Release 2024.9.0

Whenever cloudflared receives a SIGTERM or SIGINT it goes into graceful shutdown mode, which unregisters the connection and closes the control stream. Unregistering makes it so we no longer receive any new requests and makes the edge close the connection, allowing in-flight requests to finish (within a 3 minute period).
 This was working fine for http2 connections, but the quic proxy was cancelling the context as soon as the controls stream ended, forcing the process to stop immediately.

 This commit changes the behavior so that we wait the full grace period before cancelling the request

.teamcity/mac/build.sh

@@ -7,13 +7,17 @@ if [[ "$(uname)" != "Darwin" ]] ; then
     exit 1
 fi
 
+if [[ "amd64" != "${TARGET_ARCH}" && "arm64" != "${TARGET_ARCH}" ]]
+then
+  echo "TARGET_ARCH must be amd64 or arm64"
+  exit 1
+fi
+
 go version
 export GO111MODULE=on
 
 # build 'cloudflared-darwin-amd64.tgz'
 mkdir -p artifacts
-FILENAME="$(pwd)/artifacts/cloudflared-darwin-amd64.tgz"
-PKGNAME="$(pwd)/artifacts/cloudflared-amd64.pkg"
 TARGET_DIRECTORY=".build"
 BINARY_NAME="cloudflared"
 VERSION=$(git describe --tags --always --dirty="-dev")
@@ -25,10 +29,11 @@ INSTALLER_CERT="installer.cer"
 BUNDLE_ID="com.cloudflare.cloudflared"
 SEC_DUP_MSG="security: SecKeychainItemImport: The specified item already exists in the keychain."
 export PATH="$PATH:/usr/local/bin"
+FILENAME="$(pwd)/artifacts/cloudflared-darwin-$TARGET_ARCH.tgz"
+PKGNAME="$(pwd)/artifacts/cloudflared-$TARGET_ARCH.pkg"
 mkdir -p ../src/github.com/cloudflare/    
 cp -r . ../src/github.com/cloudflare/cloudflared
 cd ../src/github.com/cloudflare/cloudflared 
-GOCACHE="$PWD/../../../../" GOPATH="$PWD/../../../../" CGO_ENABLED=1 make cloudflared
 
 # Add code signing private key to the key chain
 if [[ ! -z "$CFD_CODE_SIGN_KEY" ]]; then
@@ -138,22 +143,28 @@ else
   fi
 fi
 
+# cleanup the build directory because the previous execution might have failed without cleaning up.
+rm -rf "${TARGET_DIRECTORY}"
+export TARGET_OS="darwin"
+GOCACHE="$PWD/../../../../" GOPATH="$PWD/../../../../" CGO_ENABLED=1 make cloudflared
+
 # sign the cloudflared binary
 if [[ ! -z "$CODE_SIGN_NAME" ]]; then
   codesign -s "${CODE_SIGN_NAME}" -f -v --timestamp --options runtime ${BINARY_NAME}
-  
+
  # notarize the binary
  # TODO: TUN-5789
 fi
 
+ARCH_TARGET_DIRECTORY="${TARGET_DIRECTORY}/${TARGET_ARCH}-build"
 # creating build directory
-rm -rf $TARGET_DIRECTORY
-mkdir "${TARGET_DIRECTORY}"
-mkdir "${TARGET_DIRECTORY}/contents"
-cp -r ".mac_resources/scripts" "${TARGET_DIRECTORY}/scripts"
+rm -rf $ARCH_TARGET_DIRECTORY
+mkdir -p "${ARCH_TARGET_DIRECTORY}"
+mkdir -p "${ARCH_TARGET_DIRECTORY}/contents"
+cp -r ".mac_resources/scripts" "${ARCH_TARGET_DIRECTORY}/scripts"
 
 # copy cloudflared into the build directory
-cp ${BINARY_NAME} "${TARGET_DIRECTORY}/contents/${PRODUCT}"
+cp ${BINARY_NAME} "${ARCH_TARGET_DIRECTORY}/contents/${PRODUCT}"
 
 # compress cloudflared into a tar and gzipped file
 tar czf "$FILENAME" "${BINARY_NAME}"
@@ -162,8 +173,8 @@ tar czf "$FILENAME" "${BINARY_NAME}"
 if [[ ! -z "$PKG_SIGN_NAME" ]]; then
   pkgbuild --identifier com.cloudflare.${PRODUCT} \
       --version ${VERSION} \
-      --scripts ${TARGET_DIRECTORY}/scripts \
-      --root ${TARGET_DIRECTORY}/contents \
+      --scripts ${ARCH_TARGET_DIRECTORY}/scripts \
+      --root ${ARCH_TARGET_DIRECTORY}/contents \
       --install-location /usr/local/bin \
       --sign "${PKG_SIGN_NAME}" \
       ${PKGNAME}
@@ -173,12 +184,12 @@ if [[ ! -z "$PKG_SIGN_NAME" ]]; then
 else
     pkgbuild --identifier com.cloudflare.${PRODUCT} \
       --version ${VERSION} \
-      --scripts ${TARGET_DIRECTORY}/scripts \
-      --root ${TARGET_DIRECTORY}/contents \
+      --scripts ${ARCH_TARGET_DIRECTORY}/scripts \
+      --root ${ARCH_TARGET_DIRECTORY}/contents \
       --install-location /usr/local/bin \
       ${PKGNAME}
 fi
 
-
-# cleaning up the build directory
-rm -rf $TARGET_DIRECTORY
+# cleanup build directory because this script is not ran within containers,
+# which might lead to future issues in subsequent runs.
+rm -rf "${TARGET_DIRECTORY}"

.teamcity/package-windows.sh

@@ -3,15 +3,17 @@ echo $VERSION
 
 export TARGET_OS=windows
 # This controls the directory the built artifacts go into
-export ARTIFACT_DIR=built_artifacts/
-mkdir -p $ARTIFACT_DIR
+export BUILT_ARTIFACT_DIR=built_artifacts/
+export FINAL_ARTIFACT_DIR=artifacts/
+mkdir -p $BUILT_ARTIFACT_DIR
+mkdir -p $FINAL_ARTIFACT_DIR
 windowsArchs=("amd64" "386")
 for arch in ${windowsArchs[@]}; do
     export TARGET_ARCH=$arch
     # Copy exe into final directory
-    cp ./artifacts/cloudflared-windows-$arch.exe $ARTIFACT_DIR/cloudflared-windows-$arch.exe
-    cp ./artifacts/cloudflared-windows-$arch.exe ./cloudflared.exe
+    cp $BUILT_ARTIFACT_DIR/cloudflared-windows-$arch.exe ./cloudflared.exe
     make cloudflared-msi
     # Copy msi into final directory
-    mv cloudflared-$VERSION-$arch.msi $ARTIFACT_DIR/cloudflared-windows-$arch.msi
-done
+    mv cloudflared-$VERSION-$arch.msi $FINAL_ARTIFACT_DIR/cloudflared-windows-$arch.msi
+    cp $BUILT_ARTIFACT_DIR/cloudflared-windows-$arch.exe $FINAL_ARTIFACT_DIR/cloudflared-windows-$arch.exe 
+done

