Release 2019.2.0

AUTH-1403: Print the paths in the ssh-config instructions
AUTH-1503: Added RDP support
2026-08-07 15:24:46 +00:00 · 2019-02-11 14:06:56 -06:00 · 2019-02-11 10:56:06 -06:00 · 2019-02-08 14:28:47 -06:00 · 2019-02-07 16:38:52 -06:00 · 2019-02-01 14:57:53 -06:00
158 changed files with 17957 additions and 1776 deletions
@@ -7,3 +7,4 @@ guide/public
 .idea
 .vscode
 \#*\#
+cscope.*
@@ -2,31 +2,48 @@


 [[projects]]
+  digest = "1:b16fbfbcc20645cb419f78325bb2e85ec729b338e996a228124d68931a6f2a37"
  name = "github.com/BurntSushi/toml"
  packages = ["."]
+  pruneopts = "UT"
  revision = "b26d9c308763d68093482582cea63d69be07a0f0"
  version = "v0.3.0"

 [[projects]]
  branch = "master"
+  digest = "1:d6afaeed1502aa28e80a4ed0981d570ad91b2579193404256ce672ed0a609e0d"
  name = "github.com/beorn7/perks"
  packages = ["quantile"]
+  pruneopts = "UT"
  revision = "3a771d992973f24aa725d07868b467d1ddfceafb"

 [[projects]]
+  digest = "1:fed1f537c2f1269fe475a8556c393fe466641682d73ef8fd0491cd3aa1e47bad"
  name = "github.com/certifi/gocertifi"
  packages = ["."]
+  pruneopts = "UT"
  revision = "deb3ae2ef2610fde3330947281941c562861188b"
  version = "2018.01.18"

 [[projects]]
  branch = "master"
+  digest = "1:e5003c19d396d8b3cf1324ea0bf49b00f13e9466d0297d1268b641f1c617c3a2"
  name = "github.com/cloudflare/brotli-go"
  packages = ["."]
+  pruneopts = "T"
  revision = "18c9f6c67e3dfc12e0ddaca748d2887f97a7ac28"

 [[projects]]
  branch = "master"
+  digest = "1:6dbb2bbc7e6333e691c4d82fd86485f0695a35902fbb9b2df5f72e22ab0040f3"
+  name = "github.com/cloudflare/golibs"
+  packages = ["lrucache"]
+  pruneopts = "UT"
+  revision = "333127dbecfcc23a8db7d9a4f52785d23aff44a1"
+
+[[projects]]
+  branch = "master"
+  digest = "1:af68c8bdac3ceaf46c67f0c43cc1ee5f10e705d8e04f8a63fa41231d0be6b0fb"
  name = "github.com/coredns/coredns"
  packages = [
    "core/dnsserver",
@@ -52,30 +69,64 @@
    "plugin/pkg/uniq",
    "plugin/pkg/watch",
    "plugin/test",
-    "request"
+    "request",
  ]
+  pruneopts = "UT"
  revision = "992e7928c7c258628d2b13b769acc86781b9faea"

 [[projects]]
+  branch = "master"
+  digest = "1:6a503e232df389d94ebb97dfb22d4ae463b6e2f351660613e11d9e42f57ab6df"
+  name = "github.com/coreos/go-oidc"
+  packages = [
+    "http",
+    "jose",
+    "key",
+    "oauth2",
+    "oidc",
+  ]
+  pruneopts = "UT"
+  revision = "a93f71fdfe73d2c0f5413c0565eea0af6523a6df"
+
+[[projects]]
+  digest = "1:1da3a221f0bc090792d3a2a080ff09008427c0e0f0533a4ed6abd8994421da73"
  name = "github.com/coreos/go-systemd"
  packages = ["daemon"]
+  pruneopts = "UT"
  revision = "39ca1b05acc7ad1220e09f133283b8859a8b71ab"
  version = "v17"

 [[projects]]
+  digest = "1:6fda0d7f5e52b081e075775b1ecebf1ea0c923e7be33604ed0225ae078e701b5"
+  name = "github.com/coreos/pkg"
+  packages = [
+    "health",
+    "httputil",
+    "timeutil",
+  ]
+  pruneopts = "UT"
+  revision = "97fdf19511ea361ae1c100dd393cc47f8dcfa1e1"
+  version = "v4"
+
+[[projects]]
+  digest = "1:a2c1d0e43bd3baaa071d1b9ed72c27d78169b2b269f71c105ac4ba34b1be4a39"
  name = "github.com/davecgh/go-spew"
  packages = ["spew"]
+  pruneopts = "UT"
  revision = "346938d642f2ec3594ed81d874461961cd0faa76"
  version = "v1.1.0"

 [[projects]]
  branch = "master"
+  digest = "1:c013ffc6e15f9f898078f9d38441c68b228aa7b899659452170250ccb27f5f1e"
  name = "github.com/elgs/gosqljson"
  packages = ["."]
+  pruneopts = "UT"
  revision = "027aa4915315a0b2825c0f025cea347829b974fa"

 [[projects]]
  branch = "master"
+  digest = "1:15eadee5930d325154e5e1f3c4f4b28ab62f9c0aa949580e8d9edabaf0b64e85"
  name = "github.com/equinox-io/equinox"
  packages = [
    ".",
@@ -83,213 +134,285 @@
    "internal/go-update/internal/binarydist",
    "internal/go-update/internal/osext",
    "internal/osext",
-    "proto"
+    "proto",
  ]
+  pruneopts = "UT"
  revision = "f24972fa72facf59d05c91c848b65eac38815915"

 [[projects]]
  branch = "master"
+  digest = "1:433763f10d88dba9b533a7ea2fe9f5ee11e57e00306eb97a1f6090fd978e8fa1"
  name = "github.com/facebookgo/grace"
  packages = ["gracenet"]
+  pruneopts = "UT"
  revision = "75cf19382434e82df4dd84953f566b8ad23d6e9e"

 [[projects]]
  branch = "master"
+  digest = "1:50a46ab1d5edbbdd55125b4d37f1bf503d0807c26461f9ad7b358d6006641d09"
  name = "github.com/flynn/go-shlex"
  packages = ["."]
+  pruneopts = "UT"
  revision = "3f9db97f856818214da2e1057f8ad84803971cff"

 [[projects]]
  branch = "master"
+  digest = "1:d4623fc7bf7e281d9107367cc4a9e76ed3e86b1eec1a4e30630c870bef1fedd0"
  name = "github.com/getsentry/raven-go"
  packages = ["."]
+  pruneopts = "UT"
  revision = "ed7bcb39ff10f39ab08e317ce16df282845852fa"

 [[projects]]
  branch = "master"
+  digest = "1:3e6afc3ed8a72949aa735c00fddc23427dc9384ccfd51cf0d91a412e668da632"
  name = "github.com/golang-collections/collections"
  packages = ["queue"]
+  pruneopts = "UT"
  revision = "604e922904d35e97f98a774db7881f049cd8d970"

 [[projects]]
+  digest = "1:17fe264ee908afc795734e8c4e63db2accabaf57326dbf21763a7d6b86096260"
  name = "github.com/golang/protobuf"
  packages = [
    "proto",
    "ptypes",
    "ptypes/any",
    "ptypes/duration",
-    "ptypes/timestamp"
+    "ptypes/timestamp",
  ]
+  pruneopts = "UT"
  revision = "b4deda0973fb4c70b50d226b1af49f3da59f5265"
  version = "v1.1.0"

 [[projects]]
+  digest = "1:8f8811f9be822914c3a25c6a071e93beb4c805d7b026cbf298bc577bc1cc945b"
  name = "github.com/google/uuid"
  packages = ["."]
+  pruneopts = "UT"
  revision = "064e2069ce9c359c118179501254f67d7d37ba24"
  version = "0.2"

 [[projects]]
+  digest = "1:c79fb010be38a59d657c48c6ba1d003a8aa651fa56b579d959d74573b7dff8e1"
  name = "github.com/gorilla/context"
  packages = ["."]
+  pruneopts = "UT"
  revision = "08b5f424b9271eedf6f9f0ce86cb9396ed337a42"
  version = "v1.1.1"

 [[projects]]
+  digest = "1:e73f5b0152105f18bc131fba127d9949305c8693f8a762588a82a48f61756f5f"
  name = "github.com/gorilla/mux"
  packages = ["."]
+  pruneopts = "UT"
  revision = "e3702bed27f0d39777b0b37b664b6280e8ef8fbf"
  version = "v1.6.2"

 [[projects]]
+  digest = "1:43dd08a10854b2056e615d1b1d22ac94559d822e1f8b6fcc92c1a1057e85188e"
  name = "github.com/gorilla/websocket"
  packages = ["."]
+  pruneopts = "UT"
  revision = "ea4d1f681babbce9545c9c5f3d5194a789c89f5b"
  version = "v1.2.0"

 [[projects]]
  branch = "master"
+  digest = "1:1a1206efd03a54d336dce7bb8719e74f2f8932f661cb9f57d5813a1d99c083d8"
  name = "github.com/grpc-ecosystem/grpc-opentracing"
  packages = ["go/otgrpc"]
+  pruneopts = "UT"
  revision = "8e809c8a86450a29b90dcc9efbf062d0fe6d9746"

+[[projects]]
+  digest = "1:75ab90ae3f5d876167e60f493beadfe66f0ed861a710f283fb06c86437a09538"
+  name = "github.com/jonboulle/clockwork"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "2eee05ed794112d45db504eb05aa693efd2b8b09"
+  version = "v0.1.0"
+
 [[projects]]
  branch = "master"
+  digest = "1:37ce7d7d80531b227023331002c0d42b4b4b291a96798c82a049d03a54ba79e4"
  name = "github.com/lib/pq"
  packages = [
    ".",
-    "oid"
+    "oid",
  ]
+  pruneopts = "UT"
  revision = "90697d60dd844d5ef6ff15135d0203f65d2f53b8"

 [[projects]]
+  digest = "1:c658e84ad3916da105a761660dcaeb01e63416c8ec7bc62256a9b411a05fcd67"
  name = "github.com/mattn/go-colorable"
  packages = ["."]
+  pruneopts = "UT"
  revision = "167de6bfdfba052fa6b2d3664c8f5272e23c9072"
  version = "v0.0.9"

 [[projects]]
+  digest = "1:d4d17353dbd05cb52a2a52b7fe1771883b682806f68db442b436294926bbfafb"
  name = "github.com/mattn/go-isatty"
  packages = ["."]
+  pruneopts = "UT"
  revision = "0360b2af4f38e8d38c7fce2a9f4e702702d73a39"
  version = "v0.0.3"

 [[projects]]
+  digest = "1:ff5ebae34cfbf047d505ee150de27e60570e8c394b3b8fdbb720ff6ac71985fc"
  name = "github.com/matttproud/golang_protobuf_extensions"
  packages = ["pbutil"]
+  pruneopts = "UT"
  revision = "c12348ce28de40eed0136aa2b644d0ee0650e56c"
  version = "v1.0.1"

 [[projects]]
  branch = "master"
+  digest = "1:75fa16a231ef40da3e462d651c20b9df20bde0777bdc1ac0982242c79057ee71"
  name = "github.com/mholt/caddy"
  packages = [
    ".",
    "caddyfile",
-    "telemetry"
+    "telemetry",
  ]
+  pruneopts = "UT"
  revision = "d3b731e9255b72d4571a5aac125634cf1b6031dc"

 [[projects]]
+  digest = "1:463e4140189f8194f9121ca1c7fe3b8e9e9a2ab3d949b43c835c21034927dc62"
  name = "github.com/miekg/dns"
  packages = ["."]
+  pruneopts = "UT"
  revision = "5a2b9fab83ff0f8bfc99684bd5f43a37abe560f1"
  version = "v1.0.8"

 [[projects]]
  branch = "master"
+  digest = "1:8eb17c2ec4df79193ae65b621cd1c0c4697db3bc317fe6afdc76d7f2746abd05"
  name = "github.com/mitchellh/go-homedir"
  packages = ["."]
+  pruneopts = "UT"
  revision = "3864e76763d94a6df2f9960b16a20a33da9f9a66"

 [[projects]]
+  digest = "1:450b7623b185031f3a456801155c8320209f75d0d4c4e633c6b1e59d44d6e392"
  name = "github.com/opentracing/opentracing-go"
  packages = [
    ".",
    "ext",
-    "log"
+    "log",
  ]
+  pruneopts = "UT"
  revision = "1949ddbfd147afd4d964a9f00b24eb291e0e7c38"
  version = "v1.0.2"

 [[projects]]
+  digest = "1:40e195917a951a8bf867cd05de2a46aaf1806c50cf92eebf4c16f78cd196f747"
  name = "github.com/pkg/errors"
  packages = ["."]
+  pruneopts = "UT"
  revision = "645ef00459ed84a119197bfb8d8205042c6df63d"
  version = "v0.8.0"

 [[projects]]
+  digest = "1:0028cb19b2e4c3112225cd871870f2d9cf49b9b4276531f03438a88e94be86fe"
  name = "github.com/pmezard/go-difflib"
  packages = ["difflib"]
+  pruneopts = "UT"
  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
  version = "v1.0.0"

 [[projects]]
+  digest = "1:c968b29db5d68ec97de404b6d058d5937fa015a141b3b4f7a0d87d5f8226f04c"
  name = "github.com/prometheus/client_golang"
  packages = [
    "prometheus",
-    "prometheus/promhttp"
+    "prometheus/promhttp",
  ]
+  pruneopts = "UT"
  revision = "967789050ba94deca04a5e84cce8ad472ce313c1"
  version = "v0.9.0-pre1"

 [[projects]]
  branch = "master"
+  digest = "1:32d10bdfa8f09ecf13598324dba86ab891f11db3c538b6a34d1c3b5b99d7c36b"
  name = "github.com/prometheus/client_model"
  packages = ["go"]
+  pruneopts = "UT"
  revision = "99fa1f4be8e564e8a6b613da7fa6f46c9edafc6c"

 [[projects]]
  branch = "master"
+  digest = "1:e469cd65badf7694aeb44874518606d93c1d59e7735d3754ad442782437d3cc3"
  name = "github.com/prometheus/common"
  packages = [
    "expfmt",
    "internal/bitbucket.org/ww/goautoneg",
-    "model"
+    "model",
  ]
+  pruneopts = "UT"
  revision = "7600349dcfe1abd18d72d3a1770870d9800a7801"

 [[projects]]
  branch = "master"
+  digest = "1:20d9bb50dbee172242f9bcd6ec24a917dd7a5bb17421bf16a79c33111dea7db1"
  name = "github.com/prometheus/procfs"
  packages = [
    ".",
    "internal/util",
    "nfs",
-    "xfs"
+    "xfs",
  ]
+  pruneopts = "UT"
  revision = "ae68e2d4c00fed4943b5f6698d504a5fe083da8a"

 [[projects]]
+  digest = "1:9a6f766efd8d5752adb7052aebb6e3d85255b31a8dff5e58ab4efa740ba9efa0"
  name = "github.com/rifflock/lfshook"
  packages = ["."]
+  pruneopts = "UT"
  revision = "bf539943797a1f34c1f502d07de419b5238ae6c6"
  version = "v2.3"

 [[projects]]
+  digest = "1:9e9193aa51197513b3abcb108970d831fbcf40ef96aa845c4f03276e1fa316d2"
  name = "github.com/sirupsen/logrus"
  packages = ["."]
+  pruneopts = "UT"
  revision = "c155da19408a8799da419ed3eeb0cb5db0ad5dbc"
  version = "v1.0.5"

 [[projects]]
+  digest = "1:18752d0b95816a1b777505a97f71c7467a8445b8ffb55631a7bf779f6ba4fa83"
  name = "github.com/stretchr/testify"
  packages = ["assert"]
+  pruneopts = "UT"
  revision = "f35b8ab0b5a2cef36673838d662e249dd9c94686"
  version = "v1.2.2"

 [[projects]]
  branch = "master"
+  digest = "1:1182d12da264c8fe593504f150c3a479297767991fc1c06796cb67e4f61c4366"
  name = "golang.org/x/crypto"
  packages = [
+    "curve25519",
    "ed25519",
    "ed25519/internal/edwards25519",
-    "ssh/terminal"
+    "internal/subtle",
+    "nacl/box",
+    "nacl/secretbox",
+    "poly1305",
+    "salsa20/salsa",
+    "ssh/terminal",
  ]
+  pruneopts = "UT"
  revision = "a49355c7e3f8fe157a85be2f77e6e269a0f89602"

 [[projects]]
  branch = "master"
+  digest = "1:011ee76ffb757c7c91a3e61cf5d6f367d1fd5dd08e16a4e6ae688e7759f8509a"
  name = "golang.org/x/net"
  packages = [
    "bpf",
@@ -304,18 +427,22 @@
    "ipv4",
    "ipv6",
    "trace",
-    "websocket"
+    "websocket",
  ]
+  pruneopts = "UT"
  revision = "32a936f46389aa10549d60bd7833e54b01685d09"

 [[projects]]
  branch = "master"
+  digest = "1:39ebcc2b11457b703ae9ee2e8cca0f68df21969c6102cb3b705f76cca0ea0239"
  name = "golang.org/x/sync"
  packages = ["errgroup"]
+  pruneopts = "UT"
  revision = "1d60e4601c6fd243af51cc01ddf169918a5407ca"

 [[projects]]
  branch = "master"
+  digest = "1:2e8e74aa73847379a370c2704ff08baf4a7303ae682766e70c23ded3fd9b3f37"
  name = "golang.org/x/sys"
  packages = [
    "unix",
@@ -323,11 +450,13 @@
    "windows/registry",
    "windows/svc",
    "windows/svc/eventlog",
-    "windows/svc/mgr"
+    "windows/svc/mgr",
  ]
+  pruneopts = "UT"
  revision = "ce36f3865eeb42541ce3f87f32f8462c5687befa"

 [[projects]]
+  digest = "1:a2ab62866c75542dd18d2b069fec854577a20211d7c0ea6ae746072a1dccdd18"
  name = "golang.org/x/text"
  packages = [
    "collate",
@@ -343,18 +472,22 @@
    "unicode/bidi",
    "unicode/cldr",
    "unicode/norm",
-    "unicode/rangetable"
+    "unicode/rangetable",
  ]
+  pruneopts = "UT"
  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
  version = "v0.3.0"

 [[projects]]
  branch = "master"
+  digest = "1:601e63e7d4577f907118bec825902505291918859d223bce015539e79f1160e3"
  name = "google.golang.org/genproto"
  packages = ["googleapis/rpc/status"]
+  pruneopts = "UT"
  revision = "ff3583edef7de132f219f0efc00e097cabcc0ec0"

 [[projects]]
+  digest = "1:2dab32a43451e320e49608ff4542fdfc653c95dcc35d0065ec9c6c3dd540ed74"
  name = "google.golang.org/grpc"
  packages = [
    ".",
@@ -381,28 +514,34 @@
    "stats",
    "status",
    "tap",
-    "transport"
+    "transport",
  ]
+  pruneopts = "UT"
  revision = "168a6198bcb0ef175f7dacec0b8691fc141dc9b8"
  version = "v1.13.0"

 [[projects]]
  branch = "altsrc-parse-durations"
+  digest = "1:0370b1bceda03dbfade3abbde639a43f1113bab711ec760452e5c0dcc0c14787"
  name = "gopkg.in/urfave/cli.v2"
  packages = [
    ".",
-    "altsrc"
+    "altsrc",
  ]
+  pruneopts = "UT"
  revision = "d604b6ffeee878fbf084fd2761466b6649989cee"
  source = "https://github.com/cbranch/cli"

 [[projects]]
+  digest = "1:342378ac4dcb378a5448dd723f0784ae519383532f5e70ade24132c4c8693202"
  name = "gopkg.in/yaml.v2"
  packages = ["."]
+  pruneopts = "UT"
  revision = "5420a8b6744d3b0345ab293f6fcba19c978f1183"
  version = "v2.2.1"

