ci: add Semgrep OSS scanning workflow

The goals of this PR are twofold:

## **1. Introduce a new renderer to output to `stdout`**

Implement the table renderer that will be used to report the results to stdout. The renderer should output something similar to this:

```
─── CONNECTIVITY PRE-CHECKS ──────────────────────────────────────────────────
COMPONENT            TARGET                         STATUS   DETAILS
DNS Resolution       region1.v2.argotunnel.com      PASS     Resolved successfully
DNS Resolution       region2.v2.argotunnel.com      PASS     Resolved successfully
UDP Connectivity     Port 7844 (QUIC)               PASS     Handshake successful
TCP Connectivity     Port 7844 (HTTP/2)             PASS     TLS handshake successful
Cloudflare API       api.cloudflare.com:443         PASS     Reachable

SUMMARY: Environment is healthy. cloudflared will use 'quic' as primary protocol.
──────────────────────────────────────────────────────────────────────────────
```

## **2. Add a log-level renderer**

Add support for structured logging to print the table results as logs. Below is an example of how logs should look like:

```
{"level":"info","run_id":"52828729-dfwd-45b3-w12f-727cbdb4cbd4", "component":"DNS Resolution","target":"region1.v2.argotunnel.com","status":"pass","details":"Resolved successfully","time":"2024-01-15T10:30:00Z","message":"precheck"}
{"level":"info","run_id":"52828729-dfwd-45b3-w12f-727cbdb4cbd4", "component":"DNS Resolution","target":"region2.v2.argotunnel.com","status":"pass","details":"Resolved successfully","time":"2024-01-15T10:30:00Z","message":"precheck"}
{"level":"info","run_id":"52828729-dfwd-45b3-w12f-727cbdb4cbd4", "component":"QUIC Connectivity","target":"Port 7844 (QUIC)","status":"pass","details":"Handshake successful","time":"2024-01-15T10:30:01Z","message":"precheck"}
{"level":"info","run_id":"52828729-dfwd-45b3-w12f-727cbdb4cbd4", "component":"HTTP/2 Connectivity","target":"Port 7844 (HTTP/2)","status":"pass","details":"TLS handshake successful","time":"2024-01-15T10:30:01Z","message":"precheck"}
{"level":"info","run_id":"52828729-dfwd-45b3-w12f-727cbdb4cbd4", "component":"Management API","target":"api.cloudflare.com:443","status":"pass","details":"Reachable","time":"2024-01-15T10:30:01Z","message":"precheck"}
{"level":"info","run_id":"52828729-dfwd-45b3-w12f-727cbdb4cbd4", "hard_fail":false,"suggested_protocol":"quic","time":"2024-01-15T10:30:01Z","message":"precheck complete"}
```

.ci/image/Dockerfile

@@ -6,7 +6,7 @@ RUN apt-get update && \
   apt-get install --no-install-recommends --allow-downgrades -y \
   build-essential \
   git \
-  go-boring=1.24.13-1 \
+  go-boring=1.26.0-1 \
   libffi-dev \
   procps \
   python3-dev \

.ci/linux.gitlab-ci.yml

@@ -4,8 +4,8 @@
   outputDir: artifacts
   runner: linux-x86-8cpu-16gb
   stage: build
-  golangVersion: "boring-1.24"
-  imageVersion: "3462-0b23466e0715@sha256:42e8533370666a2463041572293a79e1449001ef803a993e6a860be00858c806"
+  golangVersion: "boring-1.26"
+  imageVersion: "3501-fc698419a625@sha256:aff18c895a50e8451982484e629319e893ebd411675e0482d247079801253e7b"
   CGO_ENABLED: 1
 
 .default-packaging-job: &packaging-job-defaults

.github/workflows/semgrep.yml

@@ -1,24 +1,30 @@
+name: Semgrep OSS scan
 on:
   pull_request: {}
+  push:
+    branches: [main, master]
   workflow_dispatch: {}
-  push: 
-    branches:
-      - main
-      - master
   schedule:
-    - cron: '0 0 * * *'
-name: Semgrep config
+    - cron: '0 0 25 * *'
+concurrency:
+  group: semgrep-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   semgrep:
-    name: semgrep/ci
-    runs-on: ubuntu-latest
-    env:
-      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
-      SEMGREP_URL: https://cloudflare.semgrep.dev
-      SEMGREP_APP_URL: https://cloudflare.semgrep.dev
-      SEMGREP_VERSION_CHECK_URL: https://cloudflare.semgrep.dev/api/check-version
-    container:
-      image: semgrep/semgrep
+    name: semgrep-oss
+    runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@v4
-      - run: semgrep ci
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+      - id: cache-semgrep
+        uses: actions/cache@v5
+        with:
+          path: ~/.local
+          key: semgrep-1.160.0-${{ runner.os }}
+      - if: steps.cache-semgrep.outputs.cache-hit != 'true'
+        run: pip install --user semgrep==1.160.0
+      - run: echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      - run: semgrep scan --config=auto

.gitlab-ci.yml

@@ -1,5 +1,5 @@
 variables:
-  GO_VERSION: "1.24.13"
+  GO_VERSION: "1.26.0"
   MAC_GO_VERSION: "go@$GO_VERSION"
   WIN_GO_VERSION: "go$GO_VERSION"
   GIT_DEPTH: "0"

.golangci.yaml

@@ -1,3 +1,5 @@
+version: "2"
+
 linters:
   enable:
     # Some of the linters below are commented out. We should uncomment and start running them, but they return
@@ -14,10 +16,7 @@ linters:
     - errcheck         # Errcheck is a program for checking for unchecked errors in Go code. These unchecked errors can be critical bugs in some cases.
     - errname          # Checks that sentinel errors are prefixed with the Err and error types are suffixed with the Error.
     - exhaustive       # Check exhaustiveness of enum switch statements.
-    - gofmt            # Gofmt checks whether code was gofmt-ed. By default this tool runs with -s option to check for code simplification.
-    - goimports        # Check import statements are formatted according to the 'goimport' command. Reformat imports in autofix mode.
     - gosec            # Inspects source code for security problems.
-    - gosimple         # Linter for Go source code that specializes in simplifying code.
     - govet            # Vet examines Go source code and reports suspicious constructs. It is roughly the same as 'go vet' and uses its passes.
     - ineffassign      # Detects when assignments to existing variables are not used.
     - importas         # Enforces consistent import aliases.
@@ -36,7 +35,13 @@ linters:
     - wastedassign     # Finds wasted assignment statements.
     - whitespace       # Whitespace is a linter that checks for unnecessary newlines at the start and end of functions, if, for, etc.
     - zerologlint      # Detects the wrong usage of zerolog that a user forgets to dispatch with Send or Msg.
-  # Other linters are disabled, list of all is here: https://golangci-lint.run/usage/linters/
+    # Other linters are disabled, list of all is here: https://golangci-lint.run/usage/linters/
+
+formatters:
+  enable:
+    - gofmt      # Formats code according to Go standard formatting
+    - goimports  # Formats imports and groups them properly
+
 run:
   timeout: 5m
   modules-download-mode: vendor
@@ -44,9 +49,10 @@ run:
 # output configuration options
 output:
   formats:
-    - format: 'colored-line-number'
-  print-issued-lines: true
-  print-linter-name: true
+    text:
+      colors: true
+      print-linter-name: true
+      print-issued-lines: true
 
 issues:
   # Maximum issues count per one linter.
@@ -67,7 +73,7 @@ issues:
   new: true
   # Show only new issues created after git revision `REV`.
   # Default: ""
-  new-from-rev: ac34f94d423273c8fa8fdbb5f2ac60e55f2c77d5
+  new-from-rev: d2a87e9b93456ad7f82417400f4209d513668487
   # Show issues in any part of update files (requires new-from-rev or new-from-patch).
   # Default: false
   whole-files: true

CHANGES.md

@@ -1,3 +1,7 @@
+## 2026.4.0
+### Breaking Change
+- The default value of `--edge-ip-version` has changed from `4` to `auto`. This means cloudflared will now use whichever address family (IPv4 or IPv6) the system resolver returns first, instead of always preferring IPv4. Users who require IPv4-only connections should explicitly set `--edge-ip-version 4`.
+
 ## 2026.2.0
 ### Breaking Change
 - Removes the `proxy-dns` feature from cloudflared. This feature allowed running a local DNS over HTTPS (DoH) proxy.

Dockerfile

@@ -1,7 +1,7 @@
 # use a builder image for building cloudflare
 ARG TARGET_GOOS
 ARG TARGET_GOARCH
-FROM golang:1.24.13 AS builder
+FROM golang:1.26.0 AS builder
 ENV GO111MODULE=on \
   CGO_ENABLED=0 \
   TARGET_GOOS=${TARGET_GOOS} \

Dockerfile.amd64

@@ -1,5 +1,5 @@
 # use a builder image for building cloudflare
-FROM golang:1.24.13 AS builder
+FROM golang:1.26.0 AS builder
 ENV GO111MODULE=on \
   CGO_ENABLED=0 \
   # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual

Dockerfile.arm64

@@ -1,5 +1,5 @@
 # use a builder image for building cloudflare
-FROM golang:1.24.13 AS builder
+FROM golang:1.26.0 AS builder
 ENV GO111MODULE=on \
   CGO_ENABLED=0 \
   # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual

README.md

@@ -62,7 +62,7 @@ For example, as of January 2023 Cloudflare will support cloudflared version 2023
 ### Requirements
 - [GNU Make](https://www.gnu.org/software/make/)
 - [capnp](https://capnproto.org/install.html)
-- [go >= 1.24](https://go.dev/doc/install)
+- [go >= 1.26](https://go.dev/doc/install)
 - Optional tools:
   - [capnpc-go](https://pkg.go.dev/zombiezen.com/go/capnproto2/capnpc-go)
   - [goimports](https://pkg.go.dev/golang.org/x/tools/cmd/goimports)

cmd/cloudflared/access/validation.go

@@ -3,6 +3,7 @@ package access
 import (
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
@@ -23,6 +24,24 @@ func parseRequestHeaders(values []string) http.Header {
 	return headers
 }
 
+// bracketBareIPv6 wraps bare IPv6 addresses in a URL with square brackets.
+// Go 1.26 tightened net/url parsing to strictly require RFC 3986 bracket syntax
+// for IPv6 addresses in URLs. Before Go 1.26, bare forms like "http://::1" were
+// accepted; now they are rejected. This function detects bare IPv6 in the host
+// portion and brackets it so that url.ParseRequestURI can parse it correctly.
+func bracketBareIPv6(input string) string {
+	prefix := input[:strings.Index(input, "://")+3]
+	rest := input[len(prefix):]
+	host := rest
+	if i := strings.IndexAny(rest, "/?#"); i >= 0 {
+		host = rest[:i]
+	}
+	if net.ParseIP(host) != nil && strings.Contains(host, ":") {
+		return prefix + "[" + host + "]" + rest[len(host):]
+	}
+	return input
+}
+
 // parseHostname will attempt to convert a user provided URL string into a string with some light error checking on
 // certain expectations from the URL.
 // Will convert all HTTP URLs to HTTPS
@@ -33,6 +52,7 @@ func parseURL(input string) (*url.URL, error) {
 	if !strings.HasPrefix(input, "https://") && !strings.HasPrefix(input, "http://") {
 		input = fmt.Sprintf("https://%s", input)
 	}
+	input = bracketBareIPv6(input)
 	url, err := url.ParseRequestURI(input)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse as URL: %w", err)

cmd/cloudflared/access/validation_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParseRequestHeaders(t *testing.T) {
@@ -15,6 +16,30 @@ func TestParseRequestHeaders(t *testing.T) {
 	assert.Equal(t, "000:000:0:1:asd", values.Get("cf-trace-id"))
 }
 
+func TestBracketBareIPv6(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"https://::1", "https://[::1]"},
+		{"https://::1/path", "https://[::1]/path"},
+		{"https://::1:8080", "https://[::1:8080]"},
+		{"https://::1:8080/path", "https://[::1:8080]/path"},
+		{"https://::1?query=1", "https://[::1]?query=1"},         // query without path
+		{"https://::1#fragment", "https://[::1]#fragment"},       // fragment without path
+		{"https://[::1]", "https://[::1]"},                       // already bracketed
+		{"https://[::1]:8080", "https://[::1]:8080"},             // already bracketed with port
+		{"https://127.0.0.1", "https://127.0.0.1"},               // IPv4 unchanged
+		{"https://example.com", "https://example.com"},           // hostname unchanged
+		{"https://example.com:8080", "https://example.com:8080"}, // hostname:port unchanged
+	}
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			assert.Equal(t, tt.expected, bracketBareIPv6(tt.input))
+		})
+	}
+}
+
 func TestParseURL(t *testing.T) {
 	schemes := []string{
 		"http://",
@@ -28,8 +53,8 @@ func TestParseURL(t *testing.T) {
 		{"localhost", "localhost"},
 		{"127.0.0.1", "127.0.0.1"},
 		{"127.0.0.1:9090", "127.0.0.1:9090"},
-		{"::1", "::1"},
-		{"::1:8080", "::1:8080"},
+		{"::1", "[::1]"},
+		{"::1:8080", "[::1:8080]"},
 		{"[::1]", "[::1]"},
 		{"[::1]:8080", "[::1]:8080"},
 		{":8080", ":8080"},
@@ -49,7 +74,7 @@ func TestParseURL(t *testing.T) {
 					input := fmt.Sprintf("%s%s%s", scheme, host.input, path)
 					expected := fmt.Sprintf("%s%s%s", "https://", host.expected, path)
 					url, err := parseURL(input)
-					assert.NoError(t, err, "input: %s\texpected: %s", input, expected)
+					require.NoError(t, err, "input: %s\texpected: %s", input, expected)
 					assert.Equal(t, expected, url.String())
 					assert.Equal(t, host.expected, url.Host)
 					assert.Equal(t, "https", url.Scheme)

cmd/cloudflared/tunnel/cmd.go

@@ -44,6 +44,7 @@ import (
 )
 
 const (
+	//nolint:gosec // This is the Sentry DSN for cloudflared which is safe to be public
 	sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b:3e8827f6f9f740738eb11138f7bebb68@sentry.io/189878"
 
 	LogFieldCommand             = "command"
@@ -230,7 +231,7 @@ func TunnelCommand(c *cli.Context) error {
 		return err
 	}
 
-	// Run a adhoc named tunnel
+	// Run an adhoc named tunnel
 	// Allows for the creation, routing (optional), and startup of a tunnel in one command
 	// --name required
 	// --url or --hello-world required
@@ -240,8 +241,8 @@ func TunnelCommand(c *cli.Context) error {
 		if err != nil {
 			return errors.Wrap(err, "Invalid hostname provided")
 		}
-		url := c.String("url")
-		if url == hostname && url != "" && hostname != "" {
+		tunnelURL := c.String("url")
+		if tunnelURL == hostname && tunnelURL != "" && hostname != "" {
 			return fmt.Errorf("hostname and url shouldn't match. See --help for more information")
 		}
 
@@ -257,7 +258,7 @@ func TunnelCommand(c *cli.Context) error {
 
 	// If user provides a config, check to see if they meant to use `tunnel run` instead
 	if ref := config.GetConfiguration().TunnelID; ref != "" {
-		return fmt.Errorf("Use `cloudflared tunnel run` to start tunnel %s", ref)
+		return fmt.Errorf("use `cloudflared tunnel run` to start tunnel %s", ref)
 	}
 
 	// Classic tunnel usage is no longer supported
@@ -345,12 +346,14 @@ func StartServer(
 				traceLog.Err(err).Msg("Failed to close temporary trace output file")
 			}
 			traceOutputFilepath := c.String(cfdflags.TraceOutput)
+			//nolint:gosec // File path is safe because it is explicitly provided by the user via the --trace-output flag
 			if err := os.Rename(tmpTraceFile.Name(), traceOutputFilepath); err != nil {
 				traceLog.
 					Err(err).
 					Str(LogFieldTraceOutputFilepath, traceOutputFilepath).
 					Msg("Failed to rename temporary trace output file")
 			} else {
+				//nolint:gosec // File path is safe, since it is created by os.CreateTemp
 				err := os.Remove(tmpTraceFile.Name())
 				if err != nil {
 					traceLog.Err(err).Msg("Failed to remove the temporary trace file")
@@ -368,7 +371,7 @@ func StartServer(
 	info.Log(log)
 	logClientOptions(c, log)
 
-	// this context drives the server, when it's cancelled tunnel and all other components (origins, dns, etc...) should stop
+	// this context drives the server, when it's canceled tunnel and all other components (origins, dns, etc...) should stop
 	ctx, cancel := context.WithCancel(c.Context)
 	defer cancel()
 
@@ -451,7 +454,7 @@ func StartServer(
 		return errors.Wrap(err, "Error opening metrics server listener")
 	}
 
-	defer metricsListener.Close()
+	defer func() { _ = metricsListener.Close() }()
 	wg.Add(1)
 
 	go func() {
@@ -565,13 +568,14 @@ func writePidFile(waitForSignal *signal.Signal, pidPathname string, log *zerolog
 		log.Err(err).Str(LogFieldPIDPathname, pidPathname).Msg("Unable to expand the path, try to use absolute path in --pidfile")
 		return
 	}
-	file, err := os.Create(expandedPath)
+	cleanPath := filepath.Clean(expandedPath)
+	file, err := os.Create(cleanPath)
 	if err != nil {
 		log.Err(err).Str(LogFieldExpandedPath, expandedPath).Msg("Unable to write pid")
 		return
 	}
-	defer file.Close()
-	fmt.Fprintf(file, "%d", os.Getpid())
+	defer func() { _ = file.Close() }()
+	_, _ = fmt.Fprintf(file, "%d", os.Getpid())
 }
 
 func hostnameFromURI(uri string) string {
@@ -627,7 +631,7 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Name:    cfdflags.EdgeIpVersion,
 			Usage:   "Cloudflare Edge IP address version to connect with. {4, 6, auto}",
 			EnvVars: []string{"TUNNEL_EDGE_IP_VERSION"},
-			Value:   "4",
+			Value:   "auto",
 			Hidden:  false,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
@@ -1135,6 +1139,12 @@ func sshFlags(shouldHide bool) []cli.Flag {
 }
 
 func stdinControl(reconnectCh chan supervisor.ReconnectSignal, log *zerolog.Logger) {
+	helpStr := strings.Join([]string{
+		"Supported command:",
+		"reconnect [delay]",
+		"- restarts one randomly chosen connection with optional delay before reconnect\n",
+	}, "\n")
+
 	for {
 		scanner := bufio.NewScanner(os.Stdin)
 		for scanner.Scan() {
@@ -1143,7 +1153,7 @@ func stdinControl(reconnectCh chan supervisor.ReconnectSignal, log *zerolog.Logg
 
 			switch parts[0] {
 			case "":
-				break
+				continue
 			case "reconnect":
 				var reconnect supervisor.ReconnectSignal
 				if len(parts) > 1 {
@@ -1155,13 +1165,11 @@ func stdinControl(reconnectCh chan supervisor.ReconnectSignal, log *zerolog.Logg
 				}
 				log.Info().Msgf("Sending %+v", reconnect)
 				reconnectCh <- reconnect
+			case "help":
+				log.Info().Msg(helpStr)
 			default:
 				log.Info().Str(LogFieldCommand, command).Msg("Unknown command")
-				fallthrough
-			case "help":
-				log.Info().Msg(`Supported command:
-reconnect [delay]
-- restarts one randomly chosen connection with optional delay before reconnect`)
+				log.Info().Msg(helpStr)
 			}
 		}
 	}

component-tests/test_edge_discovery.py

@@ -20,12 +20,21 @@ class TestEdgeDiscovery:
     @pytest.mark.parametrize("protocol", protocols())
     def test_default_only(self, tmp_path, component_tests_config, protocol):
         """
-        This test runs a tunnel to connect via IPv4-only edge addresses (default is unset "--edge-ip-version 4")
+        This test runs a tunnel with the default edge-ip-version (auto), which will use
+        whichever address family the system resolver returns first.
         """
         if self.has_ipv6_only():
-            pytest.skip("Host has IPv6 only support and current default is IPv4 only")
-        self.expect_address_connections(
-            tmp_path, component_tests_config, protocol, None, self.expect_ipv4_address)
+            self.expect_address_connections(
+                tmp_path, component_tests_config, protocol, None, self.expect_ipv6_address)
+        elif self.has_ipv4_only():
+            self.expect_address_connections(
+                tmp_path, component_tests_config, protocol, None, self.expect_ipv4_address)
+        elif self.has_dual_stack(address_family_preference=socket.AddressFamily.AF_INET6):
+            self.expect_address_connections(
+                tmp_path, component_tests_config, protocol, None, self.expect_ipv6_address)
+        else:
+            self.expect_address_connections(
+                tmp_path, component_tests_config, protocol, None, self.expect_ipv4_address)
 
     @pytest.mark.parametrize("protocol", protocols())
     def test_ipv4_only(self, tmp_path, component_tests_config, protocol):

connection/protocol.go

@@ -19,6 +19,9 @@ const (
 	edgeH2TLSServerName = "h2.cftunnel.com"
 	// edgeQUICServerName is the server name to establish quic connection with edge.
 	edgeQUICServerName = "quic.cftunnel.com"
+	// probeTLSServerName is the server name used for pre-flight connectivity checks.
+	probeTLSServerName = "probe.cftunnel.com"
+	quicProtos         = "argotunnel"
 	AutoSelectFlag     = "auto"
 	// SRV and TXT record resolution TTL
 	ResolveTTL = time.Hour
@@ -69,7 +72,24 @@ func (p Protocol) TLSSettings() *TLSSettings {
 	case QUIC:
 		return &TLSSettings{
 			ServerName: edgeQUICServerName,
-			NextProtos: []string{"argotunnel"},
+			NextProtos: []string{quicProtos},
+		}
+	default:
+		return nil
+	}
+}
+
+// ProbeTLSSettings returns TLS settings for pre-flight connectivity checks.
+func (p Protocol) ProbeTLSSettings() *TLSSettings {
+	switch p {
+	case HTTP2:
+		return &TLSSettings{
+			ServerName: probeTLSServerName,
+		}
+	case QUIC:
+		return &TLSSettings{
+			ServerName: probeTLSServerName,
+			NextProtos: []string{quicProtos},
 		}
 	default:
 		return nil

connection/protocol_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/cloudflare/cloudflared/edgediscovery"
 )
@@ -14,15 +15,6 @@ const (
 	testAccountTag = "testAccountTag"
 )
 
-func mockFetcher(getError bool, protocolPercent ...edgediscovery.ProtocolPercent) edgediscovery.PercentageFetcher {
-	return func() (edgediscovery.ProtocolPercents, error) {
-		if getError {
-			return nil, fmt.Errorf("failed to fetch percentage")
-		}
-		return protocolPercent, nil
-	}
-}
-
 type dynamicMockFetcher struct {
 	protocolPercents edgediscovery.ProtocolPercents
 	err              error
@@ -89,14 +81,14 @@ func TestNewProtocolSelector(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			selector, err := NewProtocolSelector(test.protocol, testAccountTag, test.tunnelTokenProvided, test.needPQ, fetcher.fetch(), ResolveTTL, &log)
 			if test.wantErr {
-				assert.Error(t, err, fmt.Sprintf("test %s failed", test.name))
+				assert.Error(t, err, "test %s failed", test.name)
 			} else {
-				assert.NoError(t, err, fmt.Sprintf("test %s failed", test.name))
-				assert.Equal(t, test.expectedProtocol, selector.Current(), fmt.Sprintf("test %s failed", test.name))
+				require.NoError(t, err, "test %s failed", test.name)
+				assert.Equalf(t, test.expectedProtocol, selector.Current(), "test %s failed", test.name)
 				fallback, ok := selector.Fallback()
-				assert.Equal(t, test.hasFallback, ok, fmt.Sprintf("test %s failed", test.name))
+				assert.Equalf(t, test.hasFallback, ok, "test %s failed", test.name)
 				if test.hasFallback {
-					assert.Equal(t, test.expectedFallback, fallback, fmt.Sprintf("test %s failed", test.name))
+					assert.Equalf(t, test.expectedFallback, fallback, "test %s failed", test.name)
 				}
 			}
 		})
@@ -106,7 +98,7 @@ func TestNewProtocolSelector(t *testing.T) {
 func TestAutoProtocolSelectorRefresh(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
 	selector, err := NewProtocolSelector(AutoSelectFlag, testAccountTag, false, false, fetcher.fetch(), testNoTTL, &log)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, QUIC, selector.Current())
 
 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
@@ -136,7 +128,7 @@ func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
 	// Since the user chooses http2 on purpose, we always stick to it.
 	selector, err := NewProtocolSelector(HTTP2.String(), testAccountTag, false, false, fetcher.fetch(), testNoTTL, &log)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, HTTP2, selector.Current())
 
 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
@@ -165,9 +157,50 @@ func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
 func TestAutoProtocolSelectorNoRefreshWithToken(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
 	selector, err := NewProtocolSelector(AutoSelectFlag, testAccountTag, true, false, fetcher.fetch(), testNoTTL, &log)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, QUIC, selector.Current())
 
 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
 	assert.Equal(t, QUIC, selector.Current())
 }
+
+func TestProbeTLSSettings(t *testing.T) {
+	tests := []struct {
+		name           string
+		protocol       Protocol
+		expectedServer string
+		expectedProtos []string
+		expectNil      bool
+	}{
+		{
+			name:           "HTTP2 returns probe SNI",
+			protocol:       HTTP2,
+			expectedServer: probeTLSServerName,
+			expectedProtos: nil,
+		},
+		{
+			name:           "QUIC returns probe SNI with alpn",
+			protocol:       QUIC,
+			expectedServer: probeTLSServerName,
+			expectedProtos: []string{"argotunnel"},
+		},
+		{
+			name:      "Unknown protocol returns nil",
+			protocol:  Protocol(999),
+			expectNil: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			settings := test.protocol.ProbeTLSSettings()
+			if test.expectNil {
+				assert.Nil(t, settings)
+			} else {
+				assert.NotNil(t, settings)
+				assert.Equal(t, test.expectedServer, settings.ServerName)
+				assert.Equal(t, test.expectedProtos, settings.NextProtos)
+			}
+		})
+	}
+}

go.mod

@@ -1,6 +1,6 @@
 module github.com/cloudflare/cloudflared
 
-go 1.24.0
+go 1.26
 
 require (
 	github.com/coreos/go-oidc/v3 v3.17.0

prechecks/interfaces.go

@@ -0,0 +1,82 @@
+package prechecks
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/netip"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/rs/zerolog"
+
+	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
+)
+
+// DNSResolver abstracts edge DNS discovery used by DNS probes.
+//
+// The production implementation wraps allregions.EdgeDiscovery
+// (edgediscovery/allregions/discovery.go), which performs an SRV lookup for
+// _v2-origintunneld._tcp.argotunnel.com, falls back to DNS-over-TLS when the
+// system resolver fails, and resolves each discovered hostname via
+// net.LookupIP. The returned slice already has each address tagged with
+// .IPVersion = V4 or V6.
+//
+// Note: allregions.EdgeDiscovery must be exported (currently unexported as
+// edgeDiscovery) before a production adapter can be wired up.
+type DNSResolver interface {
+	// Resolve performs edge discovery for the given region string (empty for
+	// global, "us" / "fed" for regional endpoints) and returns the resolved
+	// addresses grouped by CNAME target, mirroring the structure returned by
+	// allregions.EdgeDiscovery.
+	Resolve(region string) ([][]*allregions.EdgeAddr, error)
+}
+
+// TCPDialer abstracts the TCP + TLS handshake used by HTTP/2 connectivity probes.
+//
+// The production implementation wraps edgediscovery.DialEdge
+// (edgediscovery/dial.go), which is the same function supervisor/tunnel.go
+// uses for production HTTP/2 connections. Reusing it ensures the pre-check
+// validates the identical dial path the tunnel will take.
+type TCPDialer interface {
+	// DialEdge dials the given edge TCP address with TLS, respecting the
+	// provided timeout, and returns the established connection. The caller is
+	// responsible for closing the connection.
+	DialEdge(ctx context.Context, timeout time.Duration, tlsConfig *tls.Config, addr *net.TCPAddr, localIP net.IP) (net.Conn, error)
+}
+
+// QUICDialer abstracts the UDP + QUIC handshake used by QUIC connectivity probes.
+//
+// The production implementation wraps connection.DialQuic
+// (connection/quic.go), which is the same function supervisor/tunnel.go uses
+// for production QUIC connections. The pre-check performs a handshake only —
+// no streams are opened and no RPC frames are sent — to avoid triggering the
+// OTD registration timeout described in TUN-6732.
+type QUICDialer interface {
+	// DialQuic performs a QUIC handshake to the given edge address and returns
+	// the established connection. The caller is responsible for closing the
+	// connection. connIndex is used for UDP port reuse bookkeeping consistent
+	// with the production dial path.
+	DialQuic(
+		ctx context.Context,
+		quicConfig *quic.Config,
+		tlsConfig *tls.Config,
+		addr netip.AddrPort,
+		localAddr net.IP,
+		connIndex uint8,
+		logger *zerolog.Logger,
+	) (quic.Connection, error)
+}
+
+// ManagementDialer abstracts the TCP dial to api.cloudflare.com:443 used by
+// the Management API probe.
+//
+// A successful TCP connection (no TLS handshake required) is sufficient to
+// confirm that port 443 is reachable. This probe is always a soft failure:
+// the tunnel can run without it, but automatic software updates will be
+// unavailable.
+type ManagementDialer interface {
+	// DialContext opens a TCP connection to the given network address. The
+	// caller is responsible for closing the connection.
+	DialContext(ctx context.Context, network, addr string) (net.Conn, error)
+}

prechecks/result.go

@@ -0,0 +1,218 @@
+package prechecks
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/rs/zerolog"
+)
+
+const (
+	// tableWidth is the total character width of the separator lines.
+	tableWidth = 80
+
+	// Status names.
+	passStatus    = "PASS"
+	failStatus    = "FAIL"
+	skipStatus    = "SKIP"
+	unknownStatus = "UNKNOWN"
+
+	// Section separators.
+	sectionChar = "-"
+	headerTitle = "CONNECTIVITY PRE-CHECKS"
+
+	// Log message constants.
+	logMsgPrecheck         = "precheck"
+	logMsgPrecheckComplete = "precheck complete"
+
+	// Log field names.
+	logFieldRunID             = "run_id"
+	logFieldComponent         = "component"
+	logFieldTarget            = "target"
+	logFieldStatus            = "status"
+	logFieldDetails           = "details"
+	logFieldHardFail          = "hard_fail"
+	logFieldSuggestedProtocol = "suggested_protocol"
+
+	sep = " "
+)
+
+// statusLabel returns the display label for a given Status.
+func (s Status) statusLabel() string {
+	switch s {
+	case Pass:
+		return passStatus
+	case Fail:
+		return failStatus
+	case Skip:
+		return skipStatus
+	default:
+		return unknownStatus
+	}
+}
+
+// logString returns the lowercase string used in structured log fields.
+func (s Status) logString() string {
+	return strings.ToLower(s.String())
+}
+
+// separator returns a full-width horizontal line.
+func separator() string {
+	return strings.Repeat(sectionChar, tableWidth)
+}
+
+// header returns the top section title line.
+func header() string {
+	leftDashes := strings.Repeat(sectionChar, 3)
+	rightLen := tableWidth - len(leftDashes) - len(headerTitle) - len(sep)*2
+	return leftDashes + sep + headerTitle + sep + strings.Repeat(sectionChar, rightLen)
+}
+
+// renderTable uses text/tabwriter to format the results rows with
+// automatically aligned columns, returning the rendered string.
+func renderTable(results []CheckResult) string {
+	var buf bytes.Buffer
+	// minwidth=0, tabwidth=8, padding=2, padchar=' ', flags=0
+	w := tabwriter.NewWriter(&buf, 0, 8, 2, ' ', 0)
+	_, _ = fmt.Fprintln(w, "COMPONENT\tTARGET\tSTATUS\tDETAILS")
+	for _, r := range results {
+		_, _ = fmt.Fprintf(w, "%s\t%s\t%s\t%s\n", r.Component, r.Target, r.ProbeStatus.statusLabel(), r.Details)
+	}
+	_ = w.Flush()
+	return buf.String()
+}
+
+// renderActions collects all non-empty Action strings from results and returns
+// the formatted warning/error block that appears between the table and SUMMARY.
+// A Fail result is rendered as ERROR when the report is a hard fail, and as
+// WARNING otherwise (degraded but tunnel can still run).
+func renderActions(r Report) string {
+	hardFail := r.hasHardFail()
+	var sb strings.Builder
+	for _, res := range r.Results {
+		if res.Action == "" || res.ProbeStatus != Fail {
+			continue
+		}
+		if hardFail {
+			_, _ = fmt.Fprintf(&sb, "ERROR: %s\n", res.Action)
+		} else {
+			_, _ = fmt.Fprintf(&sb, "WARNING: %s\n", res.Action)
+		}
+	}
+	return sb.String()
+}
+
+// summaryLine builds the SUMMARY: line based on the Report state.
+func summaryLine(r Report) string {
+	switch {
+	case r.hasHardFail():
+		return "SUMMARY: Environment has critical failures. cloudflared may not be able to establish a tunnel."
+	case r.hasWarn():
+		return fmt.Sprintf("SUMMARY: Environment ready with degraded transport. cloudflared will proceed using '%s'.", r.SuggestedProtocol)
+	default:
+		return fmt.Sprintf("SUMMARY: Environment is healthy. cloudflared will use '%s' as primary protocol.", r.SuggestedProtocol)
+	}
+}
+
+// hasHardFail returns true when the environment cannot establish a tunnel:
+//   - Any DNS probe failed, OR
+//   - Both the QUIC and HTTP/2 transport probes failed.
+//
+// A single transport failing is not a hard fail — the other transport can be
+// used as a fallback (degraded state, reported via hasWarn).
+func (r Report) hasHardFail() bool {
+	var quicFail, http2Fail bool
+	for _, res := range r.Results {
+		if res.ProbeStatus != Fail {
+			continue
+		}
+		switch res.Type {
+		case ProbeTypeDNS:
+			return true
+		case ProbeTypeQUIC:
+			quicFail = true
+		case ProbeTypeHTTP2:
+			http2Fail = true
+		case ProbeTypeManagementAPI:
+			// Management API failure is not a hard fail
+		}
+	}
+	return quicFail && http2Fail
+}
+
+// hasWarn returns true when the environment is degraded but functional:
+//   - Exactly one transport (QUIC or HTTP/2) failed, OR
+//   - The Management API is unreachable (auto-updates unavailable).
+//
+// Hard-fail conditions (DNS down, both transports blocked) take precedence
+// and will cause hasWarn to return false.
+func (r Report) hasWarn() bool {
+	if r.hasHardFail() {
+		return false
+	}
+	var quicFail, http2Fail, apiFail bool
+	for _, res := range r.Results {
+		if res.ProbeStatus != Fail {
+			continue
+		}
+		switch res.Type {
+		case ProbeTypeQUIC:
+			quicFail = true
+		case ProbeTypeHTTP2:
+			http2Fail = true
+		case ProbeTypeManagementAPI:
+			apiFail = true
+		case ProbeTypeDNS:
+			// DNS failures are only relevant for hard failures
+		}
+	}
+	return (quicFail != http2Fail) || apiFail
+}
+
+// String renders the Report as a human-readable table suitable for os.Stdout.
+func (r Report) String() string {
+	var sb strings.Builder
+
+	sb.WriteString(header())
+	sb.WriteString("\n")
+
+	sb.WriteString(renderTable(r.Results))
+
+	actions := renderActions(r)
+	if actions != "" {
+		sb.WriteString(actions)
+	}
+
+	sb.WriteString("\n")
+	sb.WriteString(summaryLine(r))
+	sb.WriteString("\n")
+
+	sb.WriteString(separator())
+	sb.WriteString("\n")
+
+	return sb.String()
+}
+
+// LogEvent emits each CheckResult as a structured zerolog log line, followed by
+// a final summary event. This is the JSON-logging equivalent of String().
+// Every line carries run_id so all results from a single invocation can be correlated.
+func (r Report) LogEvent(logger *zerolog.Logger) {
+	runID := r.RunID.String()
+	for _, res := range r.Results {
+		logger.Info().
+			Str(logFieldRunID, runID).
+			Str(logFieldComponent, res.Component).
+			Str(logFieldTarget, res.Target).
+			Str(logFieldStatus, res.ProbeStatus.logString()).
+			Str(logFieldDetails, res.Details).
+			Msg(logMsgPrecheck)
+	}
+
+	logger.Info().
+		Str(logFieldRunID, runID).
+		Bool(logFieldHardFail, r.hasHardFail()).
+		Str(logFieldSuggestedProtocol, r.SuggestedProtocol.String()).
+		Msg(logMsgPrecheckComplete)
+}

prechecks/result_test.go

@@ -0,0 +1,418 @@
+package prechecks
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cloudflare/cloudflared/connection"
+)
+
+// fixedRunID is used in all fixtures so golden strings are deterministic.
+var fixedRunID = uuid.MustParse("00000000-0000-0000-0000-000000000001")
+
+// Fixtures
+
+// allPassReport is the all-checks-pass scenario: QUIC is the suggested protocol.
+func allPassReport() Report {
+	return Report{
+		RunID:             fixedRunID,
+		SuggestedProtocol: connection.QUIC,
+		Results: []CheckResult{
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region1.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region2.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{Type: ProbeTypeQUIC, Component: "UDP Connectivity", Target: "Port 7844 (QUIC)", ProbeStatus: Pass, Details: "Handshake successful"},
+			{Type: ProbeTypeHTTP2, Component: "TCP Connectivity", Target: "Port 7844 (HTTP/2)", ProbeStatus: Pass, Details: "TLS handshake successful"},
+			{Type: ProbeTypeManagementAPI, Component: "Cloudflare API", Target: "api.cloudflare.com:443", ProbeStatus: Pass, Details: "Reachable"},
+		},
+	}
+}
+
+// quicBlockedReport is the degraded scenario: QUIC is blocked, HTTP/2 is the fallback.
+// Only one transport failed so this is a warning, not a hard fail.
+func quicBlockedReport() Report {
+	return Report{
+		RunID:             fixedRunID,
+		SuggestedProtocol: connection.HTTP2,
+		Results: []CheckResult{
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region1.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region2.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{
+				Type:        ProbeTypeQUIC,
+				Component:   "UDP Connectivity",
+				Target:      "Port 7844 (QUIC)",
+				ProbeStatus: Fail,
+				Details:     "Handshake failed",
+				Action:      "Allow outbound QUIC on port 7844. cloudflared will use http2 in the meantime.",
+			},
+			{Type: ProbeTypeHTTP2, Component: "TCP Connectivity", Target: "Port 7844 (HTTP/2)", ProbeStatus: Pass, Details: "TLS handshake successful"},
+			{Type: ProbeTypeManagementAPI, Component: "Cloudflare API", Target: "api.cloudflare.com:443", ProbeStatus: Pass, Details: "Reachable"},
+		},
+	}
+}
+
+// apiFailReport is the degraded scenario: all connectivity passes but the Cloudflare
+// API is unreachable. The tunnel can still run; only automatic updates are unavailable.
+func apiFailReport() Report {
+	return Report{
+		RunID:             fixedRunID,
+		SuggestedProtocol: connection.QUIC,
+		Results: []CheckResult{
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region1.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region2.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{Type: ProbeTypeQUIC, Component: "UDP Connectivity", Target: "Port 7844 (QUIC)", ProbeStatus: Pass, Details: "Handshake successful"},
+			{Type: ProbeTypeHTTP2, Component: "TCP Connectivity", Target: "Port 7844 (HTTP/2)", ProbeStatus: Pass, Details: "TLS handshake successful"},
+			{
+				Type:        ProbeTypeManagementAPI,
+				Component:   "Cloudflare API",
+				Target:      "api.cloudflare.com:443",
+				ProbeStatus: Fail,
+				Details:     "Connection refused",
+				Action:      "cloudflared will still run, but automatic software updates are unavailable. Ensure port 443 TCP to api.cloudflare.com is open if you want auto-updates.",
+			},
+		},
+	}
+}
+
+// bothTransportsBlockedReport is the hard-fail scenario: both QUIC and HTTP/2 are blocked.
+func bothTransportsBlockedReport() Report {
+	return Report{
+		RunID:             fixedRunID,
+		SuggestedProtocol: connection.HTTP2,
+		Results: []CheckResult{
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region1.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region2.v2.argotunnel.com", ProbeStatus: Pass, Details: "Resolved successfully"},
+			{
+				Type:        ProbeTypeQUIC,
+				Component:   "UDP Connectivity",
+				Target:      "Port 7844 (QUIC)",
+				ProbeStatus: Fail,
+				Details:     "Handshake failed",
+				Action:      "Allow outbound QUIC and/or TCP on port 7844 to the Cloudflare edge.",
+			},
+			{
+				Type:        ProbeTypeHTTP2,
+				Component:   "TCP Connectivity",
+				Target:      "Port 7844 (HTTP/2)",
+				ProbeStatus: Fail,
+				Details:     "Blocked or unreachable",
+			},
+			{Type: ProbeTypeManagementAPI, Component: "Cloudflare API", Target: "api.cloudflare.com:443", ProbeStatus: Pass, Details: "Reachable"},
+		},
+	}
+}
+
+// dnsFailReport is the hard-fail scenario: DNS is unresolvable, transports are skipped.
+func dnsFailReport() Report {
+	return Report{
+		RunID:             fixedRunID,
+		SuggestedProtocol: connection.HTTP2,
+		Results: []CheckResult{
+			{
+				Type:        ProbeTypeDNS,
+				Component:   "DNS Resolution",
+				Target:      "region1.v2.argotunnel.com",
+				ProbeStatus: Fail,
+				Details:     "No addresses returned",
+				Action:      "Ensure your DNS resolver can resolve 'region1.v2.argotunnel.com'. Run: dig A region1.v2.argotunnel.com @1.1.1.1. If that fails, contact your network administrator.",
+			},
+			{Type: ProbeTypeDNS, Component: "DNS Resolution", Target: "region2.v2.argotunnel.com", ProbeStatus: Fail, Details: "No addresses returned"},
+			{Type: ProbeTypeQUIC, Component: "UDP Connectivity", Target: "Port 7844 (QUIC)", ProbeStatus: Skip, Details: "DNS prerequisite failed"},
+			{Type: ProbeTypeHTTP2, Component: "TCP Connectivity", Target: "Port 7844 (HTTP/2)", ProbeStatus: Skip, Details: "DNS prerequisite failed"},
+			{Type: ProbeTypeManagementAPI, Component: "Cloudflare API", Target: "api.cloudflare.com:443", ProbeStatus: Fail, Details: "Connection refused"},
+		},
+	}
+}
+
+// String() / table renderer tests
+
+func TestString_AllPass(t *testing.T) {
+	t.Parallel()
+	want := "" +
+		"--- CONNECTIVITY PRE-CHECKS ----------------------------------------------------\n" +
+		"COMPONENT         TARGET                     STATUS  DETAILS\n" +
+		"DNS Resolution    region1.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"DNS Resolution    region2.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"UDP Connectivity  Port 7844 (QUIC)           PASS    Handshake successful\n" +
+		"TCP Connectivity  Port 7844 (HTTP/2)         PASS    TLS handshake successful\n" +
+		"Cloudflare API    api.cloudflare.com:443     PASS    Reachable\n" +
+		"\n" +
+		"SUMMARY: Environment is healthy. cloudflared will use 'quic' as primary protocol.\n" +
+		"--------------------------------------------------------------------------------\n"
+	assert.Equal(t, want, allPassReport().String())
+}
+
+func TestString_QuicBlocked(t *testing.T) {
+	t.Parallel()
+	want := "" +
+		"--- CONNECTIVITY PRE-CHECKS ----------------------------------------------------\n" +
+		"COMPONENT         TARGET                     STATUS  DETAILS\n" +
+		"DNS Resolution    region1.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"DNS Resolution    region2.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"UDP Connectivity  Port 7844 (QUIC)           FAIL    Handshake failed\n" +
+		"TCP Connectivity  Port 7844 (HTTP/2)         PASS    TLS handshake successful\n" +
+		"Cloudflare API    api.cloudflare.com:443     PASS    Reachable\n" +
+		"WARNING: Allow outbound QUIC on port 7844. cloudflared will use http2 in the meantime.\n" +
+		"\n" +
+		"SUMMARY: Environment ready with degraded transport. cloudflared will proceed using 'http2'.\n" +
+		"--------------------------------------------------------------------------------\n"
+	assert.Equal(t, want, quicBlockedReport().String())
+}
+
+func TestString_APIFail(t *testing.T) {
+	t.Parallel()
+	want := "" +
+		"--- CONNECTIVITY PRE-CHECKS ----------------------------------------------------\n" +
+		"COMPONENT         TARGET                     STATUS  DETAILS\n" +
+		"DNS Resolution    region1.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"DNS Resolution    region2.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"UDP Connectivity  Port 7844 (QUIC)           PASS    Handshake successful\n" +
+		"TCP Connectivity  Port 7844 (HTTP/2)         PASS    TLS handshake successful\n" +
+		"Cloudflare API    api.cloudflare.com:443     FAIL    Connection refused\n" +
+		"WARNING: cloudflared will still run, but automatic software updates are unavailable. Ensure port 443 TCP to api.cloudflare.com is open if you want auto-updates.\n" +
+		"\n" +
+		"SUMMARY: Environment ready with degraded transport. cloudflared will proceed using 'quic'.\n" +
+		"--------------------------------------------------------------------------------\n"
+	assert.Equal(t, want, apiFailReport().String())
+}
+
+func TestString_BothTransportsBlocked(t *testing.T) {
+	t.Parallel()
+	want := "" +
+		"--- CONNECTIVITY PRE-CHECKS ----------------------------------------------------\n" +
+		"COMPONENT         TARGET                     STATUS  DETAILS\n" +
+		"DNS Resolution    region1.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"DNS Resolution    region2.v2.argotunnel.com  PASS    Resolved successfully\n" +
+		"UDP Connectivity  Port 7844 (QUIC)           FAIL    Handshake failed\n" +
+		"TCP Connectivity  Port 7844 (HTTP/2)         FAIL    Blocked or unreachable\n" +
+		"Cloudflare API    api.cloudflare.com:443     PASS    Reachable\n" +
+		"ERROR: Allow outbound QUIC and/or TCP on port 7844 to the Cloudflare edge.\n" +
+		"\n" +
+		"SUMMARY: Environment has critical failures. cloudflared may not be able to establish a tunnel.\n" +
+		"--------------------------------------------------------------------------------\n"
+	assert.Equal(t, want, bothTransportsBlockedReport().String())
+}
+
+func TestString_DNSFail(t *testing.T) {
+	t.Parallel()
+	want := "" +
+		"--- CONNECTIVITY PRE-CHECKS ----------------------------------------------------\n" +
+		"COMPONENT         TARGET                     STATUS  DETAILS\n" +
+		"DNS Resolution    region1.v2.argotunnel.com  FAIL    No addresses returned\n" +
+		"DNS Resolution    region2.v2.argotunnel.com  FAIL    No addresses returned\n" +
+		"UDP Connectivity  Port 7844 (QUIC)           SKIP    DNS prerequisite failed\n" +
+		"TCP Connectivity  Port 7844 (HTTP/2)         SKIP    DNS prerequisite failed\n" +
+		"Cloudflare API    api.cloudflare.com:443     FAIL    Connection refused\n" +
+		"ERROR: Ensure your DNS resolver can resolve 'region1.v2.argotunnel.com'. Run: dig A region1.v2.argotunnel.com @1.1.1.1. If that fails, contact your network administrator.\n" +
+		"\n" +
+		"SUMMARY: Environment has critical failures. cloudflared may not be able to establish a tunnel.\n" +
+		"--------------------------------------------------------------------------------\n"
+	assert.Equal(t, want, dnsFailReport().String())
+}
+
+func TestString_EmptyResults(t *testing.T) {
+	t.Parallel()
+	r := Report{RunID: fixedRunID, SuggestedProtocol: connection.QUIC}
+	out := r.String()
+	// Must not panic and must still emit a valid skeleton.
+	assert.Contains(t, out, "CONNECTIVITY PRE-CHECKS")
+	assert.Contains(t, out, "SUMMARY:")
+	assert.Contains(t, out, separator())
+}
+
+// LogEvent() / structured log renderer tests
+
+// logEntry is a helper struct to unmarshal a single JSON log line emitted by LogEvent.
+type logEntry struct {
+	Level             string `json:"level"`
+	RunID             string `json:"run_id"`
+	Component         string `json:"component"`
+	Target            string `json:"target"`
+	Status            string `json:"status"`
+	Details           string `json:"details"`
+	Message           string `json:"message"`
+	HardFail          *bool  `json:"hard_fail"`
+	SuggestedProtocol string `json:"suggested_protocol"`
+}
+
+// captureLogLines runs LogEvent against a buffer-backed zerolog logger and
+// returns the parsed JSON entries, one per emitted line.
+func captureLogLines(t *testing.T, r Report) []logEntry {
+	t.Helper()
+	var buf bytes.Buffer
+	logger := zerolog.New(&buf)
+	r.LogEvent(&logger)
+
+	var entries []logEntry
+	for _, line := range strings.Split(strings.TrimRight(buf.String(), "\n"), "\n") {
+		if line == "" {
+			continue
+		}
+		var e logEntry
+		require.NoError(t, json.Unmarshal([]byte(line), &e), "failed to parse log line: %s", line)
+		entries = append(entries, e)
+	}
+	return entries
+}
+
+func TestLogEvent_AllPass(t *testing.T) {
+	t.Parallel()
+	r := allPassReport()
+	entries := captureLogLines(t, r)
+
+	// One line per result plus one summary line.
+	require.Len(t, entries, len(r.Results)+1)
+
+	// Each result line carries the right fields.
+	expected := []struct {
+		component string
+		target    string
+		status    string
+		details   string
+	}{
+		{"DNS Resolution", "region1.v2.argotunnel.com", "pass", "Resolved successfully"},
+		{"DNS Resolution", "region2.v2.argotunnel.com", "pass", "Resolved successfully"},
+		{"UDP Connectivity", "Port 7844 (QUIC)", "pass", "Handshake successful"},
+		{"TCP Connectivity", "Port 7844 (HTTP/2)", "pass", "TLS handshake successful"},
+		{"Cloudflare API", "api.cloudflare.com:443", "pass", "Reachable"},
+	}
+	for i, exp := range expected {
+		e := entries[i]
+		assert.Equal(t, "info", e.Level, "entry %d: level", i)
+		assert.Equal(t, fixedRunID.String(), e.RunID, "entry %d: run_id", i)
+		assert.Equal(t, exp.component, e.Component, "entry %d: component", i)
+		assert.Equal(t, exp.target, e.Target, "entry %d: target", i)
+		assert.Equal(t, exp.status, e.Status, "entry %d: status", i)
+		assert.Equal(t, exp.details, e.Details, "entry %d: details", i)
+		assert.Equal(t, logMsgPrecheck, e.Message, "entry %d: message", i)
+	}
+
+	// Summary line.
+	summary := entries[len(entries)-1]
+	assert.Equal(t, logMsgPrecheckComplete, summary.Message)
+	assert.Equal(t, fixedRunID.String(), summary.RunID)
+	require.NotNil(t, summary.HardFail)
+	assert.False(t, *summary.HardFail)
+	assert.Equal(t, "quic", summary.SuggestedProtocol)
+}
+
+func TestLogEvent_QuicBlocked(t *testing.T) {
+	t.Parallel()
+	entries := captureLogLines(t, quicBlockedReport())
+
+	// QUIC row (index 2) must carry status=fail and the right details.
+	quic := entries[2]
+	assert.Equal(t, "fail", quic.Status)
+	assert.Equal(t, "UDP Connectivity", quic.Component)
+	assert.Equal(t, "Port 7844 (QUIC)", quic.Target)
+	assert.Equal(t, "Handshake failed", quic.Details)
+	assert.Equal(t, fixedRunID.String(), quic.RunID)
+
+	// Summary: not a hard fail (HTTP/2 still works), protocol falls back to http2.
+	summary := entries[len(entries)-1]
+	require.NotNil(t, summary.HardFail)
+	assert.False(t, *summary.HardFail)
+	assert.Equal(t, "http2", summary.SuggestedProtocol)
+	assert.Equal(t, fixedRunID.String(), summary.RunID)
+}
+
+func TestLogEvent_APIFail(t *testing.T) {
+	t.Parallel()
+	entries := captureLogLines(t, apiFailReport())
+
+	// API row (index 4) carries status=fail and the expected details.
+	api := entries[4]
+	assert.Equal(t, "fail", api.Status)
+	assert.Equal(t, "Cloudflare API", api.Component)
+	assert.Equal(t, "api.cloudflare.com:443", api.Target)
+	assert.Equal(t, "Connection refused", api.Details)
+	assert.Equal(t, fixedRunID.String(), api.RunID)
+
+	// All transport rows pass.
+	assert.Equal(t, "pass", entries[2].Status)
+	assert.Equal(t, "pass", entries[3].Status)
+
+	// Summary: not a hard fail, QUIC is still the suggested protocol.
+	summary := entries[len(entries)-1]
+	require.NotNil(t, summary.HardFail)
+	assert.False(t, *summary.HardFail)
+	assert.Equal(t, "quic", summary.SuggestedProtocol)
+}
+
+func TestLogEvent_BothTransportsBlocked(t *testing.T) {
+	t.Parallel()
+	entries := captureLogLines(t, bothTransportsBlockedReport())
+
+	// Both transport rows carry status=fail.
+	assert.Equal(t, "fail", entries[2].Status)
+	assert.Equal(t, "Handshake failed", entries[2].Details)
+	assert.Equal(t, "fail", entries[3].Status)
+	assert.Equal(t, "Blocked or unreachable", entries[3].Details)
+
+	// Summary: hard fail is true.
+	summary := entries[len(entries)-1]
+	require.NotNil(t, summary.HardFail)
+	assert.True(t, *summary.HardFail)
+}
+
+func TestLogEvent_DNSFail(t *testing.T) {
+	t.Parallel()
+	entries := captureLogLines(t, dnsFailReport())
+
+	// Both DNS rows carry status=fail and the expected details.
+	assert.Equal(t, "fail", entries[0].Status)
+	assert.Equal(t, "No addresses returned", entries[0].Details)
+	assert.Equal(t, "fail", entries[1].Status)
+	assert.Equal(t, "No addresses returned", entries[1].Details)
+
+	// Transport rows are skipped.
+	assert.Equal(t, "skip", entries[2].Status)
+	assert.Equal(t, "DNS prerequisite failed", entries[2].Details)
+	assert.Equal(t, "skip", entries[3].Status)
+	assert.Equal(t, "DNS prerequisite failed", entries[3].Details)
+
+	// Summary: hard fail is true.
+	summary := entries[len(entries)-1]
+	require.NotNil(t, summary.HardFail)
+	assert.True(t, *summary.HardFail)
+}
+
+func TestLogEvent_EmptyReport(t *testing.T) {
+	t.Parallel()
+	r := Report{RunID: fixedRunID, SuggestedProtocol: connection.HTTP2}
+	entries := captureLogLines(t, r)
+
+	// No result lines, only the summary.
+	require.Len(t, entries, 1)
+	assert.Equal(t, logMsgPrecheckComplete, entries[0].Message)
+	assert.Equal(t, fixedRunID.String(), entries[0].RunID)
+	require.NotNil(t, entries[0].HardFail)
+	assert.False(t, *entries[0].HardFail)
+	assert.Equal(t, "http2", entries[0].SuggestedProtocol)
+}
+
+// hasHardFail / hasWarn helper tests
+
+func TestHasHardFail(t *testing.T) {
+	t.Parallel()
+	assert.False(t, allPassReport().hasHardFail())
+	assert.False(t, quicBlockedReport().hasHardFail())
+	assert.False(t, apiFailReport().hasHardFail())
+	assert.True(t, bothTransportsBlockedReport().hasHardFail())
+	assert.True(t, dnsFailReport().hasHardFail())
+}
+
+func TestHasWarn(t *testing.T) {
+	t.Parallel()
+	assert.False(t, allPassReport().hasWarn())
+	assert.True(t, quicBlockedReport().hasWarn())
+	assert.True(t, apiFailReport().hasWarn())
+	assert.False(t, bothTransportsBlockedReport().hasWarn())
+	assert.False(t, dnsFailReport().hasWarn())
+}

prechecks/types.go

@@ -0,0 +1,111 @@
+package prechecks
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/cloudflare/cloudflared/connection"
+	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
+)
+
+// Status represents the outcome of a single connectivity pre-check.
+type Status int
+
+const (
+	// Pass indicates the check completed successfully.
+	Pass Status = iota
+	// Fail indicates the check did not succeed. Whether this is a hard failure
+	// or a degraded-but-functional state depends on which probe(s) failed — see
+	// Report.hasHardFail and Report.hasWarn.
+	Fail
+	// Skip indicates the check was not executed because a prerequisite
+	// check (typically DNS) failed first.
+	Skip
+)
+
+// String returns the canonical display name for a Status value.
+func (s Status) String() string {
+	switch s {
+	case Pass:
+		return "PASS"
+	case Fail:
+		return "FAIL"
+	case Skip:
+		return "SKIP"
+	default:
+		return "UNKNOWN"
+	}
+}
+
+// ProbeType identifies which connectivity probe produced a CheckResult.
+// It is used by hasHardFail and hasWarn to evaluate severity without
+// matching against human-readable strings.
+type ProbeType int
+
+const (
+	ProbeTypeDNS           ProbeType = iota // DNS resolution
+	ProbeTypeQUIC                           // UDP/QUIC transport
+	ProbeTypeHTTP2                          // TCP/HTTP2 transport
+	ProbeTypeManagementAPI                  // Cloudflare management API
+)
+
+// CheckResult holds the outcome of one individual connectivity probe.
+type CheckResult struct {
+	// Type identifies which probe produced this result. Used for severity
+	// classification in hasHardFail and hasWarn.
+	Type ProbeType
+
+	// Component is the human-readable probe category shown in the table header
+	// column, e.g. "DNS Resolution", "QUIC Connectivity".
+	Component string
+
+	// Target is the address or resource that was probed, e.g.
+	// "region1.v2.argotunnel.com" or "Port 7844 (QUIC)".
+	Target string
+
+	// ProbeStatus is the outcome of the probe.
+	ProbeStatus Status
+
+	// Details is a short description of the result shown in the table, e.g.
+	// "Resolved successfully" or "Handshake failed".
+	Details string
+
+	// Action is non-empty when ProbeStatus is Fail and contains a human-readable
+	// remediation instruction, e.g. "Allow outbound QUIC on port 7844."
+	Action string
+}
+
+// Report aggregates all CheckResults produced by a single Run() invocation.
+// Pre-checks run in parallel with tunnel initialization and are purely
+// diagnostic: the Report is displayed to the user but never gates startup.
+type Report struct {
+	// RunID is a unique identifier for this pre-check run. It is included in
+	// every structured log line so that all results from a single invocation
+	// can be correlated across log aggregation systems.
+	RunID uuid.UUID
+
+	// Results contains one entry per executed probe, in the order they were
+	// collected.
+	Results []CheckResult
+
+	// SuggestedProtocol is the connection protocol the pre-checks recommend
+	// based on transport probe results.
+	SuggestedProtocol connection.Protocol
+}
+
+// Config controls the behavior of a pre-check Run().
+type Config struct {
+	// Region is the optional cloudflared --region flag value. When non-empty
+	// the pre-check probes the regional edge hostnames instead of the global ones.
+	Region string
+
+	// Timeout is the maximum wall-clock duration allowed for the entire
+	// pre-check suite to complete.
+	Timeout time.Duration
+
+	// IPVersion controls which address families are probed for transport
+	// checks. It mirrors the --edge-ip-version CLI flag so that the pre-check
+	// exercises the same code paths the tunnel itself will use.
+	IPVersion allregions.ConfigIPVersion
+}

release/index.html

@@ -186,20 +186,141 @@ sudo dnf install cloudflared
 </pre>
 
 
-<h2><a name="gokeyless-packages"></a>Gokeyless</a></h2>
-<h3><a name="go-keyless-debian">Debian</a></h3>
+<h2><a name="gokeyless-packages">Gokeyless</a></h2>
+
+<ul>
+    <li><a href="#gokeyless-debian-any">Any Debian Based Distribution (Recommended)</a></li>
+    <li><a href="#gokeyless-debian-bookworm">Debian Bookworm</a></li>
+    <li><a href="#gokeyless-ubuntu-focal">Ubuntu 20.04 (Focal Fossa)</a></li>
+    <li><a href="#gokeyless-ubuntu-jammy">Ubuntu 22.04 (Jammy Jellyfish)</a></li>
+    <li><a href="#gokeyless-ubuntu-noble">Ubuntu 24.04 (Noble Numbat)</a></li>
+    <li><a href="#gokeyless-amazon-linux">Amazon Linux</a></li>
+    <li><a href="#gokeyless-rhel-generic">RHEL Generic</a></li>
+    <li><a href="#gokeyless-centos-7">Centos 7</a></li>
+    <li><a href="#gokeyless-centos-8">Centos 8</a></li>
+    <li><a href="#gokeyless-centos-stream">Centos Stream</a></li>
+</ul>
+
+<h3 style="color: #d9534f;">Warning: Public Key Rollover (30 October 2025)</h3>
+<p style="background-color: #fff3cd; border-left: 4px solid #ffc107; padding: 10px; margin: 10px 0;">
+    <strong>We have rolled our public key for package signing.</strong> If you are using RPM-based distributions (RHEL,
+    CentOS, Amazon Linux, etc.) or Debian Trixie and have the old key installed, RPM/Deb packages will no longer work with the old key.
+    Please update your repository configuration using the instructions below to ensure you can continue receiving
+    package updates. The previous keys will still work for other distributions for the time being, but it is now DEPRECATED and will be removed on 30 April 2026
+</p>
+
+<h3><a name="gokeyless-debian-any">Any Debian Based Distribution (Recommended)</a></h3>
 <pre>
+# Add cloudflare gpg key
 sudo mkdir -p --mode=0755 /usr/share/keyrings
 curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
 
 # Add this repo to your apt repositories
-echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/gokeyless buster main' | sudo tee /etc/apt/sources.list.d/cloudflare.list
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/gokeyless any main' | sudo tee /etc/apt/sources.list.d/cloudflare.list
 
 # install gokeyless
 sudo apt-get update && sudo apt-get install gokeyless
 </pre>
 
-<h3><a name="go-keyless-centos">Centos 8</a></h3>
+<h3><a name="gokeyless-debian-bookworm">Debian Bookworm</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/gokeyless bookworm main' | sudo tee /etc/apt/sources.list.d/cloudflare.list
+
+# install gokeyless
+sudo apt-get update && sudo apt-get install gokeyless
+</pre>
+
+<h3><a name="gokeyless-ubuntu-focal">Ubuntu 20.04 (Focal Fossa)</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/gokeyless focal main' | sudo tee /etc/apt/sources.list.d/cloudflare.list
+
+# install gokeyless
+sudo apt-get update && sudo apt-get install gokeyless
+</pre>
+
+<h3><a name="gokeyless-ubuntu-jammy">Ubuntu 22.04 (Jammy Jellyfish)</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/gokeyless jammy main' | sudo tee /etc/apt/sources.list.d/cloudflare.list
+
+# install gokeyless
+sudo apt-get update && sudo apt-get install gokeyless
+</pre>
+
+<h3><a name="gokeyless-ubuntu-noble">Ubuntu 24.04 (Noble Numbat)</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/gokeyless noble main' | sudo tee /etc/apt/sources.list.d/cloudflare.list
+
+# install gokeyless
+sudo apt-get update && sudo apt-get install gokeyless
+</pre>
+
+<h3><a name="gokeyless-amazon-linux">Amazon Linux</a></h3>
+<pre>
+# Add gokeyless.repo to /etc/yum.repos.d/
+curl -fsSl https://pkg.cloudflare.com/gokeyless.repo | sudo tee /etc/yum.repos.d/gokeyless.repo
+
+#update repo
+sudo yum update
+
+# install gokeyless
+sudo yum install gokeyless
+</pre>
+
+<h3><a name="gokeyless-rhel-generic">RHEL Generic</a></h3>
+<pre>
+# Add gokeyless.repo to /etc/yum.repos.d/
+curl -fsSl https://pkg.cloudflare.com/gokeyless.repo | sudo tee /etc/yum.repos.d/gokeyless.repo
+
+#update repo
+sudo yum update
+
+# install gokeyless
+sudo yum install gokeyless
+</pre>
+
+<h3><a name="gokeyless-centos-7">Centos 7</a></h3>
+<pre>
+# This requires yum config-manager
+sudo yum install yum-utils
+
+# Add gokeyless.repo to config-manager
+sudo yum-config-manager --add-repo https://pkg.cloudflare.com/gokeyless.repo
+
+# install gokeyless
+sudo yum install gokeyless
+</pre>
+
+<h3><a name="gokeyless-centos-8">Centos 8</a></h3>
+<pre>
+# This requires dnf config-manager
+# Add gokeyless.repo to config-manager
+sudo dnf config-manager --add-repo https://pkg.cloudflare.com/gokeyless.repo
+
+# install gokeyless
+sudo dnf install gokeyless
+</pre>
+
+<h3><a name="gokeyless-centos-stream">Centos Stream</a></h3>
 <pre>
 # This requires dnf config-manager
 # Add gokeyless.repo to config-manager