.teamcity/windows/component-test.ps1

@@ -5,41 +5,6 @@ $ProgressPreference = "SilentlyContinue"
 $WorkingDirectory = Get-Location
 $CloudflaredDirectory = "$WorkingDirectory\go\src\github.com\cloudflare\cloudflared"
 
-Write-Output "Installing python..."
-
-$PythonVersion = "3.10.11"
-$PythonZipFile = "$env:Temp\python-$PythonVersion-embed-amd64.zip"
-$PipInstallFile = "$env:Temp\get-pip.py"
-$PythonZipUrl = "https://www.python.org/ftp/python/$PythonVersion/python-$PythonVersion-embed-amd64.zip"
-$PythonPath = "$WorkingDirectory\Python"
-$PythonBinPath = "$PythonPath\python.exe"
-
-# Download Python zip file
-Invoke-WebRequest -Uri $PythonZipUrl -OutFile $PythonZipFile
-
-# Download Python pip file
-Invoke-WebRequest -Uri "https://bootstrap.pypa.io/get-pip.py" -OutFile $PipInstallFile
-
-# Extract Python files
-Expand-Archive $PythonZipFile -DestinationPath $PythonPath -Force
-
-# Add Python to PATH
-$env:Path = "$PythonPath\Scripts;$PythonPath;$($env:Path)"
-
-Write-Output "Installed to $PythonPath"
-
-# Install pip
-& $PythonBinPath $PipInstallFile
-
-# Add package paths in pythonXX._pth to unblock python -m pip
-$PythonImportPathFile = "$PythonPath\python310._pth"
-$ComponentTestsDir = "$CloudflaredDirectory\component-tests\"
-@($ComponentTestsDir, "Lib\site-packages", $(Get-Content $PythonImportPathFile)) | Set-Content $PythonImportPathFile
-
-# Test Python installation
-& $PythonBinPath --version
-& $PythonBinPath -m pip --version
-
 go env
 go version
 
@@ -48,8 +13,8 @@ $env:CGO_ENABLED = 1
 $env:TARGET_ARCH = "amd64"
 $env:Path = "$Env:Temp\go\bin;$($env:Path)"
 
-& $PythonBinPath --version
-& $PythonBinPath -m pip --version
+python --version
+python -m pip --version
 
 cd $CloudflaredDirectory
 
@@ -72,11 +37,11 @@ if ($LASTEXITCODE -ne 0) { throw "Failed unit tests" }
 
 Write-Output "Running component tests"
 
-& $PythonBinPath -m pip install --upgrade -r component-tests/requirements.txt
-& $PythonBinPath component-tests/setup.py --type create
-& $PythonBinPath -m pytest component-tests -o log_cli=true --log-cli-level=INFO
+python -m pip --disable-pip-version-check install --upgrade -r component-tests/requirements.txt
+python component-tests/setup.py --type create
+python -m pytest component-tests -o log_cli=true --log-cli-level=INFO
 if ($LASTEXITCODE -ne 0) {
-    & $PythonBinPath component-tests/setup.py --type cleanup
+    python component-tests/setup.py --type cleanup
     throw "Failed component tests"
 }
-& $PythonBinPath component-tests/setup.py --type cleanup
+python component-tests/setup.py --type cleanup

CHANGES.md

@@ -1,3 +1,7 @@
+## 2024.9.0
+### Bug Fixes
+- We fixed a bug related to `--grace-period`. Tunnels that use QUIC as transport weren't abiding by this waiting period before forcefully closing the connections to the edge. From now on, both QUIC and HTTP2 tunnels will wait for either the grace period to end (defaults to 30 seconds) or until the last in-flight request is handled. Users that wish to maintain the previous behavior should set `--grace-period` to 0 if `--protocol` is set to `quic`. This will force `cloudflared` to shutdown as soon as either SIGTERM or SIGINT is received.
+
 ## 2024.2.1
 ### Notices
 - Starting from this version, tunnel diagnostics will be enabled by default. This will allow the engineering team to remotely get diagnostics from cloudflared during debug activities. Users still have the capability to opt-out of this feature by defining `--management-diagnostics=false` (or env `TUNNEL_MANAGEMENT_DIAGNOSTICS`).

Makefile

@@ -218,38 +218,18 @@ cloudflared-pkg: cloudflared cloudflared.1
 cloudflared-msi:
 	wixl --define Version=$(VERSION) --define Path=$(EXECUTABLE_PATH) --output cloudflared-$(VERSION)-$(TARGET_ARCH).msi cloudflared.wxs
 
-.PHONY: cloudflared-darwin-amd64.tgz
-cloudflared-darwin-amd64.tgz: cloudflared
-	tar czf cloudflared-darwin-amd64.tgz cloudflared
-	rm cloudflared
+.PHONY: github-release-dryrun
+github-release-dryrun:
+	python3 github_release.py --path $(PWD)/built_artifacts --release-version $(VERSION) --dry-run
 
 .PHONY: github-release
-github-release: cloudflared
-	python3 github_release.py --path $(EXECUTABLE_PATH) --release-version $(VERSION)
-
-.PHONY: github-release-built-pkgs
-github-release-built-pkgs:
+github-release:
 	python3 github_release.py --path $(PWD)/built_artifacts --release-version $(VERSION)
-
-.PHONY: release-pkgs-linux
-release-pkgs-linux:
-	python3 ./release_pkgs.py
-
-.PHONY: github-message
-github-message:
 	python3 github_message.py --release-version $(VERSION)
 
-.PHONY: github-mac-upload
-github-mac-upload:
-	python3 github_release.py --path artifacts/cloudflared-darwin-amd64.tgz --release-version $(VERSION) --name cloudflared-darwin-amd64.tgz
-	python3 github_release.py --path artifacts/cloudflared-amd64.pkg --release-version $(VERSION) --name cloudflared-amd64.pkg
-
-.PHONY: github-windows-upload
-github-windows-upload:
-	python3 github_release.py --path built_artifacts/cloudflared-windows-amd64.exe --release-version $(VERSION) --name cloudflared-windows-amd64.exe
-	python3 github_release.py --path built_artifacts/cloudflared-windows-amd64.msi --release-version $(VERSION) --name cloudflared-windows-amd64.msi
-	python3 github_release.py --path built_artifacts/cloudflared-windows-386.exe --release-version $(VERSION) --name cloudflared-windows-386.exe
-	python3 github_release.py --path built_artifacts/cloudflared-windows-386.msi --release-version $(VERSION) --name cloudflared-windows-386.msi
+.PHONY: r2-linux-release
+r2-linux-release:
+	python3 ./release_pkgs.py
 
 .PHONY: capnp
 capnp:

RELEASE_NOTES

@@ -1,3 +1,36 @@
+2024.9.0
+- 2024-09-10 TUN-8621: Fix cloudflared version in change notes.
+- 2024-09-06 PPIP-2310: Update quick tunnel disclaimer
+- 2024-08-30 TUN-8621: Prevent QUIC connection from closing before grace period after unregistering
+- 2024-08-09 TUN-8592: Use metadata from the edge to determine if request body is empty for QUIC transport
+- 2024-06-26 TUN-8484: Print response when QuickTunnel can't be unmarshalled
+
+2024.8.3
+- 2024-08-15 TUN-8591 login command without extra text
+- 2024-03-25 remove code that will not be executed
+- 2024-03-25 remove code that will not be executed
+
+2024.8.2
+- 2024-08-05 TUN-8583: change final directory of artifacts
+- 2024-08-05 TUN-8585: Avoid creating GH client when dry-run is true
+
+2024.7.3
+- 2024-07-31 TUN-8546: Fix final artifacts paths
+
+2024.7.2
+- 2024-07-17 TUN-8546: rework MacOS build script
+
+2024.7.1
+- 2024-07-16 TUN-8543: use -p flag to create intermediate directories
+
+2024.7.0
+- 2024-07-05 TUN-8520: add macos arm64 build
+- 2024-07-05 TUN-8523: refactor makefile and cfsetup
+- 2024-07-02 TUN-8504: Use pre-installed python version instead of downloading it on Windows builds
+- 2024-06-26 TUN-8489: Add default noop logger for capnprpc
+- 2024-06-25 TUN-8487: Add user-agent for quick-tunnel requests
+- 2023-12-12 TUN-8057: cloudflared uses new PQ curve ID
+
 2024.6.1
 - 2024-06-12 TUN-8461: Don't log Failed to send session payload if the error is EOF
 - 2024-06-07 TUN-8456: Update quic-go to 0.45 and collect mtu and congestion control metrics

build-packages-fips.sh

@@ -3,7 +3,7 @@ VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
 
 # This controls the directory the built artifacts go into
-export ARTIFACT_DIR=built_artifacts/
+export ARTIFACT_DIR=artifacts/
 mkdir -p $ARTIFACT_DIR
 
 arch=("amd64")
@@ -23,4 +23,4 @@ make cloudflared-rpm
 mv cloudflared-fips-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-fips-linux-$RPMARCH.rpm
 
 # finally move the linux binary as well.
-mv ./cloudflared $ARTIFACT_DIR/cloudflared-fips-linux-$arch
+mv ./cloudflared $ARTIFACT_DIR/cloudflared-fips-linux-$arch

build-packages.sh

@@ -7,7 +7,7 @@ export GOEXPERIMENT=noboringcrypto
 export CGO_ENABLED=0
 
 # This controls the directory the built artifacts go into
-export ARTIFACT_DIR=built_artifacts/
+export ARTIFACT_DIR=artifacts/
 mkdir -p $ARTIFACT_DIR
 
 linuxArchs=("386" "amd64" "arm" "armhf" "arm64")

cfsetup.yaml

@@ -3,34 +3,27 @@ pinned_go: &pinned_go go-boring=1.22.2-1
 build_dir: &build_dir /cfsetup_build
 default-flavor: bullseye
 buster: &buster
-  build:
+  build-linux:
     build_dir: *build_dir
     builddeps: &build_deps
       - *pinned_go
       - build-essential
-      - gotest-to-teamcity
       - fakeroot
       - rubygem-fpm
       - rpm
       - libffi-dev
-      - reprepro
-      - createrepo
     pre-cache: &build_pre_cache
       - export GOCACHE=/cfsetup_build/.cache/go-build
       - go install golang.org/x/tools/cmd/goimports@latest
     post-cache:
-      # TODO: TUN-8126 this is temporary to make sure packages can be built before release
-      - ./build-packages.sh
       # Build binary for component test
       - GOOS=linux GOARCH=amd64 make cloudflared
-  build-fips:
+  build-linux-fips:
     build_dir: *build_dir
     builddeps: *build_deps
     pre-cache: *build_pre_cache
     post-cache:
       - export FIPS=true
-      # TODO: TUN-8126 this is temporary to make sure packages can be built before release
-      - ./build-packages-fips.sh
       # Build binary for component test
       - GOOS=linux GOARCH=amd64 make cloudflared
   cover:
@@ -39,28 +32,21 @@ buster: &buster
     pre-cache: *build_pre_cache
     post-cache:
      - make cover
-  # except FIPS (handled in github-fips-release-pkgs) and macos (handled in github-release-macos-amd64)
-  github-release-pkgs:
+  # except FIPS and macos 
+  build-linux-release:
     build_dir: *build_dir
-    builddeps:
+    builddeps: &build_deps_release
       - *pinned_go
       - build-essential
       - fakeroot
       - rubygem-fpm
       - rpm
-      - wget
-      # libmsi and libgcab are libraries the wixl binary depends on.
-      - libmsi-dev
-      - libgcab-dev
-      - python3-dev
       - libffi-dev
-      - python3-setuptools
+      - python3-dev
       - python3-pip
-      - reprepro
-      - createrepo
-    pre-cache: &github_release_pkgs_pre_cache
-      - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
-      - chmod a+x /usr/local/bin/wixl
+      - python3-setuptools
+      - wget
+    pre-cache: &build_release_pre_cache
       - pip3 install pynacl==1.4.0
       - pip3 install pygithub==1.55
       - pip3 install boto3==1.22.9
@@ -68,32 +54,14 @@ buster: &buster
     post-cache:
       # build all packages (except macos and FIPS) and move them to /cfsetup/built_artifacts
       - ./build-packages.sh
-      # release the packages built and moved to /cfsetup/built_artifacts
-      - make github-release-built-pkgs
-      # publish packages to linux repos
-      - make release-pkgs-linux
   # handle FIPS separately so that we built with gofips compiler
-  github-fips-release-pkgs:
+  build-linux-fips-release:
     build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - wget
-      # libmsi and libgcab are libraries the wixl binary depends on.
-      - libmsi-dev
-      - libgcab-dev
-      - python3-dev
-      - libffi-dev
-      - python3-setuptools
-      - python3-pip
-    pre-cache: *github_release_pkgs_pre_cache
+    builddeps: *build_deps_release
+    pre-cache: *build_release_pre_cache
     post-cache:
       # same logic as above, but for FIPS packages only
       - ./build-packages-fips.sh
-      - make github-release-built-pkgs
   generate-versions-file:
     build_dir: *build_dir
     builddeps:
@@ -152,21 +120,7 @@ buster: &buster
       - export GOOS=linux
       - export GOARCH=arm64
       - make cloudflared-deb
-  github-release-macos-amd64:
-    build_dir: *build_dir
-    builddeps: &build_pygithub
-      - *pinned_go
-      - build-essential
-      - python3-dev
-      - libffi-dev
-      - python3-setuptools
-      - python3-pip
-    pre-cache: &install_pygithub
-      - pip3 install pynacl==1.4.0
-      - pip3 install pygithub==1.55
-    post-cache:
-      - make github-mac-upload
-  github-release-windows:
+  package-windows:
     build_dir: *build_dir
     builddeps:
       - *pinned_go
@@ -186,10 +140,16 @@ buster: &buster
       - pip3 install pygithub==1.55
     post-cache:
       - .teamcity/package-windows.sh
-      - make github-windows-upload
   test:
     build_dir: *build_dir
-    builddeps: *build_deps
+    builddeps: &build_deps_tests
+      - *pinned_go
+      - build-essential
+      - fakeroot
+      - rubygem-fpm
+      - rpm
+      - libffi-dev
+      - gotest-to-teamcity
     pre-cache: *build_pre_cache
     post-cache:
       - export GOOS=linux
@@ -199,7 +159,7 @@ buster: &buster
       - make test | gotest-to-teamcity
   test-fips:
     build_dir: *build_dir
-    builddeps: *build_deps
+    builddeps: *build_deps_tests
     pre-cache: *build_pre_cache
     post-cache:
       - export GOOS=linux
@@ -210,7 +170,7 @@ buster: &buster
       - make test | gotest-to-teamcity
   component-test:
     build_dir: *build_dir
-    builddeps:
+    builddeps: &build_deps_component_test
       - *pinned_go
       - python3.7
       - python3-pip
@@ -230,24 +190,61 @@ buster: &buster
       - python3 component-tests/setup.py --type cleanup
   component-test-fips:
     build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - python3.7
-      - python3-pip
-      - python3-setuptools
-      # procps installs the ps command which is needed in test_sysv_service because the init script
-      # uses ps pid to determine if the agent is running
-      - procps
+    builddeps: *build_deps_component_test
     pre-cache-copy-paths:
       - component-tests/requirements.txt
     pre-cache: *component_test_pre_cache
     post-cache: *component_test_post_cache
-  github-message-release:
+  github-release-dryrun:
     build_dir: *build_dir
-    builddeps: *build_pygithub
-    pre-cache: *install_pygithub
+    builddeps:
+      - *pinned_go
+      - build-essential
+      - python3-dev
+      - libffi-dev
+      - python3-setuptools
+      - python3-pip
+    pre-cache:
+      - pip3 install pynacl==1.4.0
+      - pip3 install pygithub==1.55
     post-cache:
-      - make github-message
+      - make github-release-dryrun
+  github-release:
+    build_dir: *build_dir
+    builddeps:
+      - *pinned_go
+      - build-essential
+      - python3-dev
+      - libffi-dev
+      - python3-setuptools
+      - python3-pip
+    pre-cache:
+      - pip3 install pynacl==1.4.0
+      - pip3 install pygithub==1.55
+    post-cache:
+      - make github-release
+  r2-linux-release:
+    build_dir: *build_dir
+    builddeps:
+      - *pinned_go
+      - build-essential
+      - fakeroot
+      - rubygem-fpm
+      - rpm
+      - wget
+      - python3-dev
+      - libffi-dev
+      - python3-setuptools
+      - python3-pip
+      - reprepro
+      - createrepo
+    pre-cache:
+      - pip3 install pynacl==1.4.0
+      - pip3 install pygithub==1.55
+      - pip3 install boto3==1.22.9
+      - pip3 install python-gnupg==0.4.9
+    post-cache:
+      - make r2-linux-release
 
 bullseye: *buster
 bookworm: *buster

cmd/cloudflared/access/cmd.go

@@ -26,6 +26,7 @@ import (
 )
 
 const (
+	appURLFlag         = "app"
 	loginQuietFlag     = "quiet"
 	sshHostnameFlag    = "hostname"
 	sshDestinationFlag = "destination"
@@ -83,9 +84,10 @@ func Commands() []*cli.Command {
 			applications from the command line.`,
 			Subcommands: []*cli.Command{
 				{
-					Name:   "login",
-					Action: cliutil.Action(login),
-					Usage:  "login <url of access application>",
+					Name:      "login",
+					Action:    cliutil.Action(login),
+					Usage:     "login <url of access application>",
+					ArgsUsage: "url of Access application",
 					Description: `The login subcommand initiates an authentication flow with your identity provider.
 					The subcommand will launch a browser. For headless systems, a url is provided.
 					Once authenticated with your identity provider, the login command will generate a JSON Web Token (JWT)
@@ -97,6 +99,13 @@ func Commands() []*cli.Command {
 							Aliases: []string{"q"},
 							Usage:   "do not print the jwt to the command line",
 						},
+						&cli.BoolFlag{
+							Name:  "no-verbose",
+							Usage: "print only the jwt to stdout",
+						},
+						&cli.StringFlag{
+							Name: appURLFlag,
+						},
 					},
 				},
 				{
@@ -111,12 +120,12 @@ func Commands() []*cli.Command {
 				{
 					Name:        "token",
 					Action:      cliutil.Action(generateToken),
-					Usage:       "token -app=<url of access application>",
+					Usage:       "token <url of access application>",
 					ArgsUsage:   "url of Access application",
 					Description: `The token subcommand produces a JWT which can be used to authenticate requests.`,
 					Flags: []cli.Flag{
 						&cli.StringFlag{
-							Name: "app",
+							Name: appURLFlag,
 						},
 					},
 				},
@@ -232,9 +241,8 @@ func login(c *cli.Context) error {
 
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
 
-	args := c.Args()
-	appURL, err := parseURL(args.First())
-	if args.Len() < 1 || err != nil {
+	appURL, err := getAppURLFromArgs(c)
+	if err != nil {
 		log.Error().Msg("Please provide the url of the Access application")
 		return err
 	}
@@ -261,7 +269,14 @@ func login(c *cli.Context) error {
 	if c.Bool(loginQuietFlag) {
 		return nil
 	}
-	fmt.Fprintf(os.Stdout, "Successfully fetched your token:\n\n%s\n\n", cfdToken)
+
+	// Chatty by default for backward compat. The new --app flag
+	// is an implicit opt-out of the backwards-compatible chatty output.
+	if c.Bool("no-verbose") || c.IsSet(appURLFlag) {
+		fmt.Fprint(os.Stdout, cfdToken)
+	} else {
+		fmt.Fprintf(os.Stdout, "Successfully fetched your token:\n\n%s\n\n", cfdToken)
+	}
 
 	return nil
 }
@@ -340,6 +355,17 @@ func run(cmd string, args ...string) error {
 	return c.Run()
 }
 
+func getAppURLFromArgs(c *cli.Context) (*url.URL, error) {
+	var appURLStr string
+	args := c.Args()
+	if args.Len() < 1 {
+		appURLStr = c.String(appURLFlag)
+	} else {
+		appURLStr = args.First()
+	}
+	return parseURL(appURLStr)
+}
+
 // token dumps provided token to stdout
 func generateToken(c *cli.Context) error {
 	err := sentry.Init(sentry.ClientOptions{
@@ -349,8 +375,8 @@ func generateToken(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	appURL, err := parseURL(c.String("app"))
-	if err != nil || c.NumFlags() < 1 {
+	appURL, err := getAppURLFromArgs(c)
+	if err != nil {
 		fmt.Fprintln(os.Stderr, "Please provide a url.")
 		return err
 	}

cmd/cloudflared/tunnel/quick_tunnel.go

@@ -3,6 +3,7 @@ package tunnel
 import (
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -15,10 +16,7 @@ import (
 
 const httpTimeout = 15 * time.Second
 
-const disclaimer = "Thank you for trying Cloudflare Tunnel. Doing so, without a Cloudflare account, is a quick way to" +
-	" experiment and try it out. However, be aware that these account-less Tunnels have no uptime guarantee. If you " +
-	"intend to use Tunnels in production you should use a pre-created named tunnel by following: " +
-	"https://developers.cloudflare.com/cloudflare-one/connections/connect-apps"
+const disclaimer = "Thank you for trying Cloudflare Tunnel. Doing so, without a Cloudflare account, is a quick way to experiment and try it out. However, be aware that these account-less Tunnels have no uptime guarantee, are subject to the Cloudflare Online Services Terms of Use (https://www.cloudflare.com/website-terms/), and Cloudflare reserves the right to investigate your use of Tunnels for violations of such terms. If you intend to use Tunnels in production you should use a pre-created named tunnel by following: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps"
 
 // RunQuickTunnel requests a tunnel from the specified service.
 // We use this to power quick tunnels on trycloudflare.com, but the
@@ -35,14 +33,29 @@ func RunQuickTunnel(sc *subcommandContext) error {
 		Timeout: httpTimeout,
 	}
 
-	resp, err := client.Post(fmt.Sprintf("%s/tunnel", sc.c.String("quick-service")), "application/json", nil)
+	req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("%s/tunnel", sc.c.String("quick-service")), nil)
+	if err != nil {
+		return errors.Wrap(err, "failed to build quick tunnel request")
+	}
+	req.Header.Add("Content-Type", "application/json")
+	req.Header.Add("User-Agent", buildInfo.UserAgent())
+	resp, err := client.Do(req)
 	if err != nil {
 		return errors.Wrap(err, "failed to request quick Tunnel")
 	}
 	defer resp.Body.Close()
 
+	// This will read the entire response into memory so we can print it in case of error
+	rsp_body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return errors.Wrap(err, "failed to read quick-tunnel response")
+	}
+
 	var data QuickTunnelResponse
-	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+	if err := json.Unmarshal(rsp_body, &data); err != nil {
+		rsp_string := string(rsp_body)
+		fields := map[string]interface{}{"status_code": resp.Status}
+		sc.log.Err(err).Fields(fields).Msgf("Error unmarshaling QuickTunnel response: %s", rsp_string)
 		return errors.Wrap(err, "failed to unmarshal quick Tunnel")
 	}
 

component-tests/test_termination.py

@@ -45,9 +45,10 @@ class TestTermination:
             with connected:
                 connected.wait(self.timeout)
             # Send signal after the SSE connection is established
-            self.terminate_by_signal(cloudflared, signal)
-            self.wait_eyeball_thread(
-                in_flight_req, self.grace_period + self.timeout)
+            with self.within_grace_period():
+                self.terminate_by_signal(cloudflared, signal)
+                self.wait_eyeball_thread(
+                    in_flight_req, self.grace_period + self.timeout)
 
     # test cloudflared terminates before grace period expires when all eyeball
     # connections are drained
@@ -66,7 +67,7 @@ class TestTermination:
 
             with connected:
                 connected.wait(self.timeout)
-            with self.within_grace_period():
+            with self.within_grace_period(has_connection=False):
                 # Send signal after the SSE connection is established
                 self.terminate_by_signal(cloudflared, signal)
                 self.wait_eyeball_thread(in_flight_req, self.grace_period)
@@ -78,7 +79,7 @@ class TestTermination:
         with start_cloudflared(
                 tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True, capture_output=False) as cloudflared:
             wait_tunnel_ready(tunnel_url=config.get_url())
-            with self.within_grace_period():
+            with self.within_grace_period(has_connection=False):
                 self.terminate_by_signal(cloudflared, signal)
 
     def terminate_by_signal(self, cloudflared, sig):
@@ -92,13 +93,21 @@ class TestTermination:
 
     # Using this context asserts logic within the context is executed within grace period
     @contextmanager
-    def within_grace_period(self):
+    def within_grace_period(self, has_connection=True):
         try:
             start = time.time()
             yield
         finally:
+
+            # If the request takes longer than the grace period then we need to wait at most the grace period.
+            # If the request fell within the grace period cloudflared can close earlier, but to ensure that it doesn't
+            # close immediately we add a minimum boundary. If cloudflared shutdown in less than 1s it's likely that
+            # it shutdown as soon as it received SIGINT. The only way cloudflared can close immediately is if it has no
+            # in-flight requests
+            minimum = 1 if has_connection else 0
             duration = time.time() - start
-            assert duration < self.grace_period
+            # Here we truncate to ensure that we don't fail on minute differences like 10.1 instead of 10
+            assert minimum <= int(duration) <= self.grace_period
 
     def stream_request(self, config, connected, early_terminate):
         expected_terminate_message = "502 Bad Gateway"

connection/control.go

@@ -6,6 +6,8 @@ import (
 	"net"
 	"time"
 
+	"github.com/pkg/errors"
+
 	"github.com/cloudflare/cloudflared/management"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
@@ -116,27 +118,32 @@ func (c *controlStream) ServeControlStream(
 		}
 	}
 
-	c.waitForUnregister(ctx, registrationClient)
-	return nil
+	return c.waitForUnregister(ctx, registrationClient)
 }
 
-func (c *controlStream) waitForUnregister(ctx context.Context, registrationClient tunnelrpc.RegistrationClient) {
+func (c *controlStream) waitForUnregister(ctx context.Context, registrationClient tunnelrpc.RegistrationClient) error {
 	// wait for connection termination or start of graceful shutdown
 	defer registrationClient.Close()
+	var shutdownError error
 	select {
 	case <-ctx.Done():
+		shutdownError = ctx.Err()
 		break
 	case <-c.gracefulShutdownC:
 		c.stoppedGracefully = true
 	}
 
 	c.observer.sendUnregisteringEvent(c.connIndex)
-	registrationClient.GracefulShutdown(ctx, c.gracePeriod)
+	err := registrationClient.GracefulShutdown(ctx, c.gracePeriod)
+	if err != nil {
+		return errors.Wrap(err, "Error shutting down control stream")
+	}
 	c.observer.log.Info().
 		Int(management.EventTypeKey, int(management.Cloudflared)).
 		Uint8(LogFieldConnIndex, c.connIndex).
 		IPAddr(LogFieldIPAddress, c.edgeAddress).
 		Msg("Unregistered tunnel connection")
+	return shutdownError
 }
 
 func (c *controlStream) IsStopped() bool {

connection/http2_test.go

@@ -192,8 +192,9 @@ func (mc mockNamedTunnelRPCClient) RegisterConnection(
 	}, nil
 }
 
-func (mc mockNamedTunnelRPCClient) GracefulShutdown(ctx context.Context, gracePeriod time.Duration) {
+func (mc mockNamedTunnelRPCClient) GracefulShutdown(ctx context.Context, gracePeriod time.Duration) error {
 	close(mc.unregistered)
+	return nil
 }
 
 func (mockNamedTunnelRPCClient) Close() {}

connection/quic.go

@@ -42,12 +42,26 @@ const (
 	HTTPMethodKey = "HttpMethod"
 	// HTTPHostKey is used to get or set http Method in QUIC ALPN if the underlying proxy connection type is HTTP.
 	HTTPHostKey = "HttpHost"
+	// HTTPRequestBodyHintKey is used in ConnectRequest metadata to indicate if the request has body
+	HTTPRequestBodyHintKey = "HttpReqBodyHint"
 
 	QUICMetadataFlowID = "FlowID"
 	// emperically this capacity has been working well
 	demuxChanCapacity = 16
 )
 
+type RequestBodyHint uint64
+
+const (
+	RequestBodyHintMissing RequestBodyHint = iota
+	RequestBodyHintEmpty
+	RequestBodyHintHasData
+)
+
+func (rbh RequestBodyHint) String() string {
+	return [...]string{"missing", "empty", "data"}[rbh]
+}
+
 var (
 	portForConnIndex = make(map[uint8]int, 0)
 	portMapMutex     sync.Mutex
@@ -69,6 +83,7 @@ type QUICConnection struct {
 
 	rpcTimeout         time.Duration
 	streamWriteTimeout time.Duration
+	gracePeriod        time.Duration
 }
 
 // NewQUICConnection returns a new instance of QUICConnection.
@@ -86,6 +101,7 @@ func NewQUICConnection(
 	packetRouterConfig *ingress.GlobalRouterConfig,
 	rpcTimeout time.Duration,
 	streamWriteTimeout time.Duration,
+	gracePeriod time.Duration,
 ) (*QUICConnection, error) {
 	udpConn, err := createUDPConnForConnIndex(connIndex, localAddr, logger)
 	if err != nil {
@@ -122,6 +138,7 @@ func NewQUICConnection(
 		connIndex:            connIndex,
 		rpcTimeout:           rpcTimeout,
 		streamWriteTimeout:   streamWriteTimeout,
+		gracePeriod:          gracePeriod,
 	}, nil
 }
 
@@ -144,8 +161,17 @@ func (q *QUICConnection) Serve(ctx context.Context) error {
 	// In the future, if cloudflared can autonomously push traffic to the edge, we have to make sure the control
 	// stream is already fully registered before the other goroutines can proceed.
 	errGroup.Go(func() error {
-		defer cancel()
-		return q.serveControlStream(ctx, controlStream)
+		// err is equal to nil if we exit due to unregistration. If that happens we want to wait the full
+		// amount of the grace period, allowing requests to finish before we cancel the context, which will
+		// make cloudflared exit.
+		if err := q.serveControlStream(ctx, controlStream); err == nil {
+			select {
+			case <-ctx.Done():
+			case <-time.Tick(q.gracePeriod):
+			}
+		}
+		cancel()
+		return err
 	})
 	errGroup.Go(func() error {
 		defer cancel()
@@ -474,7 +500,6 @@ func buildHTTPRequest(
 	dest := connectRequest.Dest
 	method := metadata[HTTPMethodKey]
 	host := metadata[HTTPHostKey]
-	isWebsocket := connectRequest.Type == pogs.ConnectionTypeWebsocket
 
 	req, err := http.NewRequestWithContext(ctx, method, dest, body)
 	if err != nil {
@@ -499,13 +524,8 @@ func buildHTTPRequest(
 		return nil, fmt.Errorf("Error setting content-length: %w", err)
 	}
 
-	// Go's client defaults to chunked encoding after a 200ms delay if the following cases are true:
-	//   * the request body blocks
-	//   * the content length is not set (or set to -1)
-	//   * the method doesn't usually have a body (GET, HEAD, DELETE, ...)
-	//   * there is no transfer-encoding=chunked already set.
-	// So, if transfer cannot be chunked and content length is 0, we dont set a request body.
-	if !isWebsocket && !isTransferEncodingChunked(req) && req.ContentLength == 0 {
+	if shouldSetRequestBodyToEmpty(connectRequest, metadata, req) {
+		log.Debug().Str("host", req.Host).Str("method", req.Method).Msg("Set request to have no body")
 		req.Body = http.NoBody
 	}
 	stripWebsocketUpgradeHeader(req)
@@ -530,6 +550,35 @@ func isTransferEncodingChunked(req *http.Request) bool {
 	return strings.Contains(strings.ToLower(transferEncodingVal), "chunked")
 }
 
+// Borrowed from https://github.com/golang/go/blob/go1.22.6/src/net/http/request.go#L1541
+func requestMethodUsuallyLacksBody(req *http.Request) bool {
+	switch strings.ToUpper(req.Method) {
+	case "GET", "HEAD", "DELETE", "OPTIONS", "PROPFIND", "SEARCH":
+		return true
+	}
+	return false
+}
+
+func shouldSetRequestBodyToEmpty(connectRequest *pogs.ConnectRequest, metadata map[string]string, req *http.Request) bool {
+	switch metadata[HTTPRequestBodyHintKey] {
+	case RequestBodyHintEmpty.String():
+		return true
+	case RequestBodyHintHasData.String():
+		return false
+	default:
+	}
+
+	isWebsocket := connectRequest.Type == pogs.ConnectionTypeWebsocket
+	// Go's client defaults to chunked encoding after a 200ms delay if the following cases are true:
+	//   * the request body blocks
+	//   * the content length is not set (or set to -1)
+	//   * the method doesn't usually have a body (GET, HEAD, DELETE, ...)
+	//   * there is no transfer-encoding=chunked already set.
+	// So, if transfer cannot be chunked and content length is 0, we dont set a request body.
+	// Reference: https://github.com/golang/go/blob/go1.22.2/src/net/http/transfer.go#L192-L206
+	return !isWebsocket && requestMethodUsuallyLacksBody(req) && !isTransferEncodingChunked(req) && req.ContentLength == 0
+}
+
 // A helper struct that guarantees a call to close only affects read side, but not write side.
 type nopCloserReadWriter struct {
 	io.ReadWriteCloser

connection/quic_test.go

@@ -484,6 +484,125 @@ func TestBuildHTTPRequest(t *testing.T) {
 			},
 			body: io.NopCloser(&bytes.Buffer{}),
 		},
+		{
+			name: "if edge sends the body is empty hint, set body to empty",
+			connectRequest: &pogs.ConnectRequest{
+				Dest: "http://test.com",
+				Metadata: []pogs.Metadata{
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "put",
+					},
+					{
+						Key: HTTPRequestBodyHintKey,
+						Val: RequestBodyHintEmpty.String(),
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "put",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header": []string{"Misc"},
+				},
+				ContentLength: 0,
+				Host:          "cf.host",
+				Body:          http.NoBody,
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
+		{
+			name: "if edge sends the body has data hint, don't set body to empty",
+			connectRequest: &pogs.ConnectRequest{
+				Dest: "http://test.com",
+				Metadata: []pogs.Metadata{
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "put",
+					},
+					{
+						Key: HTTPRequestBodyHintKey,
+						Val: RequestBodyHintHasData.String(),
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "put",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header": []string{"Misc"},
+				},
+				ContentLength: 0,
+				Host:          "cf.host",
+				Body:          io.NopCloser(&bytes.Buffer{}),
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
+		{
+			name: "if the http method usually has body, don't set body to empty",
+			connectRequest: &pogs.ConnectRequest{
+				Dest: "http://test.com",
+				Metadata: []pogs.Metadata{
+					{
+						Key: "HttpHeader:Another-Header",
+						Val: "Misc",
+					},
+					{
+						Key: "HttpHost",
+						Val: "cf.host",
+					},
+					{
+						Key: "HttpMethod",
+						Val: "post",
+					},
+				},
+			},
+			req: &http.Request{
+				Method: "post",
+				URL: &url.URL{
+					Scheme: "http",
+					Host:   "test.com",
+				},
+				Proto:      "HTTP/1.1",
+				ProtoMajor: 1,
+				ProtoMinor: 1,
+				Header: http.Header{
+					"Another-Header": []string{"Misc"},
+				},
+				ContentLength: 0,
+				Host:          "cf.host",
+				Body:          io.NopCloser(&bytes.Buffer{}),
+			},
+			body: io.NopCloser(&bytes.Buffer{}),
+		},
 	}
 
 	log := zerolog.Nop()
@@ -736,6 +855,7 @@ func testQUICConnection(udpListenerAddr net.Addr, t *testing.T, index uint8) *QU
 		nil,
 		15*time.Second,
 		0*time.Second,
+		0*time.Second,
 	)
 	require.NoError(t, err)
 	return qc

github_release.py

@@ -17,7 +17,7 @@ import re
 from github import Github, GithubException, UnknownObjectException
 
 FORMAT = "%(levelname)s - %(asctime)s: %(message)s"
-logging.basicConfig(format=FORMAT)
+logging.basicConfig(format=FORMAT, level=logging.INFO)
 
 CLOUDFLARED_REPO = os.environ.get("GITHUB_REPO", "cloudflare/cloudflared")
 GITHUB_CONFLICT_CODE = "already_exists"
@@ -214,24 +214,33 @@ def main():
     """ Attempts to upload Asset to Github Release. Creates Release if it doesn't exist """
     try:
         args = parse_args()
-        client = Github(args.api_key)
-        repo = client.get_repo(CLOUDFLARED_REPO)
-        release = get_or_create_release(repo, args.release_version, args.dry_run)
 
         if args.dry_run:
-            logging.info("Skipping asset upload because of dry-run")
+            if os.path.isdir(args.path):
+                onlyfiles = [f for f in listdir(args.path) if isfile(join(args.path, f))]
+                for filename in onlyfiles:
+                    binary_path = os.path.join(args.path, filename)
+                    logging.info("binary: " + binary_path)
+            elif os.path.isfile(args.path):
+                logging.info("binary: " + binary_path)
+            else:
+                logging.error("dryrun failed")
             return
-
-        if os.path.isdir(args.path):
-            onlyfiles = [f for f in listdir(args.path) if isfile(join(args.path, f))]
-            for filename in onlyfiles:
-                binary_path = os.path.join(args.path, filename)
-                upload_asset(release, binary_path, filename, args.release_version, args.kv_account_id, args.namespace_id,
-                args.kv_api_token)
-                move_asset(binary_path, filename)
         else:
-            upload_asset(release, args.path, args.name, args.release_version, args.kv_account_id, args.namespace_id,
-                args.kv_api_token)
+            client = Github(args.api_key)
+            repo = client.get_repo(CLOUDFLARED_REPO)
+            release = get_or_create_release(repo, args.release_version, args.dry_run)
+
+            if os.path.isdir(args.path):
+                onlyfiles = [f for f in listdir(args.path) if isfile(join(args.path, f))]
+                for filename in onlyfiles:
+                    binary_path = os.path.join(args.path, filename)
+                    upload_asset(release, binary_path, filename, args.release_version, args.kv_account_id, args.namespace_id,
+                    args.kv_api_token)
+                    move_asset(binary_path, filename)
+            else:
+                upload_asset(release, args.path, args.name, args.release_version, args.kv_account_id, args.namespace_id,
+                    args.kv_api_token)
 
     except Exception as e:
         logging.exception(e)

management/middleware_test.go

@@ -52,13 +52,11 @@ func testRequest(t *testing.T, ts *httptest.Server, method, path string, body io
 	req, err := http.NewRequest(method, ts.URL+path, body)
 	if err != nil {
 		t.Fatal(err)
-		return nil, nil
 	}
 
 	resp, err := ts.Client().Do(req)
 	if err != nil {
 		t.Fatal(err)
-		return nil, nil
 	}
 	var claims managementErrorResponse
 	err = json.NewDecoder(resp.Body).Decode(&claims)

supervisor/pqtunnels.go

@@ -12,7 +12,7 @@ import (
 // to https://pqtunnels.cloudflareresearch.com.
 
 const (
-	PQKex     = tls.CurveID(0xfe31) // X25519Kyber768Draft00
+	PQKex     = tls.CurveID(0x6399) // X25519Kyber768Draft00
 	PQKexName = "X25519Kyber768Draft00"
 )
 

supervisor/tunnel.go

@@ -604,6 +604,7 @@ func (e *EdgeTunnelServer) serveQUIC(
 		e.config.PacketConfig,
 		e.config.RPCTimeout,
 		e.config.WriteStreamTimeout,
+		e.config.GracePeriod,
 	)
 	if err != nil {
 		connLogger.ConnAwareLogger().Err(err).Msgf("Failed to create new quic connection")

tunnelrpc/quic/cloudflared_client.go

@@ -32,7 +32,7 @@ func NewCloudflaredClient(ctx context.Context, stream io.ReadWriteCloser, reques
 		return nil, fmt.Errorf("expect to write %d bytes for RPC stream protocol signature, wrote %d", len(rpcStreamProtocolSignature), n)
 	}
 	transport := tunnelrpc.SafeTransport(stream)
-	conn := rpc.NewConn(transport)
+	conn := tunnelrpc.NewClientConn(transport)
 	client := pogs.NewCloudflaredServer_PogsClient(conn.Bootstrap(ctx), conn)
 	return &CloudflaredClient{
 		client:         client,

tunnelrpc/quic/cloudflared_server.go

@@ -6,8 +6,6 @@ import (
 	"io"
 	"time"
 
-	"zombiezen.com/go/capnproto2/rpc"
-
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
@@ -58,7 +56,7 @@ func (s *CloudflaredServer) handleRPC(ctx context.Context, stream io.ReadWriteCl
 	defer transport.Close()
 
 	main := pogs.CloudflaredServer_ServerToClient(s.sessionManager, s.configManager)
-	rpcConn := rpc.NewConn(transport, rpc.MainInterface(main.Client))
+	rpcConn := tunnelrpc.NewServerConn(transport, main.Client)
 	defer rpcConn.Close()
 
 	// We ignore the errors here because if cloudflared fails to handle a request, we will just move on.

tunnelrpc/quic/session_client.go

@@ -31,7 +31,7 @@ func NewSessionClient(ctx context.Context, stream io.ReadWriteCloser, requestTim
 		return nil, fmt.Errorf("expect to write %d bytes for RPC stream protocol signature, wrote %d", len(rpcStreamProtocolSignature), n)
 	}
 	transport := tunnelrpc.SafeTransport(stream)
-	conn := rpc.NewConn(transport)
+	conn := tunnelrpc.NewClientConn(transport)
 	return &SessionClient{
 		client:         pogs.NewSessionManager_PogsClient(conn.Bootstrap(ctx), conn),
 		transport:      transport,

tunnelrpc/quic/session_server.go

@@ -6,8 +6,6 @@ import (
 	"io"
 	"time"
 
-	"zombiezen.com/go/capnproto2/rpc"
-
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
@@ -48,7 +46,7 @@ func (s *SessionManagerServer) Serve(ctx context.Context, stream io.ReadWriteClo
 	defer transport.Close()
 
 	main := pogs.SessionManager_ServerToClient(s.sessionManager)
-	rpcConn := rpc.NewConn(transport, rpc.MainInterface(main.Client))
+	rpcConn := tunnelrpc.NewServerConn(transport, main.Client)
 	defer rpcConn.Close()
 
 	select {

tunnelrpc/registration_client.go

@@ -23,7 +23,7 @@ type RegistrationClient interface {
 		edgeAddress net.IP,
 	) (*pogs.ConnectionDetails, error)
 	SendLocalConfiguration(ctx context.Context, config []byte) error
-	GracefulShutdown(ctx context.Context, gracePeriod time.Duration)
+	GracefulShutdown(ctx context.Context, gracePeriod time.Duration) error
 	Close()
 }
 
@@ -35,7 +35,7 @@ type registrationClient struct {
 
 func NewRegistrationClient(ctx context.Context, stream io.ReadWriteCloser, requestTimeout time.Duration) RegistrationClient {
 	transport := SafeTransport(stream)
-	conn := rpc.NewConn(transport)
+	conn := NewClientConn(transport)
 	client := pogs.NewRegistrationServer_PogsClient(conn.Bootstrap(ctx), conn)
 	return &registrationClient{
 		client:         client,
@@ -79,7 +79,7 @@ func (r *registrationClient) SendLocalConfiguration(ctx context.Context, config
 	return err
 }
 
-func (r *registrationClient) GracefulShutdown(ctx context.Context, gracePeriod time.Duration) {
+func (r *registrationClient) GracefulShutdown(ctx context.Context, gracePeriod time.Duration) error {
 	ctx, cancel := context.WithTimeout(ctx, gracePeriod)
 	defer cancel()
 	defer metrics.CapnpMetrics.ClientOperations.WithLabelValues(metrics.Registration, metrics.OperationUnregisterConnection).Inc()
@@ -88,7 +88,9 @@ func (r *registrationClient) GracefulShutdown(ctx context.Context, gracePeriod t
 	err := r.client.UnregisterConnection(ctx)
 	if err != nil {
 		metrics.CapnpMetrics.ClientFailures.WithLabelValues(metrics.Registration, metrics.OperationUnregisterConnection).Inc()
+		return err
 	}
+	return nil
 }
 
 func (r *registrationClient) Close() {

tunnelrpc/registration_server.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"io"
 
-	"zombiezen.com/go/capnproto2/rpc"
-
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 
@@ -28,8 +26,7 @@ func (s *RegistrationServer) Serve(ctx context.Context, stream io.ReadWriteClose
 	defer transport.Close()
 
 	main := pogs.RegistrationServer_ServerToClient(s.registrationServer)
-	rpcConn := rpc.NewConn(transport, rpc.MainInterface(main.Client))
-	defer rpcConn.Close()
+	rpcConn := NewServerConn(transport, main.Client)
 
 	select {
 	case <-rpcConn.Done():

tunnelrpc/utils.go

@@ -1,10 +1,12 @@
 package tunnelrpc
 
 import (
+	"context"
 	"io"
 	"time"
 
 	"github.com/pkg/errors"
+	capnp "zombiezen.com/go/capnproto2"
 	"zombiezen.com/go/capnproto2/rpc"
 )
 
@@ -67,3 +69,21 @@ func isTemporaryError(e error) bool {
 	t, ok := e.(temp)
 	return ok && t.Temporary()
 }
+
+// NoopCapnpLogger provides a logger to discard all capnp rpc internal logging messages as
+// they are by default provided to stdout if no logger interface is provided. These logging
+// messages in cloudflared have typically not provided a high amount of pratical value
+// as the messages are extremely verbose and don't provide a good insight into the message
+// contents or rpc method names.
+type noopCapnpLogger struct{}
+
+func (noopCapnpLogger) Infof(ctx context.Context, format string, args ...interface{})  {}
+func (noopCapnpLogger) Errorf(ctx context.Context, format string, args ...interface{}) {}
+
+func NewClientConn(transport rpc.Transport) *rpc.Conn {
+	return rpc.NewConn(transport, rpc.ConnLog(noopCapnpLogger{}))
+}
+
+func NewServerConn(transport rpc.Transport, client capnp.Client) *rpc.Conn {
+	return rpc.NewConn(transport, rpc.MainInterface(client), rpc.ConnLog(noopCapnpLogger{}))
+}