 [[projects]]
+  digest = "1:8ffc3ddc31414c0a71220957bb723b16510d7fcb5b3880dc0da4cf6d39c31642"
  name = "zombiezen.com/go/capnproto2"
  packages = [
    ".",
@@ -418,8 +557,9 @@
    "rpc/internal/refcount",
    "schemas",
    "server",
-    "std/capnp/rpc"
+    "std/capnp/rpc",
  ]
+  pruneopts = "UT"
  revision = "7cfd211c19c7f5783c695f3654efa46f0df259c3"
  source = "https://github.com/zombiezen/go-capnproto2"
  version = "v2.17.1"
@@ -427,6 +567,59 @@
 [solve-meta]
  analyzer-name = "dep"
  analyzer-version = 1
-  inputs-digest = "9aac6a0260101988582bfa55d39559e53cf8ccd7e37caad3350aeea768f5bdb2"
+  input-imports = [
+    "github.com/cloudflare/brotli-go",
+    "github.com/cloudflare/golibs/lrucache",
+    "github.com/coredns/coredns/core/dnsserver",
+    "github.com/coredns/coredns/plugin",
+    "github.com/coredns/coredns/plugin/cache",
+    "github.com/coredns/coredns/plugin/metrics/vars",
+    "github.com/coredns/coredns/plugin/pkg/dnstest",
+    "github.com/coredns/coredns/plugin/pkg/rcode",
+    "github.com/coredns/coredns/request",
+    "github.com/coreos/go-oidc/jose",
+    "github.com/coreos/go-oidc/oidc",
+    "github.com/coreos/go-systemd/daemon",
+    "github.com/elgs/gosqljson",
+    "github.com/equinox-io/equinox",
+    "github.com/facebookgo/grace/gracenet",
+    "github.com/getsentry/raven-go",
+    "github.com/golang-collections/collections/queue",
+    "github.com/google/uuid",
+    "github.com/gorilla/mux",
+    "github.com/gorilla/websocket",
+    "github.com/lib/pq",
+    "github.com/mattn/go-colorable",
+    "github.com/miekg/dns",
+    "github.com/mitchellh/go-homedir",
+    "github.com/pkg/errors",
+    "github.com/prometheus/client_golang/prometheus",
+    "github.com/prometheus/client_golang/prometheus/promhttp",
+    "github.com/rifflock/lfshook",
+    "github.com/sirupsen/logrus",
+    "github.com/stretchr/testify/assert",
+    "golang.org/x/crypto/nacl/box",
+    "golang.org/x/crypto/ssh/terminal",
+    "golang.org/x/net/context",
+    "golang.org/x/net/http2",
+    "golang.org/x/net/http2/hpack",
+    "golang.org/x/net/idna",
+    "golang.org/x/net/trace",
+    "golang.org/x/net/websocket",
+    "golang.org/x/sync/errgroup",
+    "golang.org/x/sys/windows",
+    "golang.org/x/sys/windows/svc",
+    "golang.org/x/sys/windows/svc/eventlog",
+    "golang.org/x/sys/windows/svc/mgr",
+    "gopkg.in/urfave/cli.v2",
+    "gopkg.in/urfave/cli.v2/altsrc",
+    "zombiezen.com/go/capnproto2",
+    "zombiezen.com/go/capnproto2/encoding/text",
+    "zombiezen.com/go/capnproto2/pogs",
+    "zombiezen.com/go/capnproto2/rpc",
+    "zombiezen.com/go/capnproto2/schemas",
+    "zombiezen.com/go/capnproto2/server",
+    "zombiezen.com/go/capnproto2/std/capnp/rpc",
+  ]
  solver-name = "gps-cdcl"
  solver-version = 1
@@ -48,6 +48,7 @@
 [[constraint]]
  name = "zombiezen.com/go/capnproto2"
  source = "https://github.com/zombiezen/go-capnproto2"
+  version = "2.17.1"

 [[constraint]]
  name = "github.com/gorilla/websocket"
@@ -64,3 +65,15 @@
 [[override]]
  name = "github.com/mholt/caddy"
  branch = "master"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/coreos/go-oidc"
+
+[[constraint]]
+  branch = "master"
+  name = "golang.org/x/crypto"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/cloudflare/golibs"
@@ -16,9 +16,17 @@ ifeq ($(EQUINOX_IS_DRAFT), true)
 	EQUINOX_FLAGS := --draft $(EQUINOX_FLAGS)
 endif

+ifeq ($(GOARCH),)
+	GOARCH := amd64
+endif
+
 .PHONY: all
 all: cloudflared test

+.PHONY: clean
+clean:
+	go clean
+
 .PHONY: cloudflared
 cloudflared:
 	go build -v $(VERSION_FLAGS) $(IMPORT_PATH)/cmd/cloudflared
@@ -32,7 +40,7 @@ cloudflared-deb: cloudflared
 	mkdir -p $(PACKAGE_DIR)
 	cp cloudflared $(PACKAGE_DIR)/cloudflared
 	fakeroot fpm -C $(PACKAGE_DIR) -s dir -t deb --deb-compression bzip2 \
-		-a $(GOARCH) -v $(VERSION) -n cloudflared
+		-a $(GOARCH) -v $(VERSION) -n cloudflared cloudflared=/usr/local/bin/

 .PHONY: cloudflared-darwin-amd64.tgz
 cloudflared-darwin-amd64.tgz: cloudflared
@@ -55,3 +63,7 @@ release: bin/equinox
 bin/equinox:
 	mkdir -p bin
 	curl -s https://bin.equinox.io/c/75JtLRTsJ3n/release-tool-beta-$(EQUINOX_PLATFORM).tgz | tar xz -C bin/
+
+.PHONY: tunnel-deps
+tunnel-deps:
+	capnp compile -ogo -I ./tunnelrpc tunnelrpc/tunnelrpc.capnp
@@ -1,3 +1,92 @@
+2019.2.0
+- 2019-01-24 AUTH-1462: better curl arg parsing
+- 2019-02-01 TUN-1456: Only make one UUID
+- 2019-01-30 cloudflared/linux_service: Add missing /etc/init.d shebang
+- 2019-02-07 AUTH-1511: Add custom headers for ssh command
+- 2019-02-01 AUTH-1503: Added RDP support
+- 2019-02-01 AUTH-1403: Print the paths in the ssh-config instructions
+
+2019.1.0
+- 2018-12-10 TUN-1231: Horizontal overflow wrapping on the Hello page
+- 2018-12-17 TUN-1140: Show usage if invoked with no args or config
+- 2018-11-06 TUN-632 Filter out common network exceptions from going to Sentry on StartServer
+- 2019-01-07 TUN-1138: Install cloudflared service directory with 755 permissions
+- 2019-01-07 TUN-1265: Silent exit when failing to parse config
+- 2019-01-10 TUN-1350: Enhance error messages with cloudflarestatus.com link, if relevant
+- 2019-01-16 TUN-1358: Close readyList after Muxer.Serve() has stopped running
+- 2019-01-24 AUTH-1423: move from stdout to stderr
+- 2019-01-24 AUTH-1404: reauth if the token is about to expire within 15 minutes
+- 2019-01-24 AUTH-1459: improved ssh streaming error message
+- 2019-01-24 AUTH-1211: print all the versions
+- 2019-01-24 AUTH-1337: fix url path
+- 2019-01-28 TUN-1418: Rename ProtocolLogger to TransportLogger, and use TransportLogger to log RPC events.
+- 2019-01-28 TUN-1419: Identify request/response headers/content length with ray ID
+
+2018.12.1
+- 2018-12-11 TUN-1270: cloudflared panic (HA metrics missing label)
+
+2018.12.0
+- 2018-11-15 TUN-1196: Allow TLS config client CA and root CA to be constructed from multiple certificates
+- 2018-11-20 TUN-1209: TLS Config Certificates and GetCertificate can both be set
+- 2018-11-26 TUN-1212: Expose tunnel_id in metrics
+- 2018-11-30 TUN-1204: remove 'cloudflared hello' command
+- 2018-12-04 Fix license URL typo
+- 2018-12-07 TUN-1250: ValidateHTTPService shouldn't follow 302s
+
+2018.11.0
+- 2018-10-31 AUTH-1282: Fixed an issue where we were receiving as opposed sending on the channel.
+- 2018-11-06 TUN-1179: Fix log message in cmd/cloudflared/transfer.Run
+- 2018-11-13 AUTH-1308: get jwt even when you are already logged in
+- 2018-11-12 TUN-1190: check URL parse error when starting SSH proxy server
+- 2018-11-15 AUTH-1320: Fixed request issue and unhide the ssh command
+
+2018.10.5
+- 2018-10-18 TUN-968: Flow control for large requests/responses
+- 2018-10-26 TUN-1158: Windows: use process arguments rather than trivial service arguments
+- 2018-10-20 #30: Fix the Content-Length header for HTTP2->HTTP1
+- 2018-10-29 TUN-1160: pass Host header during origin url validation
+
+2018.10.4
+- 2018-09-21 AUTH-1070: added SSH/protocol forwarding
+- 2018-10-19 AUTH-1235: fixed packaging of deb dev file
+- 2018-10-19 TUN-1097: Host missing from WebSocket request
+- 2018-10-19 AUTH-1188: UX Review and Changes for CLI SSH Access
+
+2018.10.3
+- 2018-10-08 TUN-1099: Bring back changes in 2018.10.1
+- 2018-10-08 TUN-1098: removed deprecation error
+- 2018-10-08 TUN-1101: False negatives in Cloudflared error reporting
+
+2018.10.2
+- 2018-10-06 TUN-1093: Revert cloudflared to 2018.8.0
+
+2018.10.1
+- 2018-10-03 TUN-1012: Normalize config filename for Linux services
+- 2018-10-05 TUN-1081: cloudflared now generates UUIDs
+- 2018-10-05 TUN-1083: fixed incorrect help menu
+- 2018-10-05 TUN-1086: fixed config option
+
+2018.10.0
+- 2018-08-15 AUTH-910, AUTH-1049, AUTH-1068, AUTH-1056: Generate and store Access tokens with E2EE option, curl/cmd wrapper
+- 2018-09-11 TUN-890: To support free tunnels, hostname can now be ""
+- 2018-09-12 TUN-810: Cloudflared should open dash/argotunnel not dash/warp
+- 2018-09-12 TUN-985: Don't display tunnel ID if it's empty string
+- 2018-09-11 TUN-881: Display trial zone URL upon successful registration
+- 2018-09-11 TUN-868: HTTP/HTTPS mismatch should have a better error message
+- 2018-09-19 TUN-1028: Unhide cloudflared compression flag
+- 2018-09-20 AUTH-1139: refactored cloudflared help menu
+- 2018-09-20 TUN-1035: New text for cloudflared tunnel --help
+- 2018-09-18 AUTH-1136: addressing beta feedback
+- 2018-09-26 AUTH-1165: hide access command
+- 2018-09-26 TUN-1046: Document that delta compression is a beta feature
+- 2018-09-28 TUN-1056: Lint error broke build
+- 2018-09-27 TUN-1052: Origintunneld can send back an Origincert to Cloudflared
+- 2018-09-28 TUN-1052: Changing type of OriginCert to :Data
+- 2018-10-01 TUN-1062: Makefile target for regenerating Capn Proto definitions
+- 2018-10-02 TUN-1064: Revert OriginCert capnp changes in Cloudflared. Reverts commits a1ee2342e97 and 8c756c45785.
+- 2018-10-03 TUN-1076: Pin capnproto2 to version 2.17.1
+- 2018-10-03 AUTH-1199: unhide access command, added beta label
+
 2018.8.0
 - 2018-05-01 Initial commit
 - 2018-05-03 TUN-595: Add License/Readme files to cloudflared
@@ -0,0 +1,140 @@
+//Package carrier provides a WebSocket proxy to carry or proxy a connection
+//from the local client to the edge. See it as a wrapper around any protocol
+//that it packages up in a WebSocket connection to the edge.
+package carrier
+
+import (
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/token"
+	"github.com/cloudflare/cloudflared/websocket"
+	"github.com/sirupsen/logrus"
+)
+
+// StdinoutStream is empty struct for wrapping stdin/stdout
+// into a single ReadWriter
+type StdinoutStream struct {
+}
+
+// Read will read from Stdin
+func (c *StdinoutStream) Read(p []byte) (int, error) {
+	return os.Stdin.Read(p)
+
+}
+
+// Write will write to Stdout
+func (c *StdinoutStream) Write(p []byte) (int, error) {
+	return os.Stdout.Write(p)
+}
+
+// StartClient will copy the data from stdin/stdout over a WebSocket connection
+// to the edge (originURL)
+func StartClient(logger *logrus.Logger, originURL string, stream io.ReadWriter, headers http.Header) error {
+	return serveStream(logger, originURL, stream, headers)
+}
+
+// StartServer will setup a server on a specified port and copy data over a WebSocket connection
+// to the edge (originURL)
+func StartServer(logger *logrus.Logger, address, originURL string, shutdownC <-chan struct{}, headers http.Header) error {
+	listener, err := net.Listen("tcp", address)
+	if err != nil {
+		logger.WithError(err).Error("failed to start forwarding server")
+		return err
+	}
+	defer listener.Close()
+	for {
+		select {
+		case <-shutdownC:
+			return nil
+		default:
+			conn, err := listener.Accept()
+			if err != nil {
+				return err
+			}
+			go serveConnection(logger, conn, originURL, headers)
+		}
+	}
+}
+
+// serveConnection handles connections for the StartServer call
+func serveConnection(logger *logrus.Logger, c net.Conn, originURL string, headers http.Header) {
+	defer c.Close()
+	serveStream(logger, originURL, c, headers)
+}
+
+// serveStream will serve the data over the WebSocket stream
+func serveStream(logger *logrus.Logger, originURL string, conn io.ReadWriter, headers http.Header) error {
+	wsConn, err := createWebsocketStream(originURL, headers)
+	if err != nil {
+		logger.WithError(err).Errorf("failed to connect to %s\n", originURL)
+		return err
+	}
+	defer wsConn.Close()
+
+	websocket.Stream(wsConn, conn)
+
+	return nil
+}
+
+// createWebsocketStream will create a WebSocket connection to stream data over
+// It also handles redirects from Access and will present that flow if
+// the token is not present on the request
+func createWebsocketStream(originURL string, headers http.Header) (*websocket.Conn, error) {
+	req, err := http.NewRequest(http.MethodGet, originURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header = headers
+
+	wsConn, resp, err := websocket.ClientConnect(req, nil)
+	if err != nil && resp != nil && resp.StatusCode > 300 {
+		location, err := resp.Location()
+		if err != nil {
+			return nil, err
+		}
+		if !strings.Contains(location.String(), "cdn-cgi/access/login") {
+			return nil, errors.New("not an Access redirect")
+		}
+		req, err := buildAccessRequest(originURL)
+		if err != nil {
+			return nil, err
+		}
+
+		wsConn, _, err = websocket.ClientConnect(req, nil)
+		if err != nil {
+			return nil, err
+		}
+	} else if err != nil {
+		return nil, err
+	}
+
+	return &websocket.Conn{Conn: wsConn}, nil
+}
+
+// buildAccessRequest builds an HTTP request with the Access token set
+func buildAccessRequest(originURL string) (*http.Request, error) {
+	req, err := http.NewRequest(http.MethodGet, originURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	token, err := token.FetchToken(req.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	// We need to create a new request as FetchToken will modify req (boo mutable)
+	// as it has to follow redirect on the API and such, so here we init a new one
+	originRequest, err := http.NewRequest(http.MethodGet, originURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	originRequest.Header.Set("cf-access-token", token)
+
+	return originRequest, nil
+}
@@ -0,0 +1,122 @@
+package carrier
+
+import (
+	"bytes"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+
+	ws "github.com/gorilla/websocket"
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+)
+
+const (
+	// example in Sec-Websocket-Key in rfc6455
+	testSecWebsocketKey = "dGhlIHNhbXBsZSBub25jZQ=="
+)
+
+type testStreamer struct {
+	buf *bytes.Buffer
+	l   sync.RWMutex
+}
+
+func newTestStream() *testStreamer {
+	return &testStreamer{buf: new(bytes.Buffer)}
+}
+
+func (s *testStreamer) Read(p []byte) (int, error) {
+	s.l.RLock()
+	defer s.l.RUnlock()
+	return s.buf.Read(p)
+
+}
+
+func (s *testStreamer) Write(p []byte) (int, error) {
+	s.l.Lock()
+	defer s.l.Unlock()
+	return s.buf.Write(p)
+}
+
+func TestStartClient(t *testing.T) {
+	message := "Good morning Austin! Time for another sunny day in the great state of Texas."
+	logger := logrus.New()
+	ts := newTestWebSocketServer()
+	defer ts.Close()
+
+	buf := newTestStream()
+	err := StartClient(logger, "http://"+ts.Listener.Addr().String(), buf, nil)
+	assert.NoError(t, err)
+	buf.Write([]byte(message))
+
+	readBuffer := make([]byte, len(message))
+	buf.Read(readBuffer)
+	assert.Equal(t, message, string(readBuffer))
+}
+
+func TestStartServer(t *testing.T) {
+	listenerAddress := "localhost:1117"
+	message := "Good morning Austin! Time for another sunny day in the great state of Texas."
+	logger := logrus.New()
+	shutdownC := make(chan struct{})
+	ts := newTestWebSocketServer()
+	defer ts.Close()
+
+	go func() {
+		err := StartServer(logger, listenerAddress, "http://"+ts.Listener.Addr().String(), shutdownC, nil)
+		if err != nil {
+			t.Fatalf("Error starting server: %v", err)
+		}
+	}()
+
+	conn, err := net.Dial("tcp", listenerAddress)
+	if err != nil {
+		t.Fatalf("Error connecting to server: %v", err)
+	}
+	conn.Write([]byte(message))
+
+	readBuffer := make([]byte, len(message))
+	conn.Read(readBuffer)
+	assert.Equal(t, string(readBuffer), message)
+}
+
+func newTestWebSocketServer() *httptest.Server {
+	upgrader := ws.Upgrader{
+		ReadBufferSize:  1024,
+		WriteBufferSize: 1024,
+	}
+
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, _ := upgrader.Upgrade(w, r, nil)
+		defer conn.Close()
+		for {
+			mt, message, err := conn.ReadMessage()
+			if err != nil {
+				break
+			}
+
+			if err := conn.WriteMessage(mt, []byte(message)); err != nil {
+				break
+			}
+		}
+	}))
+}
+
+func testRequest(t *testing.T, url string, stream io.ReadWriter) *http.Request {
+	req, err := http.NewRequest("GET", url, stream)
+	if err != nil {
+		t.Fatalf("testRequestHeader error")
+	}
+
+	req.Header.Add("Connection", "Upgrade")
+	req.Header.Add("Upgrade", "WebSocket")
+	req.Header.Add("Sec-Websocket-Key", testSecWebsocketKey)
+	req.Header.Add("Sec-Websocket-Protocol", "tunnel-protocol")
+	req.Header.Add("Sec-Websocket-Version", "13")
+	req.Header.Add("User-Agent", "curl/7.59.0")
+
+	return req
+}
@@ -1,6 +1,6 @@
 pinned_go: &pinned_go go=1.9.3-1
 build_dir: &build_dir /cfsetup_build/src/github.com/cloudflare/cloudflared/
-stretch:
+stretch: &stretch
  build:
    build_dir: *build_dir
    builddeps:
@@ -87,3 +87,5 @@ stretch:
      - export GOOS=linux
      - export GOARCH=amd64
      - make test
+
+jessie: *stretch
@@ -0,0 +1,52 @@
+package access
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/cloudflare/cloudflared/carrier"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/cloudflare/cloudflared/validation"
+	"github.com/pkg/errors"
+	cli "gopkg.in/urfave/cli.v2"
+)
+
+// ssh will start a WS proxy server for server mode
+// or copy from stdin/stdout for client mode
+// useful for proxying other protocols (like ssh) over websockets
+// (which you can put Access in front of)
+func ssh(c *cli.Context) error {
+	hostname, err := validation.ValidateHostname(c.String("hostname"))
+	if err != nil || c.String("hostname") == "" {
+		return cli.ShowCommandHelp(c, "ssh")
+	}
+	headers := buildRequestHeaders(c.StringSlice("header"))
+
+	if c.NArg() > 0 || c.IsSet("url") {
+		localForwarder, err := config.ValidateUrl(c)
+		if err != nil {
+			logger.WithError(err).Error("Error validating origin URL")
+			return errors.Wrap(err, "error validating origin URL")
+		}
+		forwarder, err := url.Parse(localForwarder)
+		if err != nil {
+			logger.WithError(err).Error("Error validating origin URL")
+			return errors.Wrap(err, "error validating origin URL")
+		}
+		return carrier.StartServer(logger, forwarder.Host, "https://"+hostname, shutdownC, headers)
+	}
+
+	return carrier.StartClient(logger, "https://"+hostname, &carrier.StdinoutStream{}, headers)
+}
+
+func buildRequestHeaders(values []string) http.Header {
+	headers := make(http.Header)
+	for _, valuePair := range values {
+		split := strings.Split(valuePair, ":")
+		if len(split) > 1 {
+			headers.Add(strings.TrimSpace(split[0]), strings.TrimSpace(split[1]))
+		}
+	}
+	return headers
+}
@@ -0,0 +1,18 @@
+package access
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildRequestHeaders(t *testing.T) {
+	headers := make(http.Header)
+	headers.Add("client", "value")
+	headers.Add("secret", "safe-value")
+
+	values := buildRequestHeaders([]string{"client: value", "secret: safe-value", "trash"})
+	assert.Equal(t, headers.Get("client"), values.Get("client"))
+	assert.Equal(t, headers.Get("secret"), values.Get("secret"))
+}
@@ -0,0 +1,270 @@
+package access
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/shell"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/token"
+	"golang.org/x/net/idna"
+
+	"github.com/cloudflare/cloudflared/log"
+	raven "github.com/getsentry/raven-go"
+	cli "gopkg.in/urfave/cli.v2"
+)
+
+const sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b@sentry.io/189878"
+
+var (
+	logger         = log.CreateLogger()
+	shutdownC      chan struct{}
+	graceShutdownC chan struct{}
+)
+
+// Init will initialize and store vars from the main program
+func Init(s, g chan struct{}) {
+	shutdownC, graceShutdownC = s, g
+}
+
+// Flags return the global flags for Access related commands (hopefully none)
+func Flags() []cli.Flag {
+	return []cli.Flag{} // no flags yet.
+}
+
+// Commands returns all the Access related subcommands
+func Commands() []*cli.Command {
+	return []*cli.Command{
+		{
+			Name:     "access",
+			Category: "Access (BETA)",
+			Usage:    "access <subcommand>",
+			Description: `(BETA) Cloudflare Access protects internal resources by securing, authenticating and monitoring access 
+			per-user and by application. With Cloudflare Access, only authenticated users with the required permissions are 
+			able to reach sensitive resources. The commands provided here allow you to interact with Access protected 
+			applications from the command line. This feature is considered beta. Your feedback is greatly appreciated!
+			https://cfl.re/CLIAuthBeta`,
+			Subcommands: []*cli.Command{
+				{
+					Name:   "login",
+					Action: login,
+					Usage:  "login <url of access application>",
+					Description: `The login subcommand initiates an authentication flow with your identity provider.
+					The subcommand will launch a browser. For headless systems, a url is provided.
+					Once authenticated with your identity provider, the login command will generate a JSON Web Token (JWT)
+					scoped to your identity, the application you intend to reach, and valid for a session duration set by your 
+					administrator. cloudflared stores the token in local storage.`,
+					Flags: []cli.Flag{
+						&cli.StringFlag{
+							Name:   "url",
+							Hidden: true,
+						},
+					},
+				},
+				{
+					Name:   "curl",
+					Action: curl,
+					Usage:  "curl [--allow-request, -ar] <url> [<curl args>...]",
+					Description: `The curl subcommand wraps curl and automatically injects the JWT into a cf-access-token
+					header when using curl to reach an application behind Access.`,
+					ArgsUsage:       "allow-request will allow the curl request to continue even if the jwt is not present.",
+					SkipFlagParsing: true,
+				},
+				{
+					Name:        "token",
+					Action:      generateToken,
+					Usage:       "token -app=<url of access application>",
+					ArgsUsage:   "url of Access application",
+					Description: `The token subcommand produces a JWT which can be used to authenticate requests.`,
+					Flags: []cli.Flag{
+						&cli.StringFlag{
+							Name: "app",
+						},
+					},
+				},
+				{
+					Name:        "ssh",
+					Action:      ssh,
+					Aliases:     []string{"rdp"},
+					Usage:       "",
+					ArgsUsage:   "",
+					Description: `The ssh subcommand sends data over a proxy to the Cloudflare edge.`,
+					Flags: []cli.Flag{
+						&cli.StringFlag{
+							Name: "hostname",
+						},
+						&cli.StringFlag{
+							Name: "url",
+						},
+						&cli.StringSliceFlag{
+							Name:    "header",
+							Aliases: []string{"H"},
+						},
+					},
+				},
+				{
+					Name:        "ssh-config",
+					Action:      sshConfig,
+					Usage:       "ssh-config",
+					Description: `Prints an example configuration ~/.ssh/config`,
+				},
+			},
+		},
+	}
+}
+
+// login pops up the browser window to do the actual login and JWT generation
+func login(c *cli.Context) error {
+	raven.SetDSN(sentryDSN)
+	logger := log.CreateLogger()
+	args := c.Args()
+	appURL, err := url.Parse(args.First())
+	if args.Len() < 1 || err != nil {
+		logger.Errorf("Please provide the url of the Access application\n")
+		return err
+	}
+	token, err := token.FetchToken(appURL)
+	if err != nil {
+		logger.Errorf("Failed to fetch token: %s\n", err)
+		return err
+	}
+	fmt.Fprintf(os.Stdout, "Successfully fetched your token:\n\n%s\n\n", string(token))
+
+	return nil
+}
+
+// curl provides a wrapper around curl, passing Access JWT along in request
+func curl(c *cli.Context) error {
+	raven.SetDSN(sentryDSN)
+	logger := log.CreateLogger()
+	args := c.Args()
+	if args.Len() < 1 {
+		logger.Error("Please provide the access app and command you wish to run.")
+		return errors.New("incorrect args")
+	}
+
+	cmdArgs, allowRequest := parseAllowRequest(args.Slice())
+	appURL, err := getAppURL(cmdArgs)
+	if err != nil {
+		return err
+	}
+
+	tok, err := token.GetTokenIfExists(appURL)
+	if err != nil || tok == "" {
+		if allowRequest {
+			logger.Warn("You don't have an Access token set. Please run access token <access application> to fetch one.")
+			return shell.Run("curl", cmdArgs...)
+		}
+		tok, err = token.FetchToken(appURL)
+		if err != nil {
+			logger.Error("Failed to refresh token: ", err)
+			return err
+		}
+	}
+
+	cmdArgs = append(cmdArgs, "-H")
+	cmdArgs = append(cmdArgs, fmt.Sprintf("cf-access-token: %s", tok))
+	return shell.Run("curl", cmdArgs...)
+}
+
+// token dumps provided token to stdout
+func generateToken(c *cli.Context) error {
+	raven.SetDSN(sentryDSN)
+	appURL, err := url.Parse(c.String("app"))
+	if err != nil || c.NumFlags() < 1 {
+		fmt.Fprintln(os.Stderr, "Please provide a url.")
+		return err
+	}
+	tok, err := token.GetTokenIfExists(appURL)
+	if err != nil || tok == "" {
+		fmt.Fprintln(os.Stderr, "Unable to find token for provided application. Please run token command to generate token.")
+		return err
+	}
+
+	if _, err := fmt.Fprint(os.Stdout, tok); err != nil {
+		fmt.Fprintln(os.Stderr, "Failed to write token to stdout.")
+		return err
+	}
+	return nil
+}
+
+// sshConfig prints an example SSH config to stdout
+func sshConfig(c *cli.Context) error {
+	outputMessage := "Add this configuration block to your %s/.ssh/config:\n\nHost [your hostname]\n\tProxyCommand %s access ssh --hostname %%h\n"
+	logger.Printf(outputMessage, os.Getenv("HOME"), cloudflaredPath())
+	return nil
+}
+
+// getAppURL will pull the appURL needed for fetching a user's Access token
+func getAppURL(cmdArgs []string) (*url.URL, error) {
+	if len(cmdArgs) < 1 {
+		logger.Error("Please provide a valid URL as the first argument to curl.")
+		return nil, errors.New("not a valid url")
+	}
+
+	u, err := processURL(cmdArgs[0])
+	if err != nil {
+		logger.Error("Please provide a valid URL as the first argument to curl.")
+		return nil, err
+	}
+
+	return u, err
+}
+
+// parseAllowRequest will parse cmdArgs and return a copy of the args and result
+// of the allow request was present
+func parseAllowRequest(cmdArgs []string) ([]string, bool) {
+	if len(cmdArgs) > 1 {
+		if cmdArgs[0] == "--allow-request" || cmdArgs[0] == "-ar" {
+			return cmdArgs[1:], true
+		}
+	}
+
+	return cmdArgs, false
+}
+
+// processURL will preprocess the string (parse to a url, convert to punycode, etc).
+func processURL(s string) (*url.URL, error) {
+	u, err := url.ParseRequestURI(s)
+	if err != nil {
+		return nil, err
+	}
+
+	if u.Host == "" {
+		return nil, errors.New("not a valid host")
+	}
+
+	host, err := idna.ToASCII(u.Hostname())
+	if err != nil { // we fail to convert to punycode, just return the url we parsed.
+		return u, nil
+	}
+	if u.Port() != "" {
+		u.Host = fmt.Sprintf("%s:%s", host, u.Port())
+	} else {
+		u.Host = host
+	}
+
+	return u, nil
+}
+
+// cloudflaredPath pulls the full path of cloudflared on disk
+func cloudflaredPath() string {
+	for _, p := range strings.Split(os.Getenv("PATH"), ":") {
+		path := fmt.Sprintf("%s/%s", p, "cloudflared")
+		if isFileThere(path) {
+			return path
+		}
+	}
+	return "cloudflared"
+}
+
+// isFileThere will check for the presence of candidate path
+func isFileThere(candidate string) bool {
+	fi, err := os.Stat(candidate)
+	if err != nil || fi.IsDir() || !fi.Mode().IsRegular() {
+		return false
+	}
+	return true
+}
@@ -0,0 +1,77 @@
+package config
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+
+	"github.com/cloudflare/cloudflared/validation"
+	homedir "github.com/mitchellh/go-homedir"
+	"gopkg.in/urfave/cli.v2"
+	"gopkg.in/urfave/cli.v2/altsrc"
+)
+
+var (
+	// File names from which we attempt to read configuration.
+	DefaultConfigFiles = []string{"config.yml", "config.yaml"}
+
+	// Launchd doesn't set root env variables, so there is default
+	// Windows default config dir was ~/cloudflare-warp in documentation; let's keep it compatible
+	DefaultConfigDirs = []string{"~/.cloudflared", "~/.cloudflare-warp", "~/cloudflare-warp", "/usr/local/etc/cloudflared", "/etc/cloudflared"}
+)
+
+const DefaultCredentialFile = "cert.pem"
+
+// FileExists checks to see if a file exist at the provided path.
+func FileExists(path string) (bool, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// ignore missing files
+			return false, nil
+		}
+		return false, err
+	}
+	f.Close()
+	return true, nil
+}
+
+// FindInputSourceContext pulls the input source from the config flag.
+func FindInputSourceContext(context *cli.Context) (altsrc.InputSourceContext, error) {
+	if context.String("config") != "" {
+		return altsrc.NewYamlSourceFromFile(context.String("config"))
+	}
+	return nil, nil
+}
+
+// FindDefaultConfigPath returns the first path that contains a config file.
+// If none of the combination of DefaultConfigDirs and DefaultConfigFiles
+// contains a config file, return empty string.
+func FindDefaultConfigPath() string {
+	for _, configDir := range DefaultConfigDirs {
+		for _, configFile := range DefaultConfigFiles {
+			dirPath, err := homedir.Expand(configDir)
+			if err != nil {
+				continue
+			}
+			path := filepath.Join(dirPath, configFile)
+			if ok, _ := FileExists(path); ok {
+				return path
+			}
+		}
+	}
+	return ""
+}
+
+// ValidateUrl will validate url flag correctness. It can be either from --url or argument
+func ValidateUrl(c *cli.Context) (string, error) {
+	var url = c.String("url")
+	if c.NArg() > 0 {
+		if c.IsSet("url") {
+			return "", errors.New("Specified origin urls using both --url and argument. Decide which one you want, I can only support one.")
+		}
+		url = c.Args().Get(0)
+	}
+	validUrl, err := validation.ValidateUrl(url)
+	return validUrl, err
+}
@@ -0,0 +1,176 @@
+// Package encrypter is suitable for encrypting messages you would like to securely share between two points.
+// Useful for providing end to end encryption (E2EE). It uses Box (NaCl) for encrypting the messages.
+// tldr is it uses Elliptic Curves (Curve25519) for the keys, XSalsa20 and Poly1305 for encryption.
+// You can read more here https://godoc.org/golang.org/x/crypto/nacl/box.
+//
+//		msg := []byte("super safe message.")
+//		alice, err := New("alice_priv_key.pem", "alice_pub_key.pem")
+//		if err != nil {
+//			log.Fatal(err)
+//		}
+//
+//		bob, err := New("bob_priv_key.pem", "bob_pub_key.pem")
+//		if err != nil {
+//			log.Fatal(err)
+//		}
+//		encrypted, err := alice.Encrypt(msg, bob.PublicKey())
+//		if err != nil {
+//			log.Fatal(err)
+//		}
+//
+//		data, err := bob.Decrypt(encrypted, alice.PublicKey())
+//		if err != nil {
+//			log.Fatal(err)
+//		}
+//		fmt.Println(string(data))
+package encrypter
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/pem"
+	"errors"
+	"io"
+	"os"
+
+	"golang.org/x/crypto/nacl/box"
+)
+
+// Encrypter represents a keypair value with auxiliary functions to make
+// doing encryption and decryption easier
+type Encrypter struct {
+	privateKey *[32]byte
+	publicKey  *[32]byte
+}
+
+// New returns a new encrypter with initialized keypair
+func New(privateKey, publicKey string) (*Encrypter, error) {
+	e := &Encrypter{}
+	pubKey, key, err := e.fetchOrGenerateKeys(privateKey, publicKey)
+	if err != nil {
+		return nil, err
+	}
+	e.privateKey, e.publicKey = key, pubKey
+	return e, nil
+}
+
+// PublicKey returns a base64 encoded public key. Useful for transport (like in HTTP requests)
+func (e *Encrypter) PublicKey() string {
+	return base64.URLEncoding.EncodeToString(e.publicKey[:])
+}
+
+// Decrypt data that was encrypted using our publicKey. It will use our privateKey and the sender's publicKey to decrypt
+// data is an encrypted buffer of data, mostly like from the Encrypt function. Messages contain the nonce data on the front
+// of the message.
+// senderPublicKey is a base64 encoded version of the sender's public key (most likely from the PublicKey function).
+// The return value is the decrypted buffer or an error.
+func (e *Encrypter) Decrypt(data []byte, senderPublicKey string) ([]byte, error) {
+	var decryptNonce [24]byte
+	copy(decryptNonce[:], data[:24]) // we pull the nonce from the front of the actual message.
+	pubKey, err := e.decodePublicKey(senderPublicKey)
+	if err != nil {
+		return nil, err
+	}
+	decrypted, ok := box.Open(nil, data[24:], &decryptNonce, pubKey, e.privateKey)
+	if !ok {
+		return nil, errors.New("failed to decrypt message")
+	}
+	return decrypted, nil
+}
+
+// Encrypt data using our privateKey and the recipient publicKey
+// data is a buffer of data that we would like to encrypt. Messages will have the nonce added to front
+// as they have to unique for each message shared.
+// recipientPublicKey is a base64 encoded version of the sender's public key (most likely from the PublicKey function).
+// The return value is the encrypted buffer or an error.
+func (e *Encrypter) Encrypt(data []byte, recipientPublicKey string) ([]byte, error) {
+	var nonce [24]byte
+	if _, err := io.ReadFull(rand.Reader, nonce[:]); err != nil {
+		return nil, err
+	}
+
+	pubKey, err := e.decodePublicKey(recipientPublicKey)
+	if err != nil {
+		return nil, err
+	}
+	// This encrypts msg and adds the nonce to the front of the message, since the nonce has to be
+	// the same for encrypting and decrypting
+	return box.Seal(nonce[:], data, &nonce, pubKey, e.privateKey), nil
+}
+
+// WriteKeys keys will take the currently initialized keypair and write them to provided filenames
+func (e *Encrypter) WriteKeys(privateKey, publicKey string) error {
+	if err := e.writeKey(e.privateKey[:], "BOX PRIVATE KEY", privateKey); err != nil {
+		return err
+	}
+	return e.writeKey(e.publicKey[:], "PUBLIC KEY", publicKey)
+}
+
+// fetchOrGenerateKeys will either load or create a keypair if it doesn't exist
+func (e *Encrypter) fetchOrGenerateKeys(privateKey, publicKey string) (*[32]byte, *[32]byte, error) {
+	key, err := e.fetchKey(privateKey)
+	if os.IsNotExist(err) {
+		return box.GenerateKey(rand.Reader)
+	} else if err != nil {
+		return nil, nil, err
+	}
+
+	pub, err := e.fetchKey(publicKey)
+	if os.IsNotExist(err) {
+		return box.GenerateKey(rand.Reader)
+	} else if err != nil {
+		return nil, nil, err
+	}
+	return pub, key, nil
+}
+
+// writeKey will write a key to disk in DER format (it's a standard pem key)
+func (e *Encrypter) writeKey(key []byte, pemType, filename string) error {
+	data := pem.EncodeToMemory(&pem.Block{
+		Type:  pemType,
+		Bytes: key,
+	})
+
+	f, err := os.Create(filename)
+	if err != nil {
+		return err
+	}
+
+	_, err = f.Write(data)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// fetchKey will load a a DER formatted key from disk
+func (e *Encrypter) fetchKey(filename string) (*[32]byte, error) {
+	f, err := os.Open(filename)
+	if err != nil {
+		return nil, err
+	}
+	buf := new(bytes.Buffer)
+	io.Copy(buf, f)
+
+	p, _ := pem.Decode(buf.Bytes())
+	if p == nil {
+		return nil, errors.New("Failed to decode key")
+	}
+	var newKey [32]byte
+	copy(newKey[:], p.Bytes)
+
+	return &newKey, nil
+}
+
+// decodePublicKey will base64 decode the provided key to the box representation
+func (e *Encrypter) decodePublicKey(key string) (*[32]byte, error) {
+	pub, err := base64.URLEncoding.DecodeString(key)
+	if err != nil {
+		return nil, err
+	}
+	var newKey [32]byte
+	copy(newKey[:], pub)
+	return &newKey, nil
+}
@@ -1,21 +0,0 @@
-package main
-
-import (
-	"fmt"
-
-	"gopkg.in/urfave/cli.v2"
-
-	"github.com/cloudflare/cloudflared/hello"
-)
-
-
-func helloWorld(c *cli.Context) error {
-	address := fmt.Sprintf(":%d", c.Int("port"))
-	listener, err := hello.CreateTLSListener(address)
-	if err != nil {
-		return err
-	}
-	defer listener.Close()
-	err = hello.StartHelloWorldServer(logger, listener, nil)
-	return err
-}
@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"

+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	cli "gopkg.in/urfave/cli.v2"
 )

@@ -30,7 +31,13 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 	app.Run(os.Args)
 }

-const serviceConfigDir = "/etc/cloudflared"
+// The directory and files that are used by the service.
+// These are hard-coded in the templates below.
+const (
+	serviceConfigDir      = "/etc/cloudflared"
+	serviceConfigFile     = "config.yml"
+	serviceCredentialFile = "cert.pem"
+)

 var systemdTemplates = []ServiceTemplate{
 	{
@@ -77,7 +84,8 @@ WantedBy=timers.target
 var sysvTemplate = ServiceTemplate{
 	Path:     "/etc/init.d/cloudflared",
 	FileMode: 0755,
-	Content: `# For RedHat and cousins:
+	Content: `#!/bin/sh
+# For RedHat and cousins:
 # chkconfig: 2345 99 01
 # description: Argo Tunnel agent
 # processname: {{.Path}}
@@ -174,6 +182,23 @@ func isSystemd() bool {
 	return false
 }

+func copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile string) error {
+	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
+		return err
+	}
+	srcCredentialPath := filepath.Join(userConfigDir, userCredentialFile)
+	destCredentialPath := filepath.Join(serviceConfigDir, serviceCredentialFile)
+	if err := copyCredential(srcCredentialPath, destCredentialPath); err != nil {
+		return err
+	}
+	srcConfigPath := filepath.Join(userConfigDir, userConfigFile)
+	destConfigPath := filepath.Join(serviceConfigDir, serviceConfigFile)
+	if err := copyConfig(srcConfigPath, destConfigPath); err != nil {
+		return err
+	}
+	return nil
+}
+
 func installLinuxService(c *cli.Context) error {
 	etPath, err := os.Executable()
 	if err != nil {
@@ -181,11 +206,12 @@ func installLinuxService(c *cli.Context) error {
 	}
 	templateArgs := ServiceTemplateArgs{Path: etPath}

-	defaultConfigDir := filepath.Dir(c.String("config"))
-	defaultConfigFile := filepath.Base(c.String("config"))
-	if err = copyCredentials(serviceConfigDir, defaultConfigDir, defaultConfigFile, defaultCredentialFile); err != nil {
+	userConfigDir := filepath.Dir(c.String("config"))
+	userConfigFile := filepath.Base(c.String("config"))
+	userCredentialFile := config.DefaultCredentialFile
+	if err = copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile); err != nil {
 		logger.WithError(err).Infof("Failed to copy user configuration. Before running the service, ensure that %s contains two files, %s and %s",
-			serviceConfigDir, defaultCredentialFile, defaultConfigFiles[0])
+			serviceConfigDir, serviceCredentialFile, serviceConfigFile)
 		return err
 	}

@@ -1,194 +0,0 @@
-package main
-
-import (
-	"crypto/rand"
-	"encoding/base32"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"syscall"
-	"time"
-
-	homedir "github.com/mitchellh/go-homedir"
-	cli "gopkg.in/urfave/cli.v2"
-)
-
-const baseLoginURL = "https://dash.cloudflare.com/warp"
-const baseCertStoreURL = "https://login.cloudflarewarp.com"
-const clientTimeout = time.Minute * 20
-
-func login(c *cli.Context) error {
-	configPath, err := homedir.Expand(defaultConfigDirs[0])
-	if err != nil {
-		return err
-	}
-	ok, err := fileExists(configPath)
-	if !ok && err == nil {
-		// create config directory if doesn't already exist
-		err = os.Mkdir(configPath, 0700)
-	}
-	if err != nil {
-		return err
-	}
-	path := filepath.Join(configPath, defaultCredentialFile)
-	fileInfo, err := os.Stat(path)
-	if err == nil && fileInfo.Size() > 0 {
-		fmt.Fprintf(os.Stderr, `You have an existing certificate at %s which login would overwrite.
-If this is intentional, please move or delete that file then run this command again.
-`, path)
-		return nil
-	}
-	if err != nil && err.(*os.PathError).Err != syscall.ENOENT {
-		return err
-	}
-
-	// for local debugging
-	baseURL := baseCertStoreURL
-	if c.IsSet("url") {
-		baseURL = c.String("url")
-	}
-	// Generate a random post URL
-	certURL := baseURL + generateRandomPath()
-	loginURL, err := url.Parse(baseLoginURL)
-	if err != nil {
-		// shouldn't happen, URL is hardcoded
-		return err
-	}
-	loginURL.RawQuery = "callback=" + url.QueryEscape(certURL)
-
-	err = open(loginURL.String())
-	if err != nil {
-		fmt.Fprintf(os.Stderr, `Please open the following URL and log in with your Cloudflare account:
-
-%s
-
-Leave cloudflared running to install the certificate automatically.
-`, loginURL.String())
-	} else {
-		fmt.Fprintf(os.Stderr, `A browser window should have opened at the following URL:
-
-%s
-
-If the browser failed to open, open it yourself and visit the URL above.
-
-`, loginURL.String())
-	}
-
-	if download(certURL, path) {
-		fmt.Fprintf(os.Stderr, `You have successfully logged in.
-If you wish to copy your credentials to a server, they have been saved to:
-%s
-`, path)
-	} else {
-		fmt.Fprintf(os.Stderr, `Failed to write the certificate due to the following error:
-%v
-
-Your browser will download the certificate instead. You will have to manually
-copy it to the following path:
-
-%s
-
-`, err, path)
-	}
-	return nil
-}
-
-// generateRandomPath generates a random URL to associate with the certificate.
-func generateRandomPath() string {
-	randomBytes := make([]byte, 40)
-	_, err := rand.Read(randomBytes)
-	if err != nil {
-		panic(err)
-	}
-	return "/" + base32.StdEncoding.EncodeToString(randomBytes)
-}
-
-// open opens the specified URL in the default browser of the user.
-func open(url string) error {
-	var cmd string
-	var args []string
-
-	switch runtime.GOOS {
-	case "windows":
-		cmd = "cmd"
-		args = []string{"/c", "start"}
-	case "darwin":
-		cmd = "open"
-	default: // "linux", "freebsd", "openbsd", "netbsd"
-		cmd = "xdg-open"
-	}
-	args = append(args, url)
-	return exec.Command(cmd, args...).Start()
-}
-
-func download(certURL, filePath string) bool {
-	client := &http.Client{Timeout: clientTimeout}
-	// attempt a (long-running) certificate get
-	for i := 0; i < 20; i++ {
-		ok, err := tryDownload(client, certURL, filePath)
-		if ok {
-			putSuccess(client, certURL)
-			return true
-		}
-		if err != nil {
-			logger.WithError(err).Error("Error fetching certificate")
-			return false
-		}
-	}
-	return false
-}
-
-func tryDownload(client *http.Client, certURL, filePath string) (ok bool, err error) {
-	resp, err := client.Get(certURL)
-	if err != nil {
-		return false, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode == 404 {
-		return false, nil
-	}
-	if resp.StatusCode != 200 {
-		return false, fmt.Errorf("Unexpected HTTP error code %d", resp.StatusCode)
-	}
-	if resp.Header.Get("Content-Type") != "application/x-pem-file" {
-		return false, fmt.Errorf("Unexpected content type %s", resp.Header.Get("Content-Type"))
-	}
-	// write response
-	file, err := os.Create(filePath)
-	if err != nil {
-		return false, err
-	}
-	defer file.Close()
-	written, err := io.Copy(file, resp.Body)
-	switch {
-	case err != nil:
-		return false, err
-	case resp.ContentLength != written && resp.ContentLength != -1:
-		return false, fmt.Errorf("Short read (%d bytes) from server while writing certificate", written)
-	default:
-		return true, nil
-	}
-}
-
-func putSuccess(client *http.Client, certURL string) {
-	// indicate success to the relay server
-	req, err := http.NewRequest("PUT", certURL+"/ok", nil)
-	if err != nil {
-		logger.WithError(err).Error("HTTP request error")
-		return
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		logger.WithError(err).Error("HTTP error")
-		return
-	}
-	resp.Body.Close()
-	if resp.StatusCode != 200 {
-		logger.Errorf("Unexpected HTTP error code %d", resp.StatusCode)
-	}
-}
@@ -2,48 +2,47 @@ package main

 import (
 	"fmt"
-	"io/ioutil"
-	"os"
-	"runtime/trace"
-	"sync"
-	"syscall"
+	"strings"
 	"time"

-	"github.com/cloudflare/cloudflared/cmd/sqlgateway"
-	"github.com/cloudflare/cloudflared/hello"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/access"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/tunnel"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
+	"github.com/cloudflare/cloudflared/log"
 	"github.com/cloudflare/cloudflared/metrics"
-	"github.com/cloudflare/cloudflared/origin"
-	"github.com/cloudflare/cloudflared/tunneldns"
-
-	"golang.org/x/crypto/ssh/terminal"

 	"github.com/getsentry/raven-go"
 	"github.com/mitchellh/go-homedir"
 	"gopkg.in/urfave/cli.v2"
-	"gopkg.in/urfave/cli.v2/altsrc"

-	"github.com/coreos/go-systemd/daemon"
-	"github.com/facebookgo/grace/gracenet"
 	"github.com/pkg/errors"
 )

 const (
-	sentryDSN       = "https://56a9c9fa5c364ab28f34b14f35ea0f1b:3e8827f6f9f740738eb11138f7bebb68@sentry.io/189878"
 	developerPortal = "https://developers.cloudflare.com/argo-tunnel"
-	quickStartUrl   = developerPortal + "/quickstart/quickstart/"
-	serviceUrl      = developerPortal + "/reference/service/"
-	argumentsUrl    = developerPortal + "/reference/arguments/"
-	licenseUrl      = developerPortal + "/licence/"
+	licenseUrl      = developerPortal + "/license/"
+	versionText     = "Print the version"
 )

 var (
 	Version   = "DEV"
 	BuildTime = "unknown"
+	logger    = log.CreateLogger()
+	// Mostly network errors that we don't want reported back to Sentry, this is done by substring match.
+	ignoredErrors = []string{
+		"connection reset by peer",
+		"An existing connection was forcibly closed by the remote host.",
+		"use of closed connection",
+		"You need to enable Argo Smart Routing",
+		"3001 connection closed",
+		"3002 connection dropped",
+		"rpc exception: dial tcp",
+		"rpc exception: EOF",
+	}
 )

 func main() {
 	metrics.RegisterBuildInfo(BuildTime, Version)
-	raven.SetDSN(sentryDSN)
 	raven.SetRelease(Version)

 	// Force shutdown channel used by the app. When closed, app must terminate.
@@ -53,590 +52,83 @@ func main() {
 	// Windows service manager closes this channel when it receives stop command.
 	graceShutdownC := make(chan struct{})

+	cli.VersionFlag = &cli.BoolFlag{
+		Name:    "version",
+		Aliases: []string{"v", "V"},
+		Usage:   versionText,
+	}
+
 	app := &cli.App{}
 	app.Name = "cloudflared"
+	app.Usage = "Cloudflare's command-line tool and agent"
+	app.ArgsUsage = "origin-url"
 	app.Copyright = fmt.Sprintf(`(c) %d Cloudflare Inc.
   Use is subject to the license agreement at %s`, time.Now().Year(), licenseUrl)
-	app.Usage = "Cloudflare reverse tunnelling proxy agent"
-	app.ArgsUsage = "origin-url"
 	app.Version = fmt.Sprintf("%s (built %s)", Version, BuildTime)
-	app.Description = `A reverse tunnel proxy agent that connects to Cloudflare's infrastructure.
-   Upon connecting, you are assigned a unique subdomain on cftunnel.com.
-   You need to specify a hostname on a zone you control.
-   A DNS record will be created to CNAME your hostname to the unique subdomain on cftunnel.com.
+	app.Description = `cloudflared connects your machine or user identity to Cloudflare's global network. 
+	You can use it to authenticate a session to reach an API behind Access, route web traffic to this machine,
+	and configure access control.`
+	app.Flags = flags()
+	app.Action = action(Version, shutdownC, graceShutdownC)
+	app.Before = tunnel.Before
+	app.Commands = commands(cli.ShowVersion)

-   Requests made to Cloudflare's servers for your hostname will be proxied
-   through the tunnel to your local webserver.`
-	app.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:  "config",
-			Usage: "Specifies a config file in YAML format.",
-			Value: findDefaultConfigPath(),
-		},
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:  "autoupdate-freq",
-			Usage: "Autoupdate frequency. Default is 24h.",
-			Value: time.Hour * 24,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:  "no-autoupdate",
-			Usage: "Disable periodic check for updates, restarting the server with the new version.",
-			Value: false,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:   "is-autoupdated",
-			Usage:  "Signal the new process that Argo Tunnel client has been autoupdated",
-			Value:  false,
-			Hidden: true,
-		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "edge",
-			Usage:   "Address of the Cloudflare tunnel server.",
-			EnvVars: []string{"TUNNEL_EDGE"},
-			Hidden:  true,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "cacert",
-			Usage:   "Certificate Authority authenticating the Cloudflare tunnel connection.",
-			EnvVars: []string{"TUNNEL_CACERT"},
-			Hidden:  true,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "no-tls-verify",
-			Usage:   "Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. Note: The connection from your machine to Cloudflare's Edge is still encrypted.",
-			EnvVars: []string{"NO_TLS_VERIFY"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "origincert",
-			Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
-			EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
-			Value:   findDefaultOriginCertPath(),
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "origin-ca-pool",
-			Usage:   "Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.",
-			EnvVars: []string{"TUNNEL_ORIGIN_CA_POOL"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "url",
-			Value:   "https://localhost:8080",
-			Usage:   "Connect to the local webserver at `URL`.",
-			EnvVars: []string{"TUNNEL_URL"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "hostname",
-			Usage:   "Set a hostname on a Cloudflare zone to route traffic through this tunnel.",
-			EnvVars: []string{"TUNNEL_HOSTNAME"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "origin-server-name",
-			Usage:   "Hostname on the origin server certificate.",
-			EnvVars: []string{"TUNNEL_ORIGIN_SERVER_NAME"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "id",
-			Usage:   "A unique identifier used to tie connections to this tunnel instance.",
-			EnvVars: []string{"TUNNEL_ID"},
-			Hidden:  true,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "lb-pool",
-			Usage:   "The name of a (new/existing) load balancing pool to add this origin to.",
-			EnvVars: []string{"TUNNEL_LB_POOL"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "api-key",
-			Usage:   "This parameter has been deprecated since version 2017.10.1.",
-			EnvVars: []string{"TUNNEL_API_KEY"},
-			Hidden:  true,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "api-email",
-			Usage:   "This parameter has been deprecated since version 2017.10.1.",
-			EnvVars: []string{"TUNNEL_API_EMAIL"},
-			Hidden:  true,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "api-ca-key",
-			Usage:   "This parameter has been deprecated since version 2017.10.1.",
-			EnvVars: []string{"TUNNEL_API_CA_KEY"},
-			Hidden:  true,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "metrics",
-			Value:   "localhost:",
-			Usage:   "Listen address for metrics reporting.",
-			EnvVars: []string{"TUNNEL_METRICS"},
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:    "metrics-update-freq",
-			Usage:   "Frequency to update tunnel metrics",
-			Value:   time.Second * 5,
-			EnvVars: []string{"TUNNEL_METRICS_UPDATE_FREQ"},
-		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "tag",
-			Usage:   "Custom tags used to identify this tunnel, in format `KEY=VALUE`. Multiple tags may be specified",
-			EnvVars: []string{"TUNNEL_TAG"},
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   "heartbeat-interval",
-			Usage:  "Minimum idle time before sending a heartbeat.",
-			Value:  time.Second * 5,
-			Hidden: true,
-		}),
-		altsrc.NewUint64Flag(&cli.Uint64Flag{
-			Name:   "heartbeat-count",
-			Usage:  "Minimum number of unacked heartbeats to send before closing the connection.",
-			Value:  5,
-			Hidden: true,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "loglevel",
-			Value:   "info",
-			Usage:   "Application logging level {panic, fatal, error, warn, info, debug}",
-			EnvVars: []string{"TUNNEL_LOGLEVEL"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "proto-loglevel",
-			Value:   "warn",
-			Usage:   "Protocol logging level {panic, fatal, error, warn, info, debug}",
-			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL"},
-		}),
-		altsrc.NewUintFlag(&cli.UintFlag{
-			Name:    "retries",
-			Value:   5,
-			Usage:   "Maximum number of retries for connection/protocol errors.",
-			EnvVars: []string{"TUNNEL_RETRIES"},
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "hello-world",
-			Value:   false,
-			Usage:   "Run Hello World Server",
-			EnvVars: []string{"TUNNEL_HELLO_WORLD"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "pidfile",
-			Usage:   "Write the application's PID to this file after first successful connection.",
-			EnvVars: []string{"TUNNEL_PIDFILE"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "logfile",
-			Usage:   "Save application log to this file for reporting issues.",
-			EnvVars: []string{"TUNNEL_LOGFILE"},
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:   "ha-connections",
-			Value:  4,
-			Hidden: true,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:  "proxy-connect-timeout",
-			Usage: "HTTP proxy timeout for establishing a new connection",
-			Value: time.Second * 30,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:  "proxy-tls-timeout",
-			Usage: "HTTP proxy timeout for completing a TLS handshake",
-			Value: time.Second * 10,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:  "proxy-tcp-keepalive",
-			Usage: "HTTP proxy TCP keepalive duration",
-			Value: time.Second * 30,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:  "proxy-no-happy-eyeballs",
-			Usage: "HTTP proxy should disable \"happy eyeballs\" for IPv4/v6 fallback",
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:  "proxy-keepalive-connections",
-			Usage: "HTTP proxy maximum keepalive connection pool size",
-			Value: 100,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:  "proxy-keepalive-timeout",
-			Usage: "HTTP proxy timeout for closing an idle connection",
-			Value: time.Second * 90,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "proxy-dns",
-			Usage:   "Run a DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS"},
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:    "proxy-dns-port",
-			Value:   53,
-			Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS_PORT"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "proxy-dns-address",
-			Usage:   "Listen address for the DNS over HTTPS proxy server.",
-			Value:   "localhost",
-			EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
-		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "proxy-dns-upstream",
-			Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-			Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:    "grace-period",
-			Usage:   "Duration to accept new requests after cloudflared receives first SIGINT/SIGTERM. A second SIGINT/SIGTERM will force cloudflared to shutdown immediately.",
-			Value:   time.Second * 30,
-			EnvVars: []string{"TUNNEL_GRACE_PERIOD"},
-			Hidden:  true,
-		}),
-		altsrc.NewUintFlag(&cli.UintFlag{
-			Name:    "compression-quality",
-			Value:   0,
-			Usage:   "Use cross-stream compression instead HTTP compression. 0-off, 1-low, 2-medium, >=3-high",
-			EnvVars: []string{"TUNNEL_COMPRESSION_LEVEL"},
-			Hidden:  true,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "no-chunked-encoding",
-			Usage:   "Disables chunked transfer encoding; useful if you are running a WSGI server.",
-			EnvVars: []string{"TUNNEL_NO_CHUNKED_ENCODING"},
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "trace-output",
-			Usage:   "Name of trace output file, generated when cloudflared stops.",
-			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
-		}),
-	}
-	app.Action = func(c *cli.Context) (err error) {
-		tags := make(map[string]string)
-		tags["hostname"] = c.String("hostname")
-		raven.SetTagsContext(tags)
-		raven.CapturePanic(func() { err = startServer(c, shutdownC, graceShutdownC) }, nil)
-		if err != nil {
-			raven.CaptureError(err, nil)
-		}
-		return err
-	}
-	app.Before = func(context *cli.Context) error {
-		if context.String("config") == "" {
-			logger.Warnf("Cannot determine default configuration path. No file %v in %v", defaultConfigFiles, defaultConfigDirs)
-		}
-		inputSource, err := findInputSourceContext(context)
-		if err != nil {
-			logger.WithError(err).Infof("Cannot load configuration from %s", context.String("config"))
-			return err
-		} else if inputSource != nil {
-			err := altsrc.ApplyInputSourceValues(context, inputSource, app.Flags)
-			if err != nil {
-				logger.WithError(err).Infof("Cannot apply configuration from %s", context.String("config"))
-				return err
-			}
-			logger.Infof("Applied configuration from %s", context.String("config"))
-		}
-		return nil
-	}
-	app.Commands = []*cli.Command{
-		{
-			Name:      "update",
-			Action:    update,
-			Usage:     "Update the agent if a new version exists",
-			ArgsUsage: " ",
-			Description: `Looks for a new version on the offical download server.
-   If a new version exists, updates the agent binary and quits.
-   Otherwise, does nothing.
-
-   To determine if an update happened in a script, check for error code 64.`,
-		},
-		{
-			Name:      "login",
-			Action:    login,
-			Usage:     "Generate a configuration file with your login details",
-			ArgsUsage: " ",
-			Flags: []cli.Flag{
-				&cli.StringFlag{
-					Name:   "url",
-					Hidden: true,
-				},
-			},
-		},
-		{
-			Name:   "hello",
-			Action: helloWorld,
-			Usage:  "Run a simple \"Hello World\" server for testing Argo Tunnel.",
-			Flags: []cli.Flag{
-				&cli.IntFlag{
-					Name:  "port",
-					Usage: "Listen on the selected port.",
-					Value: 8080,
-				},
-			},
-			ArgsUsage: " ", // can't be the empty string or we get the default output
-		},
-		{
-			Name:   "proxy-dns",
-			Action: tunneldns.Run,
-			Usage:  "Run a DNS over HTTPS proxy server.",
-			Flags: []cli.Flag{
-				&cli.StringFlag{
-					Name:    "metrics",
-					Value:   "localhost:",
-					Usage:   "Listen address for metrics reporting.",
-					EnvVars: []string{"TUNNEL_METRICS"},
-				},
-				&cli.StringFlag{
-					Name:    "address",
-					Usage:   "Listen address for the DNS over HTTPS proxy server.",
-					Value:   "localhost",
-					EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
-				},
-				&cli.IntFlag{
-					Name:    "port",
-					Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-					Value:   53,
-					EnvVars: []string{"TUNNEL_DNS_PORT"},
-				},
-				&cli.StringSliceFlag{
-					Name:    "upstream",
-					Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-					Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-					EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
-				},
-			},
-			ArgsUsage: " ", // can't be the empty string or we get the default output
-		},
-		{
-			Name: "db",
-			Action: func(c *cli.Context) error {
-				tags := make(map[string]string)
-				tags["hostname"] = c.String("hostname")
-				raven.SetTagsContext(tags)
-
-				fmt.Printf("\nSQL Database Password: ")
-				pass, err := terminal.ReadPassword(int(syscall.Stdin))
-				if err != nil {
-					logger.Error(err)
-				}
-
-				go sqlgateway.StartProxy(c, logger, string(pass))
-
-				raven.CapturePanic(func() { err = startServer(c, shutdownC, graceShutdownC) }, nil)
-				if err != nil {
-					raven.CaptureError(err, nil)
-				}
-				return err
-			},
-			Before: func(c *cli.Context) error {
-				if c.String("config") == "" {
-					logger.Warnf("Cannot determine default configuration path. No file %v in %v", defaultConfigFiles, defaultConfigDirs)
-				}
-				inputSource, err := findInputSourceContext(c)
-				if err != nil {
-					logger.WithError(err).Infof("Cannot load configuration from %s", c.String("config"))
-					return err
-				} else if inputSource != nil {
-					err := altsrc.ApplyInputSourceValues(c, inputSource, app.Flags)
-					if err != nil {
-						logger.WithError(err).Infof("Cannot apply configuration from %s", c.String("config"))
-						return err
-					}
-					logger.Infof("Applied configuration from %s", c.String("config"))
-				}
-				return nil
-			},
-			Usage: "SQL Gateway is an SQL over HTTP reverse proxy",
-			Flags: []cli.Flag{
-				&cli.BoolFlag{
-					Name:  "db",
-					Value: true,
-					Usage: "Enable the SQL Gateway Proxy",
-				},
-				&cli.StringFlag{
-					Name:  "address",
-					Value: "",
-					Usage: "Database connection string: db://user:pass",
-				},
-			},
-		},
-	}
+	tunnel.Init(Version, shutdownC, graceShutdownC) // we need this to support the tunnel sub command...
+	access.Init(shutdownC, graceShutdownC)
 	runApp(app, shutdownC, graceShutdownC)
 }

-func startServer(c *cli.Context, shutdownC, graceShutdownC chan struct{}) error {
-	var wg sync.WaitGroup
-	listeners := gracenet.Net{}
-	errC := make(chan error)
-	connectedSignal := make(chan struct{})
-	dnsReadySignal := make(chan struct{})
+func commands(version func(c *cli.Context)) []*cli.Command {
+	cmds := []*cli.Command{
+		{
+			Name:      "update",
+			Action:    updater.Update,
+			Usage:     "Update the agent if a new version exists",
+			ArgsUsage: " ",
+			Description: `Looks for a new version on the official download server.
+If a new version exists, updates the agent binary and quits.
+Otherwise, does nothing.

-	// check whether client provides enough flags or env variables. If not, print help.
-	if ok := enoughOptionsSet(c); !ok {
-		return nil
+To determine if an update happened in a script, check for error code 64.`,
+		},
+		{
+			Name: "version",
+			Action: func(c *cli.Context) (err error) {
+				version(c)
+				return nil
+			},
+			Usage:       versionText,
+			Description: versionText,
+		},
 	}
+	cmds = append(cmds, tunnel.Commands()...)
+	cmds = append(cmds, access.Commands()...)
+	return cmds
+}

-	if err := configMainLogger(c); err != nil {
-		return errors.Wrap(err, "Error configuring logger")
-	}
+func flags() []cli.Flag {
+	flags := tunnel.Flags()
+	return append(flags, access.Flags()...)
+}

-	protoLogger, err := configProtoLogger(c)
-	if err != nil {
-		return errors.Wrap(err, "Error configuring protocol logger")
-	}
+func isEmptyInvocation(c *cli.Context) bool {
+	return c.NArg() == 0 && c.NumFlags() == 0
+}

-	if c.IsSet("trace-output") {
-		tmpTraceFile, err := ioutil.TempFile("", "trace")
+func action(version string, shutdownC, graceShutdownC chan struct{}) cli.ActionFunc {
+	return func(c *cli.Context) (err error) {
+		if isEmptyInvocation(c) {
+			cli.ShowAppHelpAndExit(c, 1)
+		}
+		tags := make(map[string]string)
+		tags["hostname"] = c.String("hostname")
+		raven.SetTagsContext(tags)
+		raven.CapturePanic(func() { err = tunnel.StartServer(c, version, shutdownC, graceShutdownC) }, nil)
 		if err != nil {
-			logger.WithError(err).Error("Failed to create new temporary file to save trace output")
+			handleError(err)
 		}
-
-		defer func() {
-			if err := tmpTraceFile.Close(); err != nil {
-				logger.WithError(err).Error("Failed to close trace output file %s", tmpTraceFile.Name())
-			}
-			if err := os.Rename(tmpTraceFile.Name(), c.String("trace-output")); err != nil {
-				logger.WithError(err).Errorf("Failed to rename temporary trace output file %s to %s", tmpTraceFile.Name(), c.String("trace-output"))
-			} else {
-				os.Remove(tmpTraceFile.Name())
-			}
-		}()
-
-		if err := trace.Start(tmpTraceFile); err != nil {
-			logger.WithError(err).Error("Failed to start trace")
-			return errors.Wrap(err, "Error starting tracing")
-		}
-		defer trace.Stop()
-	}
-
-	if c.String("logfile") != "" {
-		if err := initLogFile(c, logger, protoLogger); err != nil {
-			logger.Error(err)
-		}
-	}
-
-	if err := handleDeprecatedOptions(c); err != nil {
 		return err
 	}
-
-	buildInfo := origin.GetBuildInfo()
-	logger.Infof("Build info: %+v", *buildInfo)
-	logger.Infof("Version %s", Version)
-	logClientOptions(c)
-
-	if c.IsSet("proxy-dns") {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			errC <- runDNSProxyServer(c, dnsReadySignal, shutdownC)
-		}()
-	} else {
-		close(dnsReadySignal)
-	}
-
-	// Wait for proxy-dns to come up (if used)
-	<-dnsReadySignal
-
-	// update needs to be after DNS proxy is up to resolve equinox server address
-	if isAutoupdateEnabled(c) {
-		logger.Infof("Autoupdate frequency is set to %v", c.Duration("autoupdate-freq"))
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			errC <- autoupdate(c.Duration("autoupdate-freq"), &listeners, shutdownC)
-		}()
-	}
-
-	metricsListener, err := listeners.Listen("tcp", c.String("metrics"))
-	if err != nil {
-		logger.WithError(err).Error("Error opening metrics server listener")
-		return errors.Wrap(err, "Error opening metrics server listener")
-	}
-	defer metricsListener.Close()
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		errC <- metrics.ServeMetrics(metricsListener, shutdownC, logger)
-	}()
-
-	go notifySystemd(connectedSignal)
-	if c.IsSet("pidfile") {
-		go writePidFile(connectedSignal, c.String("pidfile"))
-	}
-
-	// Serve DNS proxy stand-alone if no hostname or tag or app is going to run
-	if dnsProxyStandAlone(c) {
-		close(connectedSignal)
-		// no grace period, handle SIGINT/SIGTERM immediately
-		return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, 0)
-	}
-
-	if c.IsSet("hello-world") {
-		helloListener, err := hello.CreateTLSListener("127.0.0.1:")
-		if err != nil {
-			logger.WithError(err).Error("Cannot start Hello World Server")
-			return errors.Wrap(err, "Cannot start Hello World Server")
-		}
-		defer helloListener.Close()
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			hello.StartHelloWorldServer(logger, helloListener, shutdownC)
-		}()
-		c.Set("url", "https://"+helloListener.Addr().String())
-	}
-
-	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, logger, protoLogger)
-	if err != nil {
-		return err
-	}
-
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		errC <- origin.StartTunnelDaemon(tunnelConfig, graceShutdownC, connectedSignal)
-	}()
-
-	return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, c.Duration("grace-period"))
-}
-
-func waitToShutdown(wg *sync.WaitGroup,
-	errC chan error,
-	shutdownC, graceShutdownC chan struct{},
-	gracePeriod time.Duration,
-) error {
-	var err error
-	if gracePeriod > 0 {
-		err = waitForSignalWithGraceShutdown(errC, shutdownC, graceShutdownC, gracePeriod)
-	} else {
-		err = waitForSignal(errC, shutdownC)
-		close(graceShutdownC)
-	}
-
-	if err != nil {
-		logger.WithError(err).Error("Quitting due to error")
-	} else {
-		logger.Info("Quitting...")
-	}
-	// Wait for clean exit, discarding all errors
-	go func() {
-		for range errC {
-		}
-	}()
-	wg.Wait()
-	return err
-}
-
-func notifySystemd(waitForSignal chan struct{}) {
-	<-waitForSignal
-	daemon.SdNotify(false, "READY=1")
-}
-
-func writePidFile(waitForSignal chan struct{}, pidFile string) {
-	<-waitForSignal
-	file, err := os.Create(pidFile)
-	if err != nil {
-		logger.WithError(err).Errorf("Unable to write pid to %s", pidFile)
-	}
-	defer file.Close()
-	fmt.Fprintf(file, "%d", os.Getpid())
 }

 func userHomeDir() (string, error) {
@@ -651,3 +143,14 @@ func userHomeDir() (string, error) {
 	}
 	return homeDir, nil
 }
+
+// In order to keep the amount of noise sent to Sentry low, typical network errors can be filtered out here by a substring match.
+func handleError(err error) {
+	errorMessage := err.Error()
+	for _, ignoredErrorMessage := range ignoredErrors {
+		if strings.Contains(errorMessage, ignoredErrorMessage) {
+			return
+		}
+	}
+	raven.CaptureError(err, nil)
+}
@@ -8,9 +8,9 @@ import (
 	"io/ioutil"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"text/template"

+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/mitchellh/go-homedir"
 )

@@ -94,9 +94,9 @@ func runCommand(command string, args ...string) error {
 }

 func ensureConfigDirExists(configDir string) error {
-	ok, err := fileExists(configDir)
+	ok, err := config.FileExists(configDir)
 	if !ok && err == nil {
-		err = os.Mkdir(configDir, 0700)
+		err = os.Mkdir(configDir, 0755)
 	}
 	return err
 }
@@ -119,8 +119,7 @@ func openFile(path string, create bool) (file *os.File, exists bool, err error)
 	return file, false, err
 }

-func copyCertificate(srcConfigDir, destConfigDir, credentialFile string) error {
-	destCredentialPath := filepath.Join(destConfigDir, credentialFile)
+func copyCredential(srcCredentialPath, destCredentialPath string) error {
 	destFile, exists, err := openFile(destCredentialPath, true)
 	if err != nil {
 		return err
@@ -130,7 +129,6 @@ func copyCertificate(srcConfigDir, destConfigDir, credentialFile string) error {
 	}
 	defer destFile.Close()

-	srcCredentialPath := filepath.Join(srcConfigDir, credentialFile)
 	srcFile, _, err := openFile(srcCredentialPath, false)
 	if err != nil {
 		return err
@@ -146,17 +144,8 @@ func copyCertificate(srcConfigDir, destConfigDir, credentialFile string) error {
 	return nil
 }

-func copyCredentials(serviceConfigDir, defaultConfigDir, defaultConfigFile, defaultCredentialFile string) error {
-	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
-		return err
-	}
-
-	if err := copyCertificate(defaultConfigDir, serviceConfigDir, defaultCredentialFile); err != nil {
-		return err
-	}
-
+func copyConfig(srcConfigPath, destConfigPath string) error {
 	// Copy or create config
-	destConfigPath := filepath.Join(serviceConfigDir, defaultConfigFile)
 	destFile, exists, err := openFile(destConfigPath, true)
 	if err != nil {
 		logger.WithError(err).Infof("cannot open %s", destConfigPath)
@@ -167,7 +156,6 @@ func copyCredentials(serviceConfigDir, defaultConfigDir, defaultConfigFile, defa
 	}
 	defer destFile.Close()

-	srcConfigPath := filepath.Join(defaultConfigDir, defaultConfigFile)
 	srcFile, _, err := openFile(srcConfigPath, false)
 	if err != nil {
 		fmt.Println("Your service needs a config file that at least specifies the hostname option.")
@@ -0,0 +1,47 @@
+package shell
+
+import (
+	"io"
+	"os"
+	"os/exec"
+	"runtime"
+)
+
+// OpenBrowser opens the specified URL in the default browser of the user
+func OpenBrowser(url string) error {
+	var cmd string
+	var args []string
+
+	switch runtime.GOOS {
+	case "windows":
+		cmd = "cmd"
+		args = []string{"/c", "start"}
+	case "darwin":
+		cmd = "open"
+	default: // "linux", "freebsd", "openbsd", "netbsd"
+		cmd = "xdg-open"
+	}
+	args = append(args, url)
+	return exec.Command(cmd, args...).Start()
+}
+
+// Run will kick off a shell task and pipe the results to the respective std pipes
+func Run(cmd string, args ...string) error {
+	c := exec.Command(cmd, args...)
+	stderr, err := c.StderrPipe()
+	if err != nil {
+		return err
+	}
+	go func() {
+		io.Copy(os.Stderr, stderr)
+	}()
+
+	stdout, err := c.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	go func() {
+		io.Copy(os.Stdout, stdout)
+	}()
+	return c.Run()
+}
@@ -0,0 +1,88 @@
+package token
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/transfer"
+	"github.com/cloudflare/cloudflared/log"
+	"github.com/coreos/go-oidc/jose"
+	"github.com/coreos/go-oidc/oidc"
+	homedir "github.com/mitchellh/go-homedir"
+)
+
+var logger = log.CreateLogger()
+
+// FetchToken will either load a stored token or generate a new one
+func FetchToken(appURL *url.URL) (string, error) {
+	if token, err := GetTokenIfExists(appURL); token != "" && err == nil {
+		return token, nil
+	}
+
+	path, err := generateFilePathForTokenURL(appURL)
+	if err != nil {
+		return "", err
+	}
+
+	// this weird parameter is the resource name (token) and the key/value
+	// we want to send to the transfer service. the key is token and the value
+	// is blank (basically just the id generated in the transfer service)
+	const resourceName, key, value = "token", "token", ""
+	token, err := transfer.Run(appURL, resourceName, key, value, path, true)
+	if err != nil {
+		return "", err
+	}
+
+	return string(token), nil
+}
+
+// GetTokenIfExists will return the token from local storage if it exists
+func GetTokenIfExists(url *url.URL) (string, error) {
+	path, err := generateFilePathForTokenURL(url)
+	if err != nil {
+		return "", err
+	}
+	content, err := ioutil.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	token, err := jose.ParseJWT(string(content))
+	if err != nil {
+		return "", err
+	}
+
+	claims, err := token.Claims()
+	if err != nil {
+		return "", err
+	}
+	ident, err := oidc.IdentityFromClaims(claims)
+	// AUTH-1404, reauth if the token is about to expire within 15 minutes
+	if err == nil && ident.ExpiresAt.After(time.Now().Add(time.Minute*15)) {
+		return token.Encode(), nil
+	}
+	return "", err
+}
+
+// generateFilePathForTokenURL will return a filepath for given access application url
+func generateFilePathForTokenURL(url *url.URL) (string, error) {
+	configPath, err := homedir.Expand(config.DefaultConfigDirs[0])
+	if err != nil {
+		return "", err
+	}
+	ok, err := config.FileExists(configPath)
+	if !ok && err == nil {
+		// create config directory if doesn't already exist
+		err = os.Mkdir(configPath, 0700)
+	}
+	if err != nil {
+		return "", err
+	}
+	name := strings.Replace(fmt.Sprintf("%s%s-token", url.Hostname(), url.EscapedPath()), "/", "-", -1)
+	return filepath.Join(configPath, name), nil
+}
@@ -0,0 +1,162 @@
+package transfer
+
+import (
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"os"
+	"time"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/encrypter"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/shell"
+	"github.com/cloudflare/cloudflared/log"
+)
+
+const (
+	baseStoreURL  = "https://login.cloudflarewarp.com/"
+	clientTimeout = time.Second * 60
+)
+
+var logger = log.CreateLogger()
+
+// Run does the transfer "dance" with the end result downloading the supported resource.
+// The expanded description is run is encapsulation of shared business logic needed
+// to request a resource (token/cert/etc) from the transfer service (loginhelper).
+// The "dance" we refer to is building a HTTP request, opening that in a browser waiting for
+// the user to complete an action, while it long polls in the background waiting for an
+// action to be completed to download the resource.
+func Run(transferURL *url.URL, resourceName, key, value, path string, shouldEncrypt bool) ([]byte, error) {
+	encrypterClient, err := encrypter.New("cloudflared_priv.pem", "cloudflared_pub.pem")
+	if err != nil {
+		return nil, err
+	}
+	requestURL, err := buildRequestURL(transferURL, key, value+encrypterClient.PublicKey(), shouldEncrypt)
+	if err != nil {
+		return nil, err
+	}
+
+	// See AUTH-1423 for why we use stderr (the way git wraps ssh)
+	err = shell.OpenBrowser(requestURL)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Please open the following URL and log in with your Cloudflare account:\n\n%s\n\nLeave cloudflared running to download the %s automatically.\n", requestURL, resourceName)
+	} else {
+		fmt.Fprintf(os.Stderr, "A browser window should have opened at the following URL:\n\n%s\n\nIf the browser failed to open, open it yourself and visit the URL above.\n", requestURL)
+	}
+
+	var resourceData []byte
+
+	if shouldEncrypt {
+		buf, key, err := transferRequest(baseStoreURL + "transfer/" + encrypterClient.PublicKey())
+		if err != nil {
+			return nil, err
+		}
+
+		decodedBuf, err := base64.StdEncoding.DecodeString(string(buf))
+		if err != nil {
+			return nil, err
+		}
+		decrypted, err := encrypterClient.Decrypt(decodedBuf, key)
+		if err != nil {
+			return nil, err
+		}
+
+		resourceData = decrypted
+	} else {
+		buf, _, err := transferRequest(baseStoreURL + encrypterClient.PublicKey())
+		if err != nil {
+			return nil, err
+		}
+		resourceData = buf
+	}
+
+	if err := ioutil.WriteFile(path, resourceData, 0600); err != nil {
+		return nil, err
+	}
+
+	return resourceData, nil
+}
+
+// BuildRequestURL creates a request suitable for a resource transfer.
+// it will return a constructed url based off the base url and query key/value provided.
+// cli will build a url for cli transfer request.
+func buildRequestURL(baseURL *url.URL, key, value string, cli bool) (string, error) {
+	q := baseURL.Query()
+	q.Set(key, value)
+	baseURL.RawQuery = q.Encode()
+	if !cli {
+		return baseURL.String(), nil
+	}
+
+	q.Set("redirect_url", baseURL.String()) // we add the token as a query param on both the redirect_url
+	baseURL.RawQuery = q.Encode()           // and this actual baseURL.
+	baseURL.Path = "cdn-cgi/access/cli"
+	return baseURL.String(), nil
+}
+
+// transferRequest downloads the requested resource from the request URL
+func transferRequest(requestURL string) ([]byte, string, error) {
+	client := &http.Client{Timeout: clientTimeout}
+	const pollAttempts = 10
+	// we do "long polling" on the endpoint to get the resource.
+	for i := 0; i < pollAttempts; i++ {
+		buf, key, err := poll(client, requestURL)
+		if err != nil {
+			return nil, "", err
+		} else if len(buf) > 0 {
+			if err := putSuccess(client, requestURL); err != nil {
+				logger.WithError(err).Error("Failed to update resource success")
+			}
+			return buf, key, nil
+		}
+	}
+	return nil, "", errors.New("Failed to fetch resource")
+}
+
+// poll the endpoint for the request resource, waiting for the user interaction
+func poll(client *http.Client, requestURL string) ([]byte, string, error) {
+	resp, err := client.Get(requestURL)
+	if err != nil {
+		return nil, "", err
+	}
+	defer resp.Body.Close()
+
+	// ignore everything other than server errors as the resource
+	// may not exist until the user does the interaction
+	if resp.StatusCode >= 500 {
+		return nil, "", fmt.Errorf("error on request %d", resp.StatusCode)
+	}
+	if resp.StatusCode != 200 {
+		logger.Info("Waiting for login...")
+		return nil, "", nil
+	}
+
+	buf := new(bytes.Buffer)
+	if _, err := io.Copy(buf, resp.Body); err != nil {
+		return nil, "", err
+	}
+	return buf.Bytes(), resp.Header.Get("service-public-key"), nil
+}
+
+// putSuccess tells the server we successfully downloaded the resource
+func putSuccess(client *http.Client, requestURL string) error {
+	req, err := http.NewRequest("PUT", requestURL+"/ok", nil)
+	if err != nil {
+		return err
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+
+	resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return fmt.Errorf("HTTP Response Status Code: %d", resp.StatusCode)
+	}
+	return nil
+}
@@ -0,0 +1,686 @@
+package tunnel
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/url"
+	"os"
+	"runtime/trace"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/getsentry/raven-go"
+	"golang.org/x/crypto/ssh/terminal"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
+	"github.com/cloudflare/cloudflared/cmd/sqlgateway"
+	"github.com/cloudflare/cloudflared/hello"
+	"github.com/cloudflare/cloudflared/metrics"
+	"github.com/cloudflare/cloudflared/origin"
+	"github.com/cloudflare/cloudflared/tunneldns"
+	"github.com/cloudflare/cloudflared/websocket"
+	"github.com/coreos/go-systemd/daemon"
+	"github.com/facebookgo/grace/gracenet"
+	"github.com/pkg/errors"
+	"gopkg.in/urfave/cli.v2"
+	"gopkg.in/urfave/cli.v2/altsrc"
+)
+
+const sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b:3e8827f6f9f740738eb11138f7bebb68@sentry.io/189878"
+
+var (
+	shutdownC      chan struct{}
+	graceShutdownC chan struct{}
+	version        string
+)
+
+func Flags() []cli.Flag {
+	return tunnelFlags(true)
+}
+
+func Commands() []*cli.Command {
+	cmds := []*cli.Command{
+		{
+			Name:      "login",
+			Action:    login,
+			Usage:     "Generate a configuration file with your login details",
+			ArgsUsage: " ",
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name:   "url",
+					Hidden: true,
+				},
+			},
+			Hidden: true,
+		},
+		{
+			Name:   "proxy-dns",
+			Action: tunneldns.Run,
+			Usage:  "Run a DNS over HTTPS proxy server.",
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name:    "metrics",
+					Value:   "localhost:",
+					Usage:   "Listen address for metrics reporting.",
+					EnvVars: []string{"TUNNEL_METRICS"},
+				},
+				&cli.StringFlag{
+					Name:    "address",
+					Usage:   "Listen address for the DNS over HTTPS proxy server.",
+					Value:   "localhost",
+					EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
+				},
+				&cli.IntFlag{
+					Name:    "port",
+					Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
+					Value:   53,
+					EnvVars: []string{"TUNNEL_DNS_PORT"},
+				},
+				&cli.StringSliceFlag{
+					Name:    "upstream",
+					Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
+					Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
+					EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
+				},
+			},
+			ArgsUsage: " ", // can't be the empty string or we get the default output
+			Hidden:    false,
+		},
+		{
+			Name: "db",
+			Action: func(c *cli.Context) error {
+				tags := make(map[string]string)
+				tags["hostname"] = c.String("hostname")
+				raven.SetTagsContext(tags)
+
+				fmt.Printf("\nSQL Database Password: ")
+				pass, err := terminal.ReadPassword(int(syscall.Stdin))
+				if err != nil {
+					logger.Error(err)
+				}
+
+				go sqlgateway.StartProxy(c, logger, string(pass))
+
+				raven.CapturePanic(func() { err = tunnel(c) }, nil)
+				if err != nil {
+					raven.CaptureError(err, nil)
+				}
+				return err
+			},
+			Before: Before,
+			Usage:  "SQL Gateway is an SQL over HTTP reverse proxy",
+			Flags: []cli.Flag{
+				&cli.BoolFlag{
+					Name:  "db",
+					Value: true,
+					Usage: "Enable the SQL Gateway Proxy",
+				},
+				&cli.StringFlag{
+					Name:  "address",
+					Value: "",
+					Usage: "Database connection string: db://user:pass",
+				},
+			},
+			Hidden: true,
+		},
+	}
+
+	var subcommands []*cli.Command
+	for _, cmd := range cmds {
+		c := *cmd
+		c.Hidden = false
+		subcommands = append(subcommands, &c)
+	}
+
+	cmds = append(cmds, &cli.Command{
+		Name:      "tunnel",
+		Action:    tunnel,
+		Before:    Before,
+		Category:  "Tunnel",
+		Usage:     "Make a locally-running web service accessible over the internet using Argo Tunnel.",
+		ArgsUsage: "[origin-url]",
+		Description: `Argo Tunnel asks you to specify a hostname on a Cloudflare-powered
+		domain you control and a local address. Traffic from that hostname is routed
+		(optionally via a Cloudflare Load Balancer) to this machine and appears on the
+		specified port where it can be served.
+
+		This feature requires your Cloudflare account be subscribed to the Argo Smart Routing feature.
+
+		To use, begin by calling login to download a certificate:
+
+		  cloudflared tunnel login
+
+		With your certificate installed you can then launch your first tunnel,
+		replacing my.site.com with a subdomain of your site:
+
+		  cloudflared tunnel --hostname my.site.com --url http://localhost:8080
+
+		If you have a web server running on port 8080 (in this example), it will be available on
+		the internet!`,
+		Subcommands: subcommands,
+		Flags:       tunnelFlags(false),
+	})
+
+	return cmds
+}
+
+func tunnel(c *cli.Context) error {
+	return StartServer(c, version, shutdownC, graceShutdownC)
+}
+
+func Init(v string, s, g chan struct{}) {
+	version, shutdownC, graceShutdownC = v, s, g
+}
+
+func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan struct{}) error {
+	_ = raven.SetDSN(sentryDSN)
+	var wg sync.WaitGroup
+	listeners := gracenet.Net{}
+	errC := make(chan error)
+	connectedSignal := make(chan struct{})
+	dnsReadySignal := make(chan struct{})
+
+	if c.String("config") == "" {
+		logger.Warnf("Cannot determine default configuration path. No file %v in %v", config.DefaultConfigFiles, config.DefaultConfigDirs)
+	}
+
+	if err := configMainLogger(c); err != nil {
+		return errors.Wrap(err, "Error configuring logger")
+	}
+
+	transportLogger, err := configTransportLogger(c)
+	if err != nil {
+		return errors.Wrap(err, "Error configuring transport logger")
+	}
+
+	if c.IsSet("trace-output") {
+		tmpTraceFile, err := ioutil.TempFile("", "trace")
+		if err != nil {
+			logger.WithError(err).Error("Failed to create new temporary file to save trace output")
+		}
+
+		defer func() {
+			if err := tmpTraceFile.Close(); err != nil {
+				logger.WithError(err).Errorf("Failed to close trace output file %s", tmpTraceFile.Name())
+			}
+			if err := os.Rename(tmpTraceFile.Name(), c.String("trace-output")); err != nil {
+				logger.WithError(err).Errorf("Failed to rename temporary trace output file %s to %s", tmpTraceFile.Name(), c.String("trace-output"))
+			} else {
+				err := os.Remove(tmpTraceFile.Name())
+				if err != nil {
+					logger.WithError(err).Errorf("Failed to remove the temporary trace file %s", tmpTraceFile.Name())
+				}
+			}
+		}()
+
+		if err := trace.Start(tmpTraceFile); err != nil {
+			logger.WithError(err).Error("Failed to start trace")
+			return errors.Wrap(err, "Error starting tracing")
+		}
+		defer trace.Stop()
+	}
+
+	if c.String("logfile") != "" {
+		if err := initLogFile(c, logger, transportLogger); err != nil {
+			logger.Error(err)
+		}
+	}
+
+	if err := handleDeprecatedOptions(c); err != nil {
+		return err
+	}
+
+	buildInfo := origin.GetBuildInfo()
+	logger.Infof("Build info: %+v", *buildInfo)
+	logger.Infof("Version %s", version)
+	logClientOptions(c)
+
+	if c.IsSet("proxy-dns") {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errC <- runDNSProxyServer(c, dnsReadySignal, shutdownC)
+		}()
+	} else {
+		close(dnsReadySignal)
+	}
+
+	// Wait for proxy-dns to come up (if used)
+	<-dnsReadySignal
+
+	// update needs to be after DNS proxy is up to resolve equinox server address
+	if updater.IsAutoupdateEnabled(c) {
+		logger.Infof("Autoupdate frequency is set to %v", c.Duration("autoupdate-freq"))
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errC <- updater.Autoupdate(c.Duration("autoupdate-freq"), &listeners, shutdownC)
+		}()
+	}
+
+	metricsListener, err := listeners.Listen("tcp", c.String("metrics"))
+	if err != nil {
+		logger.WithError(err).Error("Error opening metrics server listener")
+		return errors.Wrap(err, "Error opening metrics server listener")
+	}
+	defer metricsListener.Close()
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		errC <- metrics.ServeMetrics(metricsListener, shutdownC, logger)
+	}()
+
+	go notifySystemd(connectedSignal)
+	if c.IsSet("pidfile") {
+		go writePidFile(connectedSignal, c.String("pidfile"))
+	}
+
+	// Serve DNS proxy stand-alone if no hostname or tag or app is going to run
+	if dnsProxyStandAlone(c) {
+		close(connectedSignal)
+		// no grace period, handle SIGINT/SIGTERM immediately
+		return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, 0)
+	}
+
+	if c.IsSet("hello-world") {
+		helloListener, err := hello.CreateTLSListener("127.0.0.1:")
+		if err != nil {
+			logger.WithError(err).Error("Cannot start Hello World Server")
+			return errors.Wrap(err, "Cannot start Hello World Server")
+		}
+		defer helloListener.Close()
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			hello.StartHelloWorldServer(logger, helloListener, shutdownC)
+		}()
+		c.Set("url", "https://"+helloListener.Addr().String())
+	}
+
+	if host := hostnameFromURI(c.String("url")); host != "" {
+		listener, err := net.Listen("tcp", "127.0.0.1:")
+		if err != nil {
+			logger.WithError(err).Error("Cannot start Websocket Proxy Server")
+			return errors.Wrap(err, "Cannot start Websocket Proxy Server")
+		}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errC <- websocket.StartProxyServer(logger, listener, host, shutdownC)
+		}()
+		c.Set("url", "http://"+listener.Addr().String())
+	}
+
+	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, version, logger, transportLogger)
+	if err != nil {
+		return err
+	}
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		errC <- origin.StartTunnelDaemon(tunnelConfig, graceShutdownC, connectedSignal)
+	}()
+
+	return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, c.Duration("grace-period"))
+}
+
+func Before(c *cli.Context) error {
+	if c.String("config") == "" {
+		logger.Debugf("Cannot determine default configuration path. No file %v in %v", config.DefaultConfigFiles, config.DefaultConfigDirs)
+	}
+	inputSource, err := config.FindInputSourceContext(c)
+	if err != nil {
+		logger.WithError(err).Errorf("Cannot load configuration from %s", c.String("config"))
+		return err
+	} else if inputSource != nil {
+		err := altsrc.ApplyInputSourceValues(c, inputSource, c.App.Flags)
+		if err != nil {
+			logger.WithError(err).Errorf("Cannot apply configuration from %s", c.String("config"))
+			return err
+		}
+		logger.Debugf("Applied configuration from %s", c.String("config"))
+	}
+	return nil
+}
+
+func waitToShutdown(wg *sync.WaitGroup,
+	errC chan error,
+	shutdownC, graceShutdownC chan struct{},
+	gracePeriod time.Duration,
+) error {
+	var err error
+	if gracePeriod > 0 {
+		err = waitForSignalWithGraceShutdown(errC, shutdownC, graceShutdownC, gracePeriod)
+	} else {
+		err = waitForSignal(errC, shutdownC)
+		close(graceShutdownC)
+	}
+
+	if err != nil {
+		logger.WithError(err).Error("Quitting due to error")
+	} else {
+		logger.Info("Quitting...")
+	}
+	// Wait for clean exit, discarding all errors
+	go func() {
+		for range errC {
+		}
+	}()
+	wg.Wait()
+	return err
+}
+
+func notifySystemd(waitForSignal chan struct{}) {
+	<-waitForSignal
+	daemon.SdNotify(false, "READY=1")
+}
+
+func writePidFile(waitForSignal chan struct{}, pidFile string) {
+	<-waitForSignal
+	file, err := os.Create(pidFile)
+	if err != nil {
+		logger.WithError(err).Errorf("Unable to write pid to %s", pidFile)
+	}
+	defer file.Close()
+	fmt.Fprintf(file, "%d", os.Getpid())
+}
+
+func hostnameFromURI(uri string) string {
+	u, err := url.Parse(uri)
+	if err != nil {
+		return ""
+	}
+	switch u.Scheme {
+	case "ssh":
+		return addPortIfMissing(u, 22)
+	case "rdp":
+		return addPortIfMissing(u, 3389)
+	}
+	return ""
+}
+
+func addPortIfMissing(uri *url.URL, port int) string {
+	if uri.Port() != "" {
+		return uri.Host
+	}
+	return fmt.Sprintf("%s:%d", uri.Hostname(), port)
+}
+
+func tunnelFlags(shouldHide bool) []cli.Flag {
+	return []cli.Flag{
+		&cli.StringFlag{
+			Name:   "config",
+			Usage:  "Specifies a config file in YAML format.",
+			Value:  config.FindDefaultConfigPath(),
+			Hidden: shouldHide,
+		},
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "autoupdate-freq",
+			Usage:  "Autoupdate frequency. Default is 24h.",
+			Value:  time.Hour * 24,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:   "no-autoupdate",
+			Usage:  "Disable periodic check for updates, restarting the server with the new version.",
+			Value:  false,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:   "is-autoupdated",
+			Usage:  "Signal the new process that Argo Tunnel client has been autoupdated",
+			Value:  false,
+			Hidden: true,
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name:    "edge",
+			Usage:   "Address of the Cloudflare tunnel server.",
+			EnvVars: []string{"TUNNEL_EDGE"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "cacert",
+			Usage:   "Certificate Authority authenticating connections with Cloudflare's edge network.",
+			EnvVars: []string{"TUNNEL_CACERT"},
+			Hidden:  true,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "no-tls-verify",
+			Usage:   "Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. Note: The connection from your machine to Cloudflare's Edge is still encrypted.",
+			EnvVars: []string{"NO_TLS_VERIFY"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "origincert",
+			Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
+			EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
+			Value:   findDefaultOriginCertPath(),
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "origin-ca-pool",
+			Usage:   "Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.",
+			EnvVars: []string{"TUNNEL_ORIGIN_CA_POOL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "url",
+			Value:   "http://localhost:8080",
+			Usage:   "Connect to the local webserver at `URL`.",
+			EnvVars: []string{"TUNNEL_URL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "hostname",
+			Usage:   "Set a hostname on a Cloudflare zone to route traffic through this tunnel.",
+			EnvVars: []string{"TUNNEL_HOSTNAME"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "origin-server-name",
+			Usage:   "Hostname on the origin server certificate.",
+			EnvVars: []string{"TUNNEL_ORIGIN_SERVER_NAME"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "id",
+			Usage:   "A unique identifier used to tie connections to this tunnel instance.",
+			EnvVars: []string{"TUNNEL_ID"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "lb-pool",
+			Usage:   "The name of a (new/existing) load balancing pool to add this origin to.",
+			EnvVars: []string{"TUNNEL_LB_POOL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "api-key",
+			Usage:   "This parameter has been deprecated since version 2017.10.1.",
+			EnvVars: []string{"TUNNEL_API_KEY"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "api-email",
+			Usage:   "This parameter has been deprecated since version 2017.10.1.",
+			EnvVars: []string{"TUNNEL_API_EMAIL"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "api-ca-key",
+			Usage:   "This parameter has been deprecated since version 2017.10.1.",
+			EnvVars: []string{"TUNNEL_API_CA_KEY"},
+			Hidden:  true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "metrics",
+			Value:   "localhost:",
+			Usage:   "Listen address for metrics reporting.",
+			EnvVars: []string{"TUNNEL_METRICS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:    "metrics-update-freq",
+			Usage:   "Frequency to update tunnel metrics",
+			Value:   time.Second * 5,
+			EnvVars: []string{"TUNNEL_METRICS_UPDATE_FREQ"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name:    "tag",
+			Usage:   "Custom tags used to identify this tunnel, in format `KEY=VALUE`. Multiple tags may be specified",
+			EnvVars: []string{"TUNNEL_TAG"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "heartbeat-interval",
+			Usage:  "Minimum idle time before sending a heartbeat.",
+			Value:  time.Second * 5,
+			Hidden: true,
+		}),
+		altsrc.NewUint64Flag(&cli.Uint64Flag{
+			Name:   "heartbeat-count",
+			Usage:  "Minimum number of unacked heartbeats to send before closing the connection.",
+			Value:  5,
+			Hidden: true,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "loglevel",
+			Value:   "info",
+			Usage:   "Application logging level {panic, fatal, error, warn, info, debug}. " + debugLevelWarning,
+			EnvVars: []string{"TUNNEL_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "transport-loglevel",
+			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
+			Value:   "warn",
+			Usage:   "Transport logging level(previously called protocol logging level) {panic, fatal, error, warn, info, debug}",
+			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewUintFlag(&cli.UintFlag{
+			Name:    "retries",
+			Value:   5,
+			Usage:   "Maximum number of retries for connection/protocol errors.",
+			EnvVars: []string{"TUNNEL_RETRIES"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "hello-world",
+			Value:   false,
+			Usage:   "Run Hello World Server",
+			EnvVars: []string{"TUNNEL_HELLO_WORLD"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "pidfile",
+			Usage:   "Write the application's PID to this file after first successful connection.",
+			EnvVars: []string{"TUNNEL_PIDFILE"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "logfile",
+			Usage:   "Save application log to this file for reporting issues.",
+			EnvVars: []string{"TUNNEL_LOGFILE"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:   "ha-connections",
+			Value:  4,
+			Hidden: true,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-connect-timeout",
+			Usage:  "HTTP proxy timeout for establishing a new connection",
+			Value:  time.Second * 30,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-tls-timeout",
+			Usage:  "HTTP proxy timeout for completing a TLS handshake",
+			Value:  time.Second * 10,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-tcp-keepalive",
+			Usage:  "HTTP proxy TCP keepalive duration",
+			Value:  time.Second * 30,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:   "proxy-no-happy-eyeballs",
+			Usage:  "HTTP proxy should disable \"happy eyeballs\" for IPv4/v6 fallback",
+			Hidden: shouldHide,
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:   "proxy-keepalive-connections",
+			Usage:  "HTTP proxy maximum keepalive connection pool size",
+			Value:  100,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-keepalive-timeout",
+			Usage:  "HTTP proxy timeout for closing an idle connection",
+			Value:  time.Second * 90,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "proxy-dns",
+			Usage:   "Run a DNS over HTTPS proxy server.",
+			EnvVars: []string{"TUNNEL_DNS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:    "proxy-dns-port",
+			Value:   53,
+			Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
+			EnvVars: []string{"TUNNEL_DNS_PORT"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "proxy-dns-address",
+			Usage:   "Listen address for the DNS over HTTPS proxy server.",
+			Value:   "localhost",
+			EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name:    "proxy-dns-upstream",
+			Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
+			Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
+			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:    "grace-period",
+			Usage:   "Duration to accept new requests after cloudflared receives first SIGINT/SIGTERM. A second SIGINT/SIGTERM will force cloudflared to shutdown immediately.",
+			Value:   time.Second * 30,
+			EnvVars: []string{"TUNNEL_GRACE_PERIOD"},
+			Hidden:  true,
+		}),
+		altsrc.NewUintFlag(&cli.UintFlag{
+			Name:    "compression-quality",
+			Value:   0,
+			Usage:   "(beta) Use cross-stream compression instead HTTP compression. 0-off, 1-low, 2-medium, >=3-high.",
+			EnvVars: []string{"TUNNEL_COMPRESSION_LEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "no-chunked-encoding",
+			Usage:   "Disables chunked transfer encoding; useful if you are running a WSGI server.",
+			EnvVars: []string{"TUNNEL_NO_CHUNKED_ENCODING"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "trace-output",
+			Usage:   "Name of trace output file, generated when cloudflared stops.",
+			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
+			Hidden:  shouldHide,
+		}),
+	}
+}
@@ -0,0 +1,15 @@
+package tunnel
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TesthostnameFromURI(t *testing.T) {
+	assert.Equal(t, "ssh://awesome.warptunnels.horse:22", hostnameFromURI("ssh://awesome.warptunnels.horse:22"))
+	assert.Equal(t, "ssh://awesome.warptunnels.horse:22", hostnameFromURI("ssh://awesome.warptunnels.horse"))
+	assert.Equal(t, "rdp://localhost:3389", hostnameFromURI("rdp://localhost"))
+	assert.Equal(t, "", hostnameFromURI("trash"))
+	assert.Equal(t, "", hostnameFromURI("https://awesomesauce.com"))
+}
@@ -1,4 +1,4 @@
-package main
+package tunnel

 import (
 	"crypto/tls"
@@ -15,80 +15,39 @@ import (
 	"strings"
 	"time"

+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/tlsconfig"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/validation"
+	"golang.org/x/crypto/ssh/terminal"

 	"github.com/sirupsen/logrus"
 	"gopkg.in/urfave/cli.v2"
-	"gopkg.in/urfave/cli.v2/altsrc"

 	"github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 )

 var (
-	defaultConfigFiles = []string{"config.yml", "config.yaml"}
-
-	// Launchd doesn't set root env variables, so there is default
-	// Windows default config dir was ~/cloudflare-warp in documentation; let's keep it compatible
-	defaultConfigDirs = []string{"~/.cloudflared", "~/.cloudflare-warp", "~/cloudflare-warp", "/usr/local/etc/cloudflared", "/etc/cloudflared"}
+	developerPortal = "https://developers.cloudflare.com/argo-tunnel"
+	quickStartUrl   = developerPortal + "/quickstart/quickstart/"
+	serviceUrl      = developerPortal + "/reference/service/"
+	argumentsUrl    = developerPortal + "/reference/arguments/"
 )

-const defaultCredentialFile = "cert.pem"
-
-func fileExists(path string) (bool, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			// ignore missing files
-			return false, nil
-		}
-		return false, err
-	}
-	f.Close()
-	return true, nil
-}
-
-// returns the first path that contains a cert.pem file. If none of the defaultConfigDirs
-// (differs by OS for legacy reasons) contains a cert.pem file, return empty string
+// returns the first path that contains a cert.pem file. If none of the DefaultConfigDirs
+// contains a cert.pem file, return empty string
 func findDefaultOriginCertPath() string {
-	for _, defaultConfigDir := range defaultConfigDirs {
-		originCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, defaultCredentialFile))
-		if ok, _ := fileExists(originCertPath); ok {
+	for _, defaultConfigDir := range config.DefaultConfigDirs {
+		originCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, config.DefaultCredentialFile))
+		if ok, _ := config.FileExists(originCertPath); ok {
 			return originCertPath
 		}
 	}
 	return ""
 }

-// returns the first path that contains a config file. If none of the combination of
-// defaultConfigDirs (differs by OS for legacy reasons) and defaultConfigFiles
-// contains a config file, return empty string
-func findDefaultConfigPath() string {
-	for _, configDir := range defaultConfigDirs {
-		for _, configFile := range defaultConfigFiles {
-			dirPath, err := homedir.Expand(configDir)
-			if err != nil {
-				continue
-			}
-			path := filepath.Join(dirPath, configFile)
-			if ok, _ := fileExists(path); ok {
-				return path
-			}
-		}
-	}
-	return ""
-}
-
-func findInputSourceContext(context *cli.Context) (altsrc.InputSourceContext, error) {
-	if context.String("config") != "" {
-		return altsrc.NewYamlSourceFromFile(context.String("config"))
-	}
-	return nil, nil
-}
-
 func generateRandomClientID() string {
 	r := rand.New(rand.NewSource(time.Now().UnixNano()))
 	id := make([]byte, 32)
@@ -96,24 +55,6 @@ func generateRandomClientID() string {
 	return hex.EncodeToString(id)
 }

-func enoughOptionsSet(c *cli.Context) bool {
-	// For cloudflared to work, the user needs to at least provide a hostname,
-	// or runs as stand alone DNS proxy .
-	// When using sudo, use -E flag to preserve env vars
-	if c.NumFlags() == 0 && c.NArg() == 0 && os.Getenv("TUNNEL_HOSTNAME") == "" && os.Getenv("TUNNEL_DNS") == "" {
-		if isRunningFromTerminal() {
-			logger.Errorf("No arguments were provided. You need to at least specify the hostname for this tunnel. See %s", quickStartUrl)
-			logger.Infof("If you want to run Argo Tunnel client as a stand alone DNS proxy, run with --proxy-dns option or set TUNNEL_DNS environment variable.")
-		} else {
-			logger.Errorf("You need to specify all the options in a configuration file, or use environment variables. See %s and %s", serviceUrl, argumentsUrl)
-			logger.Infof("If you want to run Argo Tunnel client as a stand alone DNS proxy, specify proxy-dns option in the configuration file, or set TUNNEL_DNS environment variable.")
-		}
-		cli.ShowAppHelp(c)
-		return false
-	}
-	return true
-}
-
 func handleDeprecatedOptions(c *cli.Context) error {
 	// Fail if the user provided an old authentication method
 	if c.IsSet("api-key") || c.IsSet("api-email") || c.IsSet("api-ca-key") {
@@ -123,17 +64,6 @@ func handleDeprecatedOptions(c *cli.Context) error {
 	return nil
 }

-func validateUrl(c *cli.Context) (string, error) {
-	var url = c.String("url")
-	if c.NArg() > 0 {
-		if !c.IsSet("url") {
-			return "", errors.New("Please specify an origin URL.")
-		}
-	}
-	validUrl, err := validation.ValidateUrl(url)
-	return validUrl, err
-}
-
 func logClientOptions(c *cli.Context) {
 	flags := make(map[string]interface{})
 	for _, flag := range c.LocalFlagNames() {
@@ -165,7 +95,7 @@ func dnsProxyStandAlone(c *cli.Context) bool {

 func getOriginCert(c *cli.Context) ([]byte, error) {
 	if c.String("origincert") == "" {
-		logger.Warnf("Cannot determine default origin certificate path. No file %s in %v", defaultCredentialFile, defaultConfigDirs)
+		logger.Warnf("Cannot determine default origin certificate path. No file %s in %v", config.DefaultCredentialFile, config.DefaultConfigDirs)
 		if isRunningFromTerminal() {
 			logger.Errorf("You need to specify the origin certificate path with --origincert option, or set TUNNEL_ORIGIN_CERT environment variable. See %s for more information.", argumentsUrl)
 			return nil, fmt.Errorf("Client didn't specify origincert path when running from terminal")
@@ -180,7 +110,7 @@ func getOriginCert(c *cli.Context) ([]byte, error) {
 		logger.WithError(err).Errorf("Cannot resolve path %s", c.String("origincert"))
 		return nil, fmt.Errorf("Cannot resolve path %s", c.String("origincert"))
 	}
-	ok, err := fileExists(originCertPath)
+	ok, err := config.FileExists(originCertPath)
 	if err != nil {
 		logger.Errorf("Cannot check if origin cert exists at path %s", c.String("origincert"))
 		return nil, fmt.Errorf("Cannot check if origin cert exists at path %s", c.String("origincert"))
@@ -206,7 +136,7 @@ If you don't have a certificate signed by Cloudflare, run the command:
 	return originCert, nil
 }

-func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, logger, protoLogger *logrus.Logger) (*origin.TunnelConfig, error) {
+func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version string, logger, transportLogger *logrus.Logger) (*origin.TunnelConfig, error) {
 	hostname, err := validation.ValidateHostname(c.String("hostname"))
 	if err != nil {
 		logger.WithError(err).Error("Invalid hostname")
@@ -225,12 +155,12 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, logger, pr

 	tags = append(tags, tunnelpogs.Tag{Name: "ID", Value: clientID})

-	url, err := validateUrl(c)
+	originURL, err := config.ValidateUrl(c)
 	if err != nil {
-		logger.WithError(err).Error("Error validating url")
-		return nil, errors.Wrap(err, "Error validating url")
+		logger.WithError(err).Error("Error validating origin URL")
+		return nil, errors.Wrap(err, "Error validating origin URL")
 	}
-	logger.Infof("Proxying tunnel requests to %s", url)
+	logger.Infof("Proxying tunnel requests to %s", originURL)

 	originCert, err := getOriginCert(c)
 	if err != nil {
@@ -262,32 +192,45 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, logger, pr
 		httpTransport.TLSClientConfig.ServerName = c.String("origin-server-name")
 	}

+	err = validation.ValidateHTTPService(originURL, hostname, httpTransport)
+	if err != nil {
+		logger.WithError(err).Error("unable to connect to the origin")
+		return nil, errors.Wrap(err, "unable to connect to the origin")
+	}
+
+	toEdgeTLSConfig, err := createTunnelConfig(c)
+	if err != nil {
+		logger.WithError(err).Error("unable to create TLS config to connect with edge")
+		return nil, errors.Wrap(err, "unable to create TLS config to connect with edge")
+	}
+
 	return &origin.TunnelConfig{
 		EdgeAddrs:          c.StringSlice("edge"),
-		OriginUrl:          url,
+		OriginUrl:          originURL,
 		Hostname:           hostname,
 		OriginCert:         originCert,
-		TlsConfig:          tlsconfig.CreateTunnelConfig(c, c.StringSlice("edge")),
+		TlsConfig:          toEdgeTLSConfig,
 		ClientTlsConfig:    httpTransport.TLSClientConfig,
 		Retries:            c.Uint("retries"),
 		HeartbeatInterval:  c.Duration("heartbeat-interval"),
 		MaxHeartbeats:      c.Uint64("heartbeat-count"),
 		ClientID:           clientID,
 		BuildInfo:          buildInfo,
-		ReportedVersion:    Version,
+		ReportedVersion:    version,
 		LBPool:             c.String("lb-pool"),
 		Tags:               tags,
 		HAConnections:      c.Int("ha-connections"),
 		HTTPTransport:      httpTransport,
 		Metrics:            tunnelMetrics,
 		MetricsUpdateFreq:  c.Duration("metrics-update-freq"),
-		ProtocolLogger:     protoLogger,
+		TransportLogger:    transportLogger,
 		Logger:             logger,
 		IsAutoupdated:      c.Bool("is-autoupdated"),
 		GracePeriod:        c.Duration("grace-period"),
 		RunFromTerminal:    isRunningFromTerminal(),
 		NoChunkedEncoding:  c.Bool("no-chunked-encoding"),
 		CompressionQuality: c.Uint64("compression-quality"),
+		IncidentLookup:     origin.NewIncidentLookup(),
 	}, nil
 }

@@ -304,7 +247,7 @@ func loadCertPool(c *cli.Context, logger *logrus.Logger) (*x509.CertPool, error)
 		}
 	}

-	originCertPool, err := tlsconfig.LoadOriginCertPool(originCustomCAPool)
+	originCertPool, err := loadOriginCertPool(originCustomCAPool)
 	if err != nil {
 		return nil, errors.Wrap(err, "error loading the certificate pool")
 	}
@@ -316,3 +259,87 @@ func loadCertPool(c *cli.Context, logger *logrus.Logger) (*x509.CertPool, error)

 	return originCertPool, nil
 }
+
+func loadOriginCertPool(originCAPoolPEM []byte) (*x509.CertPool, error) {
+	// Get the global pool
+	certPool, err := loadGlobalCertPool()
+	if err != nil {
+		return nil, err
+	}
+
+	// Then, add any custom origin CA pool the user may have passed
+	if originCAPoolPEM != nil {
+		if !certPool.AppendCertsFromPEM(originCAPoolPEM) {
+			logger.Warn("could not append the provided origin CA to the cloudflared certificate pool")
+		}
+	}
+
+	return certPool, nil
+}
+
+func loadGlobalCertPool() (*x509.CertPool, error) {
+	// First, obtain the system certificate pool
+	certPool, err := x509.SystemCertPool()
+	if err != nil {
+		if runtime.GOOS != "windows" {
+			logger.WithError(err).Warn("error obtaining the system certificates")
+		}
+		certPool = x509.NewCertPool()
+	}
+
+	// Next, append the Cloudflare CAs into the system pool
+	cfRootCA, err := tlsconfig.GetCloudflareRootCA()
+	if err != nil {
+		return nil, errors.Wrap(err, "could not append Cloudflare Root CAs to cloudflared certificate pool")
+	}
+	for _, cert := range cfRootCA {
+		certPool.AddCert(cert)
+	}
+
+	// Finally, add the Hello certificate into the pool (since it's self-signed)
+	helloCert, err := tlsconfig.GetHelloCertificateX509()
+	if err != nil {
+		return nil, errors.Wrap(err, "could not append Hello server certificate to cloudflared certificate pool")
+	}
+	certPool.AddCert(helloCert)
+
+	return certPool, nil
+}
+
+func createTunnelConfig(c *cli.Context) (*tls.Config, error) {
+	var rootCAs []string
+	if c.String("cacert") != "" {
+		rootCAs = append(rootCAs, c.String("cacert"))
+	}
+	edgeAddrs := c.StringSlice("edge")
+
+	userConfig := &tlsconfig.TLSParameters{RootCAs: rootCAs}
+	tlsConfig, err := tlsconfig.GetConfig(userConfig)
+	if err != nil {
+		return nil, err
+	}
+	if tlsConfig.RootCAs == nil {
+		rootCAPool := x509.NewCertPool()
+		cfRootCA, err := tlsconfig.GetCloudflareRootCA()
+		if err != nil {
+			return nil, errors.Wrap(err, "could not append Cloudflare Root CAs to cloudflared certificate pool")
+		}
+		for _, cert := range cfRootCA {
+			rootCAPool.AddCert(cert)
+		}
+		tlsConfig.RootCAs = rootCAPool
+		tlsConfig.ServerName = "cftunnel.com"
+	} else if len(edgeAddrs) > 0 {
+		// Set for development environments and for testing specific origintunneld instances
+		tlsConfig.ServerName, _, _ = net.SplitHostPort(edgeAddrs[0])
+	}
+
+	if tlsConfig.ServerName == "" && !tlsConfig.InsecureSkipVerify {
+		return nil, fmt.Errorf("either ServerName or InsecureSkipVerify must be specified in the tls.Config")
+	}
+	return tlsConfig, nil
+}
+
+func isRunningFromTerminal() bool {
+	return terminal.IsTerminal(int(os.Stdout.Fd()))
+}
@@ -0,0 +1,214 @@
+// +build ignore
+// TODO: Remove the above build tag and include this test when we start compiling with Golang 1.10.0+
+
+package tunnel
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Generated using `openssl req -newkey rsa:512 -nodes -x509 -days 3650`
+var samplePEM = []byte(`
+-----BEGIN CERTIFICATE-----
+MIIB4DCCAYoCCQCb/H0EUrdXEjANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
+UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
+dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
+AwwIVGVzdCBPbmUwHhcNMTgwNDI2MTYxMDUxWhcNMjgwNDIzMTYxMDUxWjB3MQsw
+CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
+A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
+eTERMA8GA1UEAwwIVGVzdCBPbmUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAwVQD
+K0SJ25UFLznm2pU3zhzMEvpDEofHVNnCjk4mlDrtVop7PkKZ8pDEmuQANltUrxC8
+yHBE2wXMv+GlH+bDtwIDAQABMA0GCSqGSIb3DQEBCwUAA0EAjVYQzozIFPkt/HRY
+uUoZ8zEHIDICb0syFf5VAjm9AgTwIPzUmD+c5vl6LWDnxq7L45nLCzhhQ6YmiwDz
+X7Wcyg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB4DCCAYoCCQDZfCdAJ+mwzDANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
+UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
+dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
+AwwIVGVzdCBUd28wHhcNMTgwNDI2MTYxMTIwWhcNMjgwNDIzMTYxMTIwWjB3MQsw
+CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
+A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
+eTERMA8GA1UEAwwIVGVzdCBUd28wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAoHKp
+ROVK3zCSsH7ocYeyRAML4V7SFAbZcb4WIwDnE08oMBVRkQVcW5tqEkvG3RiClfzV
+wZIJ3CfqKIeSNSDU9wIDAQABMA0GCSqGSIb3DQEBCwUAA0EAJw2gUbnPiq4C2p5b
+iWzlA9Q7aKo+VQ4H7IZS7tTccr59nVjvH/TG3eWujpnocr4TOqW9M3CK1DF9mUGP
+3pQ3Jg==
+-----END CERTIFICATE-----
+`)
+
+var systemCertPoolSubjects []*pkix.Name
+
+type certificateFixture struct {
+	ou string
+	cn string
+}
+
+func TestMain(m *testing.M) {
+	systemCertPool, err := x509.SystemCertPool()
+	if isUnrecoverableError(err) {
+		os.Exit(1)
+	}
+
+	if systemCertPool == nil {
+		// On Windows, let's just assume the system cert pool was empty
+		systemCertPool = x509.NewCertPool()
+	}
+
+	systemCertPoolSubjects, err = getCertPoolSubjects(systemCertPool)
+	if err != nil {
+		os.Exit(1)
+	}
+
+	os.Exit(m.Run())
+}
+
+func TestLoadOriginCertPoolJustSystemPool(t *testing.T) {
+	certPoolSubjects := loadCertPoolSubjects(t, nil)
+	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
+
+	// Remove extra subjects from the cert pool
+	var filteredSystemCertPoolSubjects []*pkix.Name
+
+	t.Log(extraSubjects)
+
+OUTER:
+	for _, subject := range certPoolSubjects {
+		for _, extraSubject := range extraSubjects {
+			if subject == extraSubject {
+				t.Log(extraSubject)
+				continue OUTER
+			}
+		}
+
+		filteredSystemCertPoolSubjects = append(filteredSystemCertPoolSubjects, subject)
+	}
+
+	assert.Equal(t, len(filteredSystemCertPoolSubjects), len(systemCertPoolSubjects))
+
+	difference := subjectSubtract(systemCertPoolSubjects, filteredSystemCertPoolSubjects)
+	assert.Equal(t, 0, len(difference))
+}
+
+func TestLoadOriginCertPoolCFCertificates(t *testing.T) {
+	certPoolSubjects := loadCertPoolSubjects(t, nil)
+
+	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
+
+	expected := []*certificateFixture{
+		{ou: "CloudFlare Origin SSL ECC Certificate Authority"},
+		{ou: "CloudFlare Origin SSL Certificate Authority"},
+		{cn: "origin-pull.cloudflare.net"},
+		{cn: "Argo Tunnel Sample Hello Server Certificate"},
+	}
+
+	assertFixturesMatchSubjects(t, expected, extraSubjects)
+}
+
+func TestLoadOriginCertPoolWithExtraPEMs(t *testing.T) {
+	certPoolWithoutPEMSubjects := loadCertPoolSubjects(t, nil)
+	certPoolWithPEMSubjects := loadCertPoolSubjects(t, samplePEM)
+
+	difference := subjectSubtract(certPoolWithoutPEMSubjects, certPoolWithPEMSubjects)
+
+	assert.Equal(t, 2, len(difference))
+
+	expected := []*certificateFixture{
+		{cn: "Test One"},
+		{cn: "Test Two"},
+	}
+
+	assertFixturesMatchSubjects(t, expected, difference)
+}
+
+func loadCertPoolSubjects(t *testing.T, originCAPoolPEM []byte) []*pkix.Name {
+	certPool, err := loadOriginCertPool(originCAPoolPEM)
+	if isUnrecoverableError(err) {
+		t.Fatal(err)
+	}
+	assert.NotEmpty(t, certPool.Subjects())
+	certPoolSubjects, err := getCertPoolSubjects(certPool)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return certPoolSubjects
+}
+
+func assertFixturesMatchSubjects(t *testing.T, fixtures []*certificateFixture, subjects []*pkix.Name) {
+	assert.Equal(t, len(fixtures), len(subjects))
+
+	for _, fixture := range fixtures {
+		found := false
+		for _, subject := range subjects {
+			found = found || fixtureMatchesSubjectPredicate(fixture, subject)
+		}
+
+		if !found {
+			t.Fail()
+		}
+	}
+}
+
+func fixtureMatchesSubjectPredicate(fixture *certificateFixture, subject *pkix.Name) bool {
+	cnMatch := true
+	if fixture.cn != "" {
+		cnMatch = fixture.cn == subject.CommonName
+	}
+
+	ouMatch := true
+	if fixture.ou != "" {
+		ouMatch = len(subject.OrganizationalUnit) > 0 && fixture.ou == subject.OrganizationalUnit[0]
+	}
+
+	return cnMatch && ouMatch
+}
+
+func subjectSubtract(left []*pkix.Name, right []*pkix.Name) []*pkix.Name {
+	var difference []*pkix.Name
+
+	var found bool
+	for _, r := range right {
+		found = false
+		for _, l := range left {
+			if (*l).String() == (*r).String() {
+				found = true
+			}
+		}
+
+		if !found {
+			difference = append(difference, r)
+		}
+	}
+
+	return difference
+}
+
+func getCertPoolSubjects(certPool *x509.CertPool) ([]*pkix.Name, error) {
+	var subjects []*pkix.Name
+
+	for _, subject := range certPool.Subjects() {
+		var sequence pkix.RDNSequence
+		_, err := asn1.Unmarshal(subject, &sequence)
+		if err != nil {
+			return nil, err
+		}
+
+		name := pkix.Name{}
+		name.FillFromRDNSequence(&sequence)
+
+		subjects = append(subjects, &name)
+	}
+
+	return subjects, nil
+}
+
+func isUnrecoverableError(err error) bool {
+	return err != nil && err.Error() != "crypto/x509: system root pool is not available on Windows"
+}
@@ -1,11 +1,10 @@
-package main
+package tunnel

 import (
 	"fmt"
 	"os"

 	"github.com/cloudflare/cloudflared/log"
-
 	"github.com/rifflock/lfshook"
 	"github.com/sirupsen/logrus"
 	"gopkg.in/urfave/cli.v2"
@@ -14,6 +13,9 @@ import (
 	"github.com/pkg/errors"
 )

+const debugLevelWarning = "At debug level, request URL, method, protocol, content legnth and header will be logged. " +
+	"Response status, content length and header will also be logged in debug level."
+
 var logger = log.CreateLogger()

 func configMainLogger(c *cli.Context) error {
@@ -23,18 +25,21 @@ func configMainLogger(c *cli.Context) error {
 		return errors.Wrap(err, "Unknown logging level specified")
 	}
 	logger.SetLevel(logLevel)
+	if logLevel == logrus.DebugLevel {
+		logger.Warn(debugLevelWarning)
+	}
 	return nil
 }

-func configProtoLogger(c *cli.Context) (*logrus.Logger, error) {
-	protoLogLevel, err := logrus.ParseLevel(c.String("proto-loglevel"))
+func configTransportLogger(c *cli.Context) (*logrus.Logger, error) {
+	transportLogLevel, err := logrus.ParseLevel(c.String("transport-loglevel"))
 	if err != nil {
-		logger.WithError(err).Fatal("Unknown protocol logging level specified")
-		return nil, errors.Wrap(err, "Unknown protocol logging level specified")
+		logger.WithError(err).Fatal("Unknown transport logging level specified")
+		return nil, errors.Wrap(err, "Unknown transport logging level specified")
 	}
-	protoLogger := logrus.New()
-	protoLogger.Level = protoLogLevel
-	return protoLogger, nil
+	transportLogger := logrus.New()
+	transportLogger.Level = transportLogLevel
+	return transportLogger, nil
 }

 func initLogFile(c *cli.Context, loggers ...*logrus.Logger) error {
@@ -0,0 +1,69 @@
+package tunnel
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"syscall"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/transfer"
+	homedir "github.com/mitchellh/go-homedir"
+	cli "gopkg.in/urfave/cli.v2"
+)
+
+const (
+	baseLoginURL     = "https://dash.cloudflare.com/argotunnel"
+	callbackStoreURL = "https://login.cloudflarewarp.com/"
+)
+
+func login(c *cli.Context) error {
+	path, ok, err := checkForExistingCert()
+	if ok {
+		fmt.Fprintf(os.Stdout, "You have an existing certificate at %s which login would overwrite.\nIf this is intentional, please move or delete that file then run this command again.\n", path)
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	loginURL, err := url.Parse(baseLoginURL)
+	if err != nil {
+		// shouldn't happen, URL is hardcoded
+		return err
+	}
+
+	_, err = transfer.Run(loginURL, "cert", "callback", callbackStoreURL, path, false)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to write the certificate due to the following error:\n%v\n\nYour browser will download the certificate instead. You will have to manually\ncopy it to the following path:\n\n%s\n", err, path)
+		return err
+	}
+
+	fmt.Fprintf(os.Stdout, "You have successfully logged in.\nIf you wish to copy your credentials to a server, they have been saved to:\n%s\n", path)
+	return nil
+}
+
+func checkForExistingCert() (string, bool, error) {
+	configPath, err := homedir.Expand(config.DefaultConfigDirs[0])
+	if err != nil {
+		return "", false, err
+	}
+	ok, err := config.FileExists(configPath)
+	if !ok && err == nil {
+		// create config directory if doesn't already exist
+		err = os.Mkdir(configPath, 0700)
+	}
+	if err != nil {
+		return "", false, err
+	}
+	path := filepath.Join(configPath, config.DefaultCredentialFile)
+	fileInfo, err := os.Stat(path)
+	if err == nil && fileInfo.Size() > 0 {
+		return path, true, nil
+	}
+	if err != nil && err.(*os.PathError).Err != syscall.ENOENT {
+		return path, false, err
+	}
+
+	return path, false, nil
+}
@@ -1,4 +1,4 @@
-package main
+package tunnel

 import (
 	"github.com/cloudflare/cloudflared/tunneldns"
@@ -1,4 +1,4 @@
-package main
+package tunnel

 import (
 	"os"
@@ -1,4 +1,4 @@
-package main
+package tunnel

 import (
 	"fmt"
@@ -1,4 +1,4 @@
-package main
+package tunnel

 import (
 	"fmt"
@@ -1,4 +1,4 @@
-package main
+package tunnel

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package main
+package updater

 import (
 	"os"
@@ -8,6 +8,7 @@ import (
 	"golang.org/x/crypto/ssh/terminal"
 	"gopkg.in/urfave/cli.v2"

+	"github.com/cloudflare/cloudflared/log"
 	"github.com/equinox-io/equinox"
 	"github.com/facebookgo/grace/gracenet"
 )
@@ -18,13 +19,16 @@ const (
 	noUpdateOnWindowsMessage = "cloudflared will not automatically update on Windows systems."
 )

-var publicKey = []byte(`
+var (
+	publicKey = []byte(`
 -----BEGIN ECDSA PUBLIC KEY-----
 MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4OWZocTVZ8Do/L6ScLdkV+9A0IYMHoOf
 dsCmJ/QZ6aw0w9qkkwEpne1Lmo6+0pGexZzFZOH6w5amShn+RXt7qkSid9iWlzGq
 EKx0BZogHSor9Wy5VztdFaAaVbsJiCbO
 -----END ECDSA PUBLIC KEY-----
 `)
+	logger = log.CreateLogger()
+)

 type ReleaseInfo struct {
 	Updated bool
@@ -54,14 +58,14 @@ func checkForUpdates() ReleaseInfo {
 	return ReleaseInfo{Updated: true, Version: resp.ReleaseVersion}
 }

-func update(_ *cli.Context) error {
+func Update(_ *cli.Context) error {
 	if updateApplied() {
 		os.Exit(64)
 	}
 	return nil
 }

-func autoupdate(freq time.Duration, listeners *gracenet.Net, shutdownC chan struct{}) error {
+func Autoupdate(freq time.Duration, listeners *gracenet.Net, shutdownC chan struct{}) error {
 	tickC := time.Tick(freq)
 	for {
 		if updateApplied() {
@@ -96,7 +100,7 @@ func updateApplied() bool {
 	return false
 }

-func isAutoupdateEnabled(c *cli.Context) bool {
+func IsAutoupdateEnabled(c *cli.Context) bool {
 	if runtime.GOOS == "windows" {
 		logger.Info(noUpdateOnWindowsMessage)
 		return false
@@ -22,6 +22,7 @@ import (
 const (
 	windowsServiceName        = "Cloudflared"
 	windowsServiceDescription = "Argo Tunnel agent"
+	windowsServiceUrl         = "https://developers.cloudflare.com/argo-tunnel/reference/service/"

 	recoverActionDelay      = time.Second * 20
 	failureCountResetPeriod = time.Hour * 24
@@ -86,7 +87,20 @@ type windowsService struct {
 }

 // called by the package code at the start of the service
-func (s *windowsService) Execute(args []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
+func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
+	// the arguments passed here are only meaningful if they were manually
+	// specified by the user, e.g. using the Services console or `sc start`.
+	// https://docs.microsoft.com/en-us/windows/desktop/services/service-entry-point
+	// https://stackoverflow.com/a/6235139
+	var args []string
+	if len(serviceArgs) > 1 {
+		args = serviceArgs
+	} else {
+		// fall back to the arguments from ImagePath (or, as sc calls it, binPath)
+		args = os.Args
+	}
+	s.elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
+
 	const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
 	statusChan <- svc.Status{State: svc.StartPending}
 	errC := make(chan error)
@@ -163,7 +177,7 @@ func installWindowsService(c *cli.Context) error {
 	err = configRecoveryOption(s.Handle)
 	if err != nil {
 		logger.WithError(err).Errorf("Cannot set service recovery actions")
-		logger.Infof("See %s to manually configure service recovery actions", serviceUrl)
+		logger.Infof("See %s to manually configure service recovery actions", windowsServiceUrl)
 	}
 	return nil
 }
@@ -15,11 +15,12 @@ import (
 )

 const (
-	defaultFrameSize  uint32        = 1 << 14 // Minimum frame size in http2 spec
-	defaultWindowSize uint32        = 65535
-	maxWindowSize     uint32        = (1 << 31) - 1 // 2^31-1 = 2147483647, max window size specified in http2 spec
-	defaultTimeout    time.Duration = 5 * time.Second
-	defaultRetries    uint64        = 5
+	defaultFrameSize         uint32        = 1 << 14       // Minimum frame size in http2 spec
+	defaultWindowSize        uint32        = (1 << 16) - 1 // Minimum window size in http2 spec
+	maxWindowSize            uint32        = (1 << 31) - 1 // 2^31-1 = 2147483647, max window size in http2 spec
+	defaultTimeout           time.Duration = 5 * time.Second
+	defaultRetries           uint64        = 5
+	defaultWriteBufferMaxLen int           = 1024 * 1024 * 512 // 500mb

 	SettingMuxerMagic http2.SettingID = 0x42db
 	MuxerMagicOrigin  uint32          = 0xa2e43c8b
@@ -49,6 +50,12 @@ type MuxerConfig struct {
 	// Logger to use
 	Logger             *log.Entry
 	CompressionQuality CompressionSetting
+	// Initial size for HTTP2 flow control windows
+	DefaultWindowSize uint32
+	// Largest allowable size for HTTP2 flow control windows
+	MaxWindowSize uint32
+	// Largest allowable capacity for the buffer of data to be sent
+	StreamWriteBufferMaxLen int
 }

 type Muxer struct {
@@ -64,7 +71,7 @@ type Muxer struct {
 	// muxWriter is the write process.
 	muxWriter *MuxWriter
 	// muxMetricsUpdater is the process to update metrics
-	muxMetricsUpdater *muxMetricsUpdater
+	muxMetricsUpdater muxMetricsUpdater
 	// newStreamChan is used to create new streams on the writer thread.
 	// The writer will assign the next available stream ID.
 	newStreamChan chan MuxedStreamRequest
@@ -98,6 +105,15 @@ func Handshake(
 	if config.Timeout == 0 {
 		config.Timeout = defaultTimeout
 	}
+	if config.DefaultWindowSize == 0 {
+		config.DefaultWindowSize = defaultWindowSize
+	}
+	if config.MaxWindowSize == 0 {
+		config.MaxWindowSize = maxWindowSize
+	}
+	if config.StreamWriteBufferMaxLen == 0 {
+		config.StreamWriteBufferMaxLen = defaultWriteBufferMaxLen
+	}
 	// Initialise connection state fields
 	m := &Muxer{
 		f:             http2.NewFramer(w, r), // A framer that writes to w and reads from r
@@ -147,11 +163,6 @@ func Handshake(
 	// set up reader/writer pair ready for serve
 	streamErrors := NewStreamErrorMap()
 	goAwayChan := make(chan http2.ErrCode, 1)
-	updateRTTChan := make(chan *roundTripMeasurement, 1)
-	updateReceiveWindowChan := make(chan uint32, 1)
-	updateSendWindowChan := make(chan uint32, 1)
-	updateInBoundBytesChan := make(chan uint64)
-	updateOutBoundBytesChan := make(chan uint64)
 	inBoundCounter := NewAtomicCounter(0)
 	outBoundCounter := NewAtomicCounter(0)
 	pingTimestamp := NewPingTimestamp()
@@ -168,6 +179,14 @@ func Handshake(
 		config.Logger.Warn("Minimum number of unacked heartbeats to send before closing the connection has been adjusted to ", maxRetries)
 	}

+	compBytesBefore, compBytesAfter := NewAtomicCounter(0), NewAtomicCounter(0)
+
+	m.muxMetricsUpdater = newMuxMetricsUpdater(
+		m.abortChan,
+		compBytesBefore,
+		compBytesAfter,
+	)
+
 	m.explicitShutdown = NewBooleanFuse()
 	m.muxReader = &MuxReader{
 		f:                       m.f,
@@ -179,47 +198,30 @@ func Handshake(
 		abortChan:               m.abortChan,
 		pingTimestamp:           pingTimestamp,
 		connActive:              connActive,
-		initialStreamWindow:     defaultWindowSize,
-		streamWindowMax:         maxWindowSize,
-		r:                       m.r,
-		updateRTTChan:           updateRTTChan,
-		updateReceiveWindowChan: updateReceiveWindowChan,
-		updateSendWindowChan:    updateSendWindowChan,
-		bytesRead:               inBoundCounter,
-		updateInBoundBytesChan:  updateInBoundBytesChan,
+		initialStreamWindow:     m.config.DefaultWindowSize,
+		streamWindowMax:         m.config.MaxWindowSize,
+		streamWriteBufferMaxLen: m.config.StreamWriteBufferMaxLen,
+		r:              m.r,
+		metricsUpdater: m.muxMetricsUpdater,
+		bytesRead:      inBoundCounter,
 	}
 	m.muxWriter = &MuxWriter{
-		f:                       m.f,
-		streams:                 m.streams,
-		streamErrors:            streamErrors,
-		readyStreamChan:         m.readyList.ReadyChannel(),
-		newStreamChan:           m.newStreamChan,
-		goAwayChan:              goAwayChan,
-		abortChan:               m.abortChan,
-		pingTimestamp:           pingTimestamp,
-		idleTimer:               NewIdleTimer(idleDuration, maxRetries),
-		connActiveChan:          connActive.WaitChannel(),
-		maxFrameSize:            defaultFrameSize,
-		updateReceiveWindowChan: updateReceiveWindowChan,
-		updateSendWindowChan:    updateSendWindowChan,
-		bytesWrote:              outBoundCounter,
-		updateOutBoundBytesChan: updateOutBoundBytesChan,
+		f:               m.f,
+		streams:         m.streams,
+		streamErrors:    streamErrors,
+		readyStreamChan: m.readyList.ReadyChannel(),
+		newStreamChan:   m.newStreamChan,
+		goAwayChan:      goAwayChan,
+		abortChan:       m.abortChan,
+		pingTimestamp:   pingTimestamp,
+		idleTimer:       NewIdleTimer(idleDuration, maxRetries),
+		connActiveChan:  connActive.WaitChannel(),
+		maxFrameSize:    defaultFrameSize,
+		metricsUpdater:  m.muxMetricsUpdater,
+		bytesWrote:      outBoundCounter,
 	}
 	m.muxWriter.headerEncoder = hpack.NewEncoder(&m.muxWriter.headerBuffer)

-	compBytesBefore, compBytesAfter := NewAtomicCounter(0), NewAtomicCounter(0)
-
-	m.muxMetricsUpdater = newMuxMetricsUpdater(
-		updateRTTChan,
-		updateReceiveWindowChan,
-		updateSendWindowChan,
-		updateInBoundBytesChan,
-		updateOutBoundBytesChan,
-		m.abortChan,
-		compBytesBefore,
-		compBytesAfter,
-	)
-
 	if m.compressionQuality.dictSize > 0 && m.compressionQuality.nDicts > 0 {
 		nd, sz := m.compressionQuality.nDicts, m.compressionQuality.dictSize
 		writeDicts, dictChan := newH2WriteDictionaries(
@@ -305,6 +307,12 @@ func joinErrorsWithTimeout(errChan <-chan error, receiveCount int, timeout time.
 	return nil
 }

+// Serve runs the event loops that comprise h2mux:
+// - MuxReader.run()
+// - MuxWriter.run()
+// - muxMetricsUpdater.run()
+// In the normal case, Shutdown() is called concurrently with Serve() to stop
+// these loops.
 func (m *Muxer) Serve(ctx context.Context) error {
 	errGroup, _ := errgroup.WithContext(ctx)
 	errGroup.Go(func() error {
@@ -335,6 +343,7 @@ func (m *Muxer) Serve(ctx context.Context) error {
 	return nil
 }

+// Shutdown is called to initiate the "happy path" of muxer termination.
 func (m *Muxer) Shutdown() {
 	m.explicitShutdown.Fuse(true)
 	m.muxReader.Shutdown()
@@ -375,10 +384,12 @@ func (m *Muxer) OpenStream(headers []Header, body io.Reader) (*MuxedStream, erro
 		responseHeadersReceived: make(chan struct{}),
 		readBuffer:              NewSharedBuffer(),
 		writeBuffer:             &bytes.Buffer{},
-		receiveWindow:           defaultWindowSize,
-		receiveWindowCurrentMax: defaultWindowSize, // Initial window size limit. exponentially increase it when receiveWindow is exhausted
-		receiveWindowMax:        maxWindowSize,
-		sendWindow:              defaultWindowSize,
+		writeBufferMaxLen:       m.config.StreamWriteBufferMaxLen,
+		writeBufferHasSpace:     make(chan struct{}, 1),
+		receiveWindow:           m.config.DefaultWindowSize,
+		receiveWindowCurrentMax: m.config.DefaultWindowSize,
+		receiveWindowMax:        m.config.MaxWindowSize,
+		sendWindow:              m.config.DefaultWindowSize,
 		readyList:               m.readyList,
 		writeHeaders:            headers,
 		dictionaries:            m.muxReader.dictionaries,
@@ -399,12 +410,13 @@ func (m *Muxer) OpenStream(headers []Header, body io.Reader) (*MuxedStream, erro
 }

 func (m *Muxer) Metrics() *MuxerMetrics {
-	return m.muxMetricsUpdater.Metrics()
+	return m.muxMetricsUpdater.metrics()
 }

 func (m *Muxer) abort() {
 	m.abortOnce.Do(func() {
 		close(m.abortChan)
+		m.readyList.Close()
 		m.streams.Abort()
 	})
 }
@@ -39,20 +39,26 @@ func NewDefaultMuxerPair() *DefaultMuxerPair {
 	origin, edge := net.Pipe()
 	return &DefaultMuxerPair{
 		OriginMuxConfig: MuxerConfig{
-			Timeout: time.Second,
-			IsClient: true,
-			Name: "origin",
-			Logger: log.NewEntry(log.New()),
+			Timeout:                 time.Second,
+			IsClient:                true,
+			Name:                    "origin",
+			Logger:                  log.NewEntry(log.New()),
+			DefaultWindowSize:       (1 << 8) - 1,
+			MaxWindowSize:           (1 << 15) - 1,
+			StreamWriteBufferMaxLen: 1024,
 		},
-		OriginConn:      origin,
-		EdgeMuxConfig:   MuxerConfig{
-			Timeout: time.Second,
-			IsClient: false,
-			Name: "edge",
-			Logger: log.NewEntry(log.New()),
+		OriginConn: origin,
+		EdgeMuxConfig: MuxerConfig{
+			Timeout:                 time.Second,
+			IsClient:                false,
+			Name:                    "edge",
+			Logger:                  log.NewEntry(log.New()),
+			DefaultWindowSize:       (1 << 8) - 1,
+			MaxWindowSize:           (1 << 15) - 1,
+			StreamWriteBufferMaxLen: 1024,
 		},
-		EdgeConn:        edge,
-		doneC:           make(chan struct{}),
+		EdgeConn: edge,
+		doneC:    make(chan struct{}),
 	}
 }

@@ -60,22 +66,22 @@ func NewCompressedMuxerPair(quality CompressionSetting) *DefaultMuxerPair {
 	origin, edge := net.Pipe()
 	return &DefaultMuxerPair{
 		OriginMuxConfig: MuxerConfig{
-			Timeout: time.Second,
-			IsClient: true,
-			Name: "origin",
+			Timeout:            time.Second,
+			IsClient:           true,
+			Name:               "origin",
 			CompressionQuality: quality,
-			Logger: log.NewEntry(log.New()),
+			Logger:             log.NewEntry(log.New()),
 		},
-		OriginConn:      origin,
-		EdgeMuxConfig:   MuxerConfig{
-			Timeout: time.Second,
-			IsClient: false,
-			Name: "edge",
+		OriginConn: origin,
+		EdgeMuxConfig: MuxerConfