+
 // ReadConnectRequestData reads the handshake data from a QUIC stream.
-func ReadConnectRequestData(stream io.Reader) (*ConnectRequest, error) {
-	if err := verifySignature(stream); err != nil {
-		return nil, err
-	}
-
+func (rss *RequestServerStream) ReadConnectRequestData() (*ConnectRequest, error) {
 	// This is a NO-OP for now. We could cause a branching if we wanted to use multiple versions.
-	if _, err := readVersion(stream); err != nil {
+	if _, err := readVersion(rss); err != nil {
 		return nil, err
 	}
 
-	msg, err := capnp.NewDecoder(stream).Decode()
+	msg, err := capnp.NewDecoder(rss).Decode()
 	if err != nil {
 		return nil, err
 	}
@@ -43,50 +68,8 @@ func ReadConnectRequestData(stream io.Reader) (*ConnectRequest, error) {
 	return r, nil
 }
 
-// WriteConnectRequestData writes requestMeta to a stream.
-func WriteConnectRequestData(stream io.Writer, dest string, connectionType ConnectionType, metadata ...Metadata) error {
-	connectRequest := &ConnectRequest{
-		Dest:     dest,
-		Type:     connectionType,
-		Metadata: metadata,
-	}
-
-	msg, err := connectRequest.toPogs()
-	if err != nil {
-		return err
-	}
-
-	if err := writePreamble(stream); err != nil {
-		return err
-	}
-	return capnp.NewEncoder(stream).Encode(msg)
-}
-
-// ReadConnectResponseData reads the response to a RequestMeta in a stream.
-func ReadConnectResponseData(stream io.Reader) (*ConnectResponse, error) {
-	if err := verifySignature(stream); err != nil {
-		return nil, err
-	}
-
-	// This is a NO-OP for now. We could cause a branching if we wanted to use multiple versions.
-	if _, err := readVersion(stream); err != nil {
-		return nil, err
-	}
-
-	msg, err := capnp.NewDecoder(stream).Decode()
-	if err != nil {
-		return nil, err
-	}
-
-	r := &ConnectResponse{}
-	if err := r.fromPogs(msg); err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
 // WriteConnectResponseData writes response to a QUIC stream.
-func WriteConnectResponseData(stream io.Writer, respErr error, metadata ...Metadata) error {
+func (rss *RequestServerStream) WriteConnectResponseData(respErr error, metadata ...Metadata) error {
 	var connectResponse *ConnectResponse
 	if respErr != nil {
 		connectResponse = &ConnectResponse{
@@ -103,14 +86,108 @@ func WriteConnectResponseData(stream io.Writer, respErr error, metadata ...Metad
 		return err
 	}
 
-	if err := writePreamble(stream); err != nil {
+	if err := writeDataStreamPreamble(rss); err != nil {
 		return err
 	}
-	return capnp.NewEncoder(stream).Encode(msg)
+	return capnp.NewEncoder(rss).Encode(msg)
 }
 
-func writePreamble(stream io.Writer) error {
-	if err := writeSignature(stream); err != nil {
+type RequestClientStream struct {
+	io.ReadWriteCloser
+}
+
+// WriteConnectRequestData writes requestMeta to a stream.
+func (rcs *RequestClientStream) WriteConnectRequestData(dest string, connectionType ConnectionType, metadata ...Metadata) error {
+	connectRequest := &ConnectRequest{
+		Dest:     dest,
+		Type:     connectionType,
+		Metadata: metadata,
+	}
+
+	msg, err := connectRequest.toPogs()
+	if err != nil {
+		return err
+	}
+
+	if err := writeDataStreamPreamble(rcs); err != nil {
+		return err
+	}
+	return capnp.NewEncoder(rcs).Encode(msg)
+}
+
+// ReadConnectResponseData reads the response to a RequestMeta in a stream.
+func (rcs *RequestClientStream) ReadConnectResponseData() (*ConnectResponse, error) {
+	signature, err := DetermineProtocol(rcs)
+	if err != nil {
+		return nil, err
+	}
+	if signature != DataStreamProtocolSignature {
+		return nil, fmt.Errorf("Wrong protocol signature %v", signature)
+	}
+
+	// This is a NO-OP for now. We could cause a branching if we wanted to use multiple versions.
+	if _, err := readVersion(rcs); err != nil {
+		return nil, err
+	}
+
+	msg, err := capnp.NewDecoder(rcs).Decode()
+	if err != nil {
+		return nil, err
+	}
+
+	r := &ConnectResponse{}
+	if err := r.fromPogs(msg); err != nil {
+		return nil, err
+	}
+	return r, nil
+}
+
+// RPCServerStream is a stream to serve RPCs. It is closed when the RPC client is done
+type RPCServerStream struct {
+	io.ReadWriteCloser
+}
+
+func NewRPCServerStream(stream io.ReadWriteCloser, protocol ProtocolSignature) (*RPCServerStream, error) {
+	if protocol != RPCStreamProtocolSignature {
+		return nil, fmt.Errorf("RPCStream can only be created from rpc stream")
+	}
+	return &RPCServerStream{stream}, nil
+}
+
+func (s *RPCServerStream) Serve(sessionManager tunnelpogs.SessionManager, logger *zerolog.Logger) error {
+	// RPC logs are very robust, create a new logger that only logs error to reduce noise
+	rpcLogger := logger.Level(zerolog.ErrorLevel)
+	rpcTransport := tunnelrpc.NewTransportLogger(&rpcLogger, rpc.StreamTransport(s))
+	defer rpcTransport.Close()
+
+	main := tunnelpogs.SessionManager_ServerToClient(sessionManager)
+	rpcConn := rpc.NewConn(
+		rpcTransport,
+		rpc.MainInterface(main.Client),
+		tunnelrpc.ConnLog(&rpcLogger),
+	)
+	defer rpcConn.Close()
+
+	return rpcConn.Wait()
+}
+
+func DetermineProtocol(stream io.Reader) (ProtocolSignature, error) {
+	signature, err := readSignature(stream)
+	if err != nil {
+		return ProtocolSignature{}, err
+	}
+	switch signature {
+	case DataStreamProtocolSignature:
+		return DataStreamProtocolSignature, nil
+	case RPCStreamProtocolSignature:
+		return RPCStreamProtocolSignature, nil
+	default:
+		return ProtocolSignature{}, fmt.Errorf("unknown signature %v", signature)
+	}
+}
+
+func writeDataStreamPreamble(stream io.Writer) error {
+	if err := writeSignature(stream, DataStreamProtocolSignature); err != nil {
 		return err
 	}
 
@@ -128,20 +205,57 @@ func readVersion(stream io.Reader) (string, error) {
 	return string(version), err
 }
 
-func writeSignature(stream io.Writer) error {
-	_, err := stream.Write(protocolSignature)
+func readSignature(stream io.Reader) (ProtocolSignature, error) {
+	var signature ProtocolSignature
+	if _, err := io.ReadFull(stream, signature[:]); err != nil {
+		return ProtocolSignature{}, err
+	}
+	return signature, nil
+}
+
+func writeSignature(stream io.Writer, signature ProtocolSignature) error {
+	_, err := stream.Write(signature[:])
 	return err
 }
 
-func verifySignature(stream io.Reader) error {
-	signature := make([]byte, len(protocolSignature))
-	if _, err := io.ReadFull(stream, signature); err != nil {
+// RPCClientStream is a stream to call methods of SessionManager
+type RPCClientStream struct {
+	client    tunnelpogs.SessionManager_PogsClient
+	transport rpc.Transport
+}
+
+func NewRPCClientStream(ctx context.Context, stream io.ReadWriteCloser, logger *zerolog.Logger) (*RPCClientStream, error) {
+	n, err := stream.Write(RPCStreamProtocolSignature[:])
+	if err != nil {
+		return nil, err
+	}
+	if n != len(RPCStreamProtocolSignature) {
+		return nil, fmt.Errorf("expect to write %d bytes for RPC stream protocol signature, wrote %d", len(RPCStreamProtocolSignature), n)
+	}
+	transport := tunnelrpc.NewTransportLogger(logger, rpc.StreamTransport(stream))
+	conn := rpc.NewConn(
+		transport,
+		tunnelrpc.ConnLog(logger),
+	)
+	return &RPCClientStream{
+		client:    tunnelpogs.SessionManager_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn},
+		transport: transport,
+	}, nil
+}
+
+func (rcs *RPCClientStream) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeIdleAfterHint time.Duration) error {
+	resp, err := rcs.client.RegisterUdpSession(ctx, sessionID, dstIP, dstPort, closeIdleAfterHint)
+	if err != nil {
 		return err
 	}
-
-	if !bytes.Equal(signature[0:], protocolSignature) {
-		return fmt.Errorf("Wrong signature: %v", signature)
-	}
-
-	return nil
+	return resp.Err
+}
+
+func (rcs *RPCClientStream) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID, message string) error {
+	return rcs.client.UnregisterUdpSession(ctx, sessionID, message)
+}
+
+func (rcs *RPCClientStream) Close() {
+	_ = rcs.client.Close()
+	_ = rcs.transport.Close()
 }

quic/quic_protocol_test.go

@@ -2,13 +2,24 @@ package quic
 
 import (
 	"bytes"
+	"context"
 	"errors"
+	"fmt"
+	"io"
+	"net"
 	"testing"
+	"time"
 
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+const (
+	testCloseIdleAfterHint = time.Minute * 2
+)
+
 func TestConnectRequestData(t *testing.T) {
 	var tests = []struct {
 		name           string
@@ -21,7 +32,7 @@ func TestConnectRequestData(t *testing.T) {
 			hostname:       "tunnel.com",
 			connectionType: ConnectionTypeHTTP,
 			metadata: []Metadata{
-				Metadata{
+				{
 					Key: "key",
 					Val: "1234",
 				},
@@ -31,9 +42,15 @@ func TestConnectRequestData(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			b := &bytes.Buffer{}
-			err := WriteConnectRequestData(b, test.hostname, test.connectionType, test.metadata...)
+			reqClientStream := RequestClientStream{noopCloser{b}}
+			err := reqClientStream.WriteConnectRequestData(test.hostname, test.connectionType, test.metadata...)
 			require.NoError(t, err)
-			reqMeta, err := ReadConnectRequestData(b)
+			protocol, err := DetermineProtocol(b)
+			require.NoError(t, err)
+			reqServerStream, err := NewRequestServerStream(noopCloser{b}, protocol)
+			require.NoError(t, err)
+
+			reqMeta, err := reqServerStream.ReadConnectRequestData()
 			require.NoError(t, err)
 
 			assert.Equal(t, test.metadata, reqMeta.Metadata)
@@ -52,7 +69,7 @@ func TestConnectResponseMeta(t *testing.T) {
 		{
 			name: "Signature verified and response metadata is unmarshaled and read correctly",
 			metadata: []Metadata{
-				Metadata{
+				{
 					Key: "key",
 					Val: "1234",
 				},
@@ -62,7 +79,7 @@ func TestConnectResponseMeta(t *testing.T) {
 			name: "If error is not empty, other fields should be blank",
 			err:  errors.New("something happened"),
 			metadata: []Metadata{
-				Metadata{
+				{
 					Key: "key",
 					Val: "1234",
 				},
@@ -73,9 +90,12 @@ func TestConnectResponseMeta(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			b := &bytes.Buffer{}
-			err := WriteConnectResponseData(b, test.err, test.metadata...)
+			reqServerStream := RequestServerStream{noopCloser{b}}
+			err := reqServerStream.WriteConnectResponseData(test.err, test.metadata...)
 			require.NoError(t, err)
-			respMeta, err := ReadConnectResponseData(b)
+
+			reqClientStream := RequestClientStream{noopCloser{b}}
+			respMeta, err := reqClientStream.ReadConnectResponseData()
 			require.NoError(t, err)
 
 			if respMeta.Error == "" {
@@ -86,3 +106,102 @@ func TestConnectResponseMeta(t *testing.T) {
 		})
 	}
 }
+
+func TestRegisterUdpSession(t *testing.T) {
+	clientReader, serverWriter := io.Pipe()
+	serverReader, clientWriter := io.Pipe()
+
+	clientStream := mockRPCStream{clientReader, clientWriter}
+	serverStream := mockRPCStream{serverReader, serverWriter}
+
+	unregisterMessage := "closed by eyeball"
+	rpcServer := mockRPCServer{
+		sessionID:         uuid.New(),
+		dstIP:             net.IP{172, 16, 0, 1},
+		dstPort:           8000,
+		closeIdleAfter:    testCloseIdleAfterHint,
+		unregisterMessage: unregisterMessage,
+	}
+	logger := zerolog.Nop()
+	sessionRegisteredChan := make(chan struct{})
+	go func() {
+		protocol, err := DetermineProtocol(serverStream)
+		assert.NoError(t, err)
+		rpcServerStream, err := NewRPCServerStream(serverStream, protocol)
+		assert.NoError(t, err)
+		err = rpcServerStream.Serve(rpcServer, &logger)
+		assert.NoError(t, err)
+
+		serverStream.Close()
+		close(sessionRegisteredChan)
+	}()
+
+	rpcClientStream, err := NewRPCClientStream(context.Background(), clientStream, &logger)
+	assert.NoError(t, err)
+
+	assert.NoError(t, rpcClientStream.RegisterUdpSession(context.Background(), rpcServer.sessionID, rpcServer.dstIP, rpcServer.dstPort, testCloseIdleAfterHint))
+
+	// Different sessionID, the RPC server should reject the registraion
+	assert.Error(t, rpcClientStream.RegisterUdpSession(context.Background(), uuid.New(), rpcServer.dstIP, rpcServer.dstPort, testCloseIdleAfterHint))
+
+	assert.NoError(t, rpcClientStream.UnregisterUdpSession(context.Background(), rpcServer.sessionID, unregisterMessage))
+
+	// Different sessionID, the RPC server should reject the unregistraion
+	assert.Error(t, rpcClientStream.UnregisterUdpSession(context.Background(), uuid.New(), unregisterMessage))
+
+	rpcClientStream.Close()
+	<-sessionRegisteredChan
+}
+
+type mockRPCServer struct {
+	sessionID         uuid.UUID
+	dstIP             net.IP
+	dstPort           uint16
+	closeIdleAfter    time.Duration
+	unregisterMessage string
+}
+
+func (s mockRPCServer) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeIdleAfter time.Duration) error {
+	if s.sessionID != sessionID {
+		return fmt.Errorf("expect session ID %s, got %s", s.sessionID, sessionID)
+	}
+	if !s.dstIP.Equal(dstIP) {
+		return fmt.Errorf("expect destination IP %s, got %s", s.dstIP, dstIP)
+	}
+	if s.dstPort != dstPort {
+		return fmt.Errorf("expect destination port %d, got %d", s.dstPort, dstPort)
+	}
+	if s.closeIdleAfter != closeIdleAfter {
+		return fmt.Errorf("expect closeIdleAfter %d, got %d", s.closeIdleAfter, closeIdleAfter)
+	}
+	return nil
+}
+
+func (s mockRPCServer) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID, message string) error {
+	if s.sessionID != sessionID {
+		return fmt.Errorf("expect session ID %s, got %s", s.sessionID, sessionID)
+	}
+	if s.unregisterMessage != message {
+		return fmt.Errorf("expect unregister message %s, got %s", s.unregisterMessage, message)
+	}
+	return nil
+}
+
+type mockRPCStream struct {
+	io.ReadCloser
+	io.WriteCloser
+}
+
+func (s mockRPCStream) Close() error {
+	_ = s.ReadCloser.Close()
+	_ = s.WriteCloser.Close()
+	return nil
+}
+
+type noopCloser struct {
+	io.ReadWriter
+}
+
+func (noopCloser) Close() error {
+	return nil
+}

quic/tracing.go

@@ -0,0 +1,126 @@
+package quic
+
+import (
+	"context"
+	"net"
+
+	"github.com/lucas-clemente/quic-go/logging"
+	"github.com/lucas-clemente/quic-go/qlog"
+	"github.com/rs/zerolog"
+)
+
+// QUICTracer is a wrapper to create new quicConnTracer
+type tracer struct {
+	logger *zerolog.Logger
+	config *tracerConfig
+}
+
+type tracerConfig struct {
+	isClient bool
+	// Only client has an index
+	index uint8
+}
+
+func NewClientTracer(logger *zerolog.Logger, index uint8) logging.Tracer {
+	return &tracer{
+		logger: logger,
+		config: &tracerConfig{
+			isClient: true,
+			index:    index,
+		},
+	}
+}
+
+func NewServerTracer(logger *zerolog.Logger) logging.Tracer {
+	return &tracer{
+		logger: logger,
+		config: &tracerConfig{
+			isClient: false,
+		},
+	}
+}
+
+func (t *tracer) TracerForConnection(_ context.Context, p logging.Perspective, odcid logging.ConnectionID) logging.ConnectionTracer {
+	connID := logging.ConnectionID(odcid).String()
+	ql := &quicLogger{
+		logger:       t.logger,
+		connectionID: connID,
+	}
+	if t.config.isClient {
+		return newConnTracer(ql, p, odcid, newClientCollector(t.config.index))
+	}
+	return newConnTracer(ql, p, odcid, newServiceCollector())
+}
+
+func (*tracer) SentPacket(net.Addr, *logging.Header, logging.ByteCount, []logging.Frame) {}
+func (*tracer) DroppedPacket(net.Addr, logging.PacketType, logging.ByteCount, logging.PacketDropReason) {
+}
+
+// connTracer is a wrapper around https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/qlog#NewConnectionTracer to collect metrics
+type connTracer struct {
+	logging.ConnectionTracer
+	metricsCollector MetricsCollector
+	connectionID     string
+}
+
+func newConnTracer(ql *quicLogger, p logging.Perspective, odcid logging.ConnectionID, metricsCollector MetricsCollector) logging.ConnectionTracer {
+	return &connTracer{
+		qlog.NewConnectionTracer(ql, p, odcid),
+		metricsCollector,
+		logging.ConnectionID(odcid).String(),
+	}
+}
+
+func (ct *connTracer) StartedConnection(local, remote net.Addr, srcConnID, destConnID logging.ConnectionID) {
+	ct.metricsCollector.startedConnection()
+	ct.ConnectionTracer.StartedConnection(local, remote, srcConnID, destConnID)
+}
+
+func (ct *connTracer) ClosedConnection(err error) {
+	ct.metricsCollector.closedConnection(err)
+	ct.ConnectionTracer.ClosedConnection(err)
+}
+
+func (ct *connTracer) SentPacket(hdr *logging.ExtendedHeader, packetSize logging.ByteCount, ack *logging.AckFrame, frames []logging.Frame) {
+	ct.metricsCollector.sentPackets(packetSize)
+	ct.ConnectionTracer.SentPacket(hdr, packetSize, ack, frames)
+}
+
+func (ct *connTracer) ReceivedPacket(hdr *logging.ExtendedHeader, size logging.ByteCount, frames []logging.Frame) {
+	ct.metricsCollector.receivedPackets(size)
+	ct.ConnectionTracer.ReceivedPacket(hdr, size, frames)
+}
+
+func (ct *connTracer) BufferedPacket(pt logging.PacketType) {
+	ct.metricsCollector.bufferedPackets(pt)
+	ct.ConnectionTracer.BufferedPacket(pt)
+}
+
+func (ct *connTracer) DroppedPacket(pt logging.PacketType, size logging.ByteCount, reason logging.PacketDropReason) {
+	ct.metricsCollector.droppedPackets(pt, size, reason)
+	ct.ConnectionTracer.DroppedPacket(pt, size, reason)
+}
+
+func (ct *connTracer) LostPacket(level logging.EncryptionLevel, number logging.PacketNumber, reason logging.PacketLossReason) {
+	ct.metricsCollector.lostPackets(reason)
+	ct.ConnectionTracer.LostPacket(level, number, reason)
+}
+
+func (ct *connTracer) UpdatedMetrics(rttStats *logging.RTTStats, cwnd, bytesInFlight logging.ByteCount, packetsInFlight int) {
+	ct.metricsCollector.updatedRTT(rttStats)
+	ct.ConnectionTracer.UpdatedMetrics(rttStats, cwnd, bytesInFlight, packetsInFlight)
+}
+
+type quicLogger struct {
+	logger       *zerolog.Logger
+	connectionID string
+}
+
+func (qt *quicLogger) Write(p []byte) (n int, err error) {
+	qt.logger.Trace().Str("quicConnection", qt.connectionID).RawJSON("event", p).Msg("Quic event")
+	return len(p), nil
+}
+
+func (*quicLogger) Close() error {
+	return nil
+}

socks/auth_handler.go

@@ -18,7 +18,7 @@ const (
 	authFailure     = uint8(1)
 )
 
-// AuthHandler handles socks authenication requests
+// AuthHandler handles socks authentication requests
 type AuthHandler interface {
 	Handle(io.Reader, io.Writer) error
 	Register(uint8, Authenticator)
@@ -43,7 +43,7 @@ func (h *StandardAuthHandler) Register(method uint8, a Authenticator) {
 	h.authenticators[method] = a
 }
 
-// Handle gets the methods from the SOCKS5 client and authenicates with the first supported method
+// Handle gets the methods from the SOCKS5 client and authenticates with the first supported method
 func (h *StandardAuthHandler) Handle(bufConn io.Reader, conn io.Writer) error {
 	methods, err := readMethods(bufConn)
 	if err != nil {

socks/request_handler.go

@@ -55,7 +55,7 @@ func (h *StandardRequestHandler) handleConnect(conn io.ReadWriter, req *Request)
 			addr, err := net.ResolveIPAddr("ip", req.DestAddr.FQDN)
 			if err != nil {
 				_ = sendReply(conn, ruleFailure, req.DestAddr)
-				return fmt.Errorf("unable to resolve host to confirm acceess")
+				return fmt.Errorf("unable to resolve host to confirm access")
 			}
 
 			req.DestAddr.IP = addr.IP

ssh_server_tests/tests.py

@@ -178,7 +178,7 @@ class TestSSHShell(TestSSHBase):
             self.assertIn(username, pwd)
 
             # Ensure shell launched with correct user's permissions and privs.
-            # Cant read root owned 0700 files.
+            # Can't read root owned 0700 files.
             output = self.get_command_output(
                 session, f"cat {self.ROOT_ONLY_TEST_FILE_PATH}"
             )

sshgen/sshgen_test.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package sshgen

teamnet/api.go

@@ -16,11 +16,13 @@ import (
 // network, and says that eyeballs can reach that route using the corresponding
 // tunnel.
 type Route struct {
-	Network   CIDR      `json:"network"`
-	TunnelID  uuid.UUID `json:"tunnel_id"`
-	Comment   string    `json:"comment"`
-	CreatedAt time.Time `json:"created_at"`
-	DeletedAt time.Time `json:"deleted_at"`
+	Network  CIDR      `json:"network"`
+	TunnelID uuid.UUID `json:"tunnel_id"`
+	// Optional field. When unset, it means the Route belongs to the default virtual network.
+	VNetID    *uuid.UUID `json:"virtual_network_id,omitempty"`
+	Comment   string     `json:"comment"`
+	CreatedAt time.Time  `json:"created_at"`
+	DeletedAt time.Time  `json:"deleted_at"`
 }
 
 // CIDR is just a newtype wrapper around net.IPNet. It adds JSON unmarshalling.
@@ -62,27 +64,33 @@ type NewRoute struct {
 	Network  net.IPNet
 	TunnelID uuid.UUID
 	Comment  string
+	// Optional field. If unset, backend will assume the default vnet for the account.
+	VNetID *uuid.UUID
 }
 
 // MarshalJSON handles fields with non-JSON types (e.g. net.IPNet).
 func (r NewRoute) MarshalJSON() ([]byte, error) {
 	return json.Marshal(&struct {
-		TunnelID uuid.UUID `json:"tunnel_id"`
-		Comment  string    `json:"comment"`
+		TunnelID uuid.UUID  `json:"tunnel_id"`
+		Comment  string     `json:"comment"`
+		VNetID   *uuid.UUID `json:"virtual_network_id,omitempty"`
 	}{
 		TunnelID: r.TunnelID,
 		Comment:  r.Comment,
+		VNetID:   r.VNetID,
 	})
 }
 
 // DetailedRoute is just a Route with some extra fields, e.g. TunnelName.
 type DetailedRoute struct {
-	Network    CIDR      `json:"network"`
-	TunnelID   uuid.UUID `json:"tunnel_id"`
-	Comment    string    `json:"comment"`
-	CreatedAt  time.Time `json:"created_at"`
-	DeletedAt  time.Time `json:"deleted_at"`
-	TunnelName string    `json:"tunnel_name"`
+	Network  CIDR      `json:"network"`
+	TunnelID uuid.UUID `json:"tunnel_id"`
+	// Optional field. When unset, it means the DetailedRoute belongs to the default virtual network.
+	VNetID     *uuid.UUID `json:"virtual_network_id,omitempty"`
+	Comment    string     `json:"comment"`
+	CreatedAt  time.Time  `json:"created_at"`
+	DeletedAt  time.Time  `json:"deleted_at"`
+	TunnelName string     `json:"tunnel_name"`
 }
 
 // IsZero checks if DetailedRoute is the zero value.
@@ -97,9 +105,15 @@ func (r DetailedRoute) TableString() string {
 	if !r.DeletedAt.IsZero() {
 		deletedColumn = r.DeletedAt.Format(time.RFC3339)
 	}
+	vnetColumn := "default"
+	if r.VNetID != nil {
+		vnetColumn = r.VNetID.String()
+	}
+
 	return fmt.Sprintf(
-		"%s\t%s\t%s\t%s\t%s\t%s\t",
+		"%s\t%s\t%s\t%s\t%s\t%s\t%s\t",
 		r.Network.String(),
+		vnetColumn,
 		r.Comment,
 		r.TunnelID,
 		r.TunnelName,
@@ -107,3 +121,15 @@ func (r DetailedRoute) TableString() string {
 		deletedColumn,
 	)
 }
+
+type DeleteRouteParams struct {
+	Network net.IPNet
+	// Optional field. If unset, backend will assume the default vnet for the account.
+	VNetID *uuid.UUID
+}
+
+type GetRouteByIpParams struct {
+	Ip net.IP
+	// Optional field. If unset, backend will assume the default vnet for the account.
+	VNetID *uuid.UUID
+}

teamnet/api_test.go

@@ -12,77 +12,154 @@ import (
 )
 
 func TestUnmarshalRoute(t *testing.T) {
-	// Response from the teamnet route backend
-	data := `{
-		"network":"10.1.2.40/29",
-		"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
-		"comment":"test",
-		"created_at":"2020-12-22T02:00:15.587008Z",
-		"deleted_at":null
-	}`
-	var r Route
-	err := json.Unmarshal([]byte(data), &r)
+	testCases := []struct {
+		Json    string
+		HasVnet bool
+	}{
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":null
+			}`,
+			false,
+		},
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":null,
+				"virtual_network_id":"38c95083-8191-4110-8339-3f438d44fdb9"
+			}`,
+			true,
+		},
+	}
 
-	// Check everything worked
-	require.NoError(t, err)
-	require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
-	require.Equal(t, "test", r.Comment)
-	_, cidr, err := net.ParseCIDR("10.1.2.40/29")
-	require.NoError(t, err)
-	require.Equal(t, CIDR(*cidr), r.Network)
-	require.Equal(t, "test", r.Comment)
+	for _, testCase := range testCases {
+		data := testCase.Json
+
+		var r Route
+		err := json.Unmarshal([]byte(data), &r)
+
+		// Check everything worked
+		require.NoError(t, err)
+		require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
+		require.Equal(t, "test", r.Comment)
+		_, cidr, err := net.ParseCIDR("10.1.2.40/29")
+		require.NoError(t, err)
+		require.Equal(t, CIDR(*cidr), r.Network)
+		require.Equal(t, "test", r.Comment)
+
+		if testCase.HasVnet {
+			require.Equal(t, uuid.MustParse("38c95083-8191-4110-8339-3f438d44fdb9"), *r.VNetID)
+		} else {
+			require.Nil(t, r.VNetID)
+		}
+	}
 }
 
 func TestDetailedRouteJsonRoundtrip(t *testing.T) {
-	// Response from the teamnet route backend
-	data := `{
-		"network":"10.1.2.40/29",
-		"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
-		"comment":"test",
-		"created_at":"2020-12-22T02:00:15.587008Z",
-		"deleted_at":"2021-01-14T05:01:42.183002Z",
-		"tunnel_name":"Mr. Tun"
-	}`
-	var r DetailedRoute
-	err := json.Unmarshal([]byte(data), &r)
+	testCases := []struct {
+		Json    string
+		HasVnet bool
+	}{
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":"2021-01-14T05:01:42.183002Z",
+				"tunnel_name":"Mr. Tun"
+			}`,
+			false,
+		},
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"virtual_network_id":"38c95083-8191-4110-8339-3f438d44fdb9",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":"2021-01-14T05:01:42.183002Z",
+				"tunnel_name":"Mr. Tun"
+			}`,
+			true,
+		},
+	}
 
-	// Check everything worked
-	require.NoError(t, err)
-	require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
-	require.Equal(t, "test", r.Comment)
-	_, cidr, err := net.ParseCIDR("10.1.2.40/29")
-	require.NoError(t, err)
-	require.Equal(t, CIDR(*cidr), r.Network)
-	require.Equal(t, "test", r.Comment)
-	require.Equal(t, "Mr. Tun", r.TunnelName)
+	for _, testCase := range testCases {
+		data := testCase.Json
 
-	bytes, err := json.Marshal(r)
-	require.NoError(t, err)
-	obtainedJson := string(bytes)
-	data = strings.Replace(data, "\t", "", -1)
-	data = strings.Replace(data, "\n", "", -1)
-	require.Equal(t, data, obtainedJson)
+		var r DetailedRoute
+		err := json.Unmarshal([]byte(data), &r)
+
+		// Check everything worked
+		require.NoError(t, err)
+		require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
+		require.Equal(t, "test", r.Comment)
+		_, cidr, err := net.ParseCIDR("10.1.2.40/29")
+		require.NoError(t, err)
+		require.Equal(t, CIDR(*cidr), r.Network)
+		require.Equal(t, "test", r.Comment)
+		require.Equal(t, "Mr. Tun", r.TunnelName)
+
+		if testCase.HasVnet {
+			require.Equal(t, uuid.MustParse("38c95083-8191-4110-8339-3f438d44fdb9"), *r.VNetID)
+		} else {
+			require.Nil(t, r.VNetID)
+		}
+
+		bytes, err := json.Marshal(r)
+		require.NoError(t, err)
+		obtainedJson := string(bytes)
+		data = strings.Replace(data, "\t", "", -1)
+		data = strings.Replace(data, "\n", "", -1)
+		require.Equal(t, data, obtainedJson)
+	}
 }
 
 func TestMarshalNewRoute(t *testing.T) {
 	_, network, err := net.ParseCIDR("1.2.3.4/32")
 	require.NoError(t, err)
 	require.NotNil(t, network)
-	newRoute := NewRoute{
-		Network:  *network,
-		TunnelID: uuid.New(),
-		Comment:  "hi",
+	vnetId := uuid.New()
+
+	newRoutes := []NewRoute{
+		{
+			Network:  *network,
+			TunnelID: uuid.New(),
+			Comment:  "hi",
+		},
+		{
+			Network:  *network,
+			TunnelID: uuid.New(),
+			Comment:  "hi",
+			VNetID:   &vnetId,
+		},
 	}
 
-	// Test where receiver is struct
-	serialized, err := json.Marshal(newRoute)
-	require.NoError(t, err)
-	require.True(t, strings.Contains(string(serialized), "tunnel_id"))
+	for _, newRoute := range newRoutes {
+		// Test where receiver is struct
+		serialized, err := json.Marshal(newRoute)
+		require.NoError(t, err)
+		require.True(t, strings.Contains(string(serialized), "tunnel_id"))
 
-	// Test where receiver is pointer to struct
-	serialized, err = json.Marshal(&newRoute)
-	require.NoError(t, err)
-	require.True(t, strings.Contains(string(serialized), "tunnel_id"))
+		// Test where receiver is pointer to struct
+		serialized, err = json.Marshal(&newRoute)
+		require.NoError(t, err)
+		require.True(t, strings.Contains(string(serialized), "tunnel_id"))
+
+		if newRoute.VNetID == nil {
+			require.False(t, strings.Contains(string(serialized), "virtual_network_id"))
+		} else {
+			require.True(t, strings.Contains(string(serialized), "virtual_network_id"))
+		}
+	}
 }
 
 func TestRouteTableString(t *testing.T) {

teamnet/filter.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"net/url"
+	"strconv"
 	"time"
 
 	"github.com/google/uuid"
@@ -34,6 +35,11 @@ var (
 		Name:  "filter-comment-is",
 		Usage: "Show only routes with this comment.",
 	}
+	filterVnet = cli.StringFlag{
+		Name:  "filter-virtual-network-id",
+		Usage: "Show only routes that are attached to the given virtual network ID.",
+	}
+
 	// Flags contains all filter flags.
 	FilterFlags = []cli.Flag{
 		&filterDeleted,
@@ -41,6 +47,7 @@ var (
 		&filterSubset,
 		&filterSuperset,
 		&filterComment,
+		&filterVnet,
 	}
 )
 
@@ -81,11 +88,23 @@ func NewFromCLI(c *cli.Context) (*Filter, error) {
 	if tunnelID := c.String(filterTunnelID.Name); tunnelID != "" {
 		u, err := uuid.Parse(tunnelID)
 		if err != nil {
-			return nil, errors.Wrap(err, "Couldn't parse UUID from --filter-tunnel-id")
+			return nil, errors.Wrapf(err, "Couldn't parse UUID from %s", filterTunnelID.Name)
 		}
 		f.tunnelID(u)
 	}
 
+	if vnetId := c.String(filterVnet.Name); vnetId != "" {
+		u, err := uuid.Parse(vnetId)
+		if err != nil {
+			return nil, errors.Wrapf(err, "Couldn't parse UUID from %s", filterVnet.Name)
+		}
+		f.vnetID(u)
+	}
+
+	if maxFetch := c.Int("max-fetch-size"); maxFetch > 0 {
+		f.MaxFetchSize(uint(maxFetch))
+	}
+
 	return f, nil
 }
 
@@ -133,6 +152,14 @@ func (f *Filter) tunnelID(id uuid.UUID) {
 	f.queryParams.Set("tunnel_id", id.String())
 }
 
+func (f *Filter) vnetID(id uuid.UUID) {
+	f.queryParams.Set("virtual_network_id", id.String())
+}
+
+func (f *Filter) MaxFetchSize(max uint) {
+	f.queryParams.Set("per_page", strconv.Itoa(int(max)))
+}
+
 func (f Filter) Encode() string {
 	return f.queryParams.Encode()
 }

token/launch_browser_darwin.go

@@ -1,4 +1,5 @@
-//+build darwin
+//go:build darwin
+// +build darwin
 
 package token
 

token/launch_browser_other.go

@@ -1,4 +1,5 @@
-//+build !windows,!darwin,!linux,!netbsd,!freebsd,!openbsd
+//go:build !windows && !darwin && !linux && !netbsd && !freebsd && !openbsd
+// +build !windows,!darwin,!linux,!netbsd,!freebsd,!openbsd
 
 package token
 

token/launch_browser_unix.go

@@ -1,4 +1,5 @@
-//+build linux freebsd openbsd netbsd
+//go:build linux || freebsd || openbsd || netbsd
+// +build linux freebsd openbsd netbsd
 
 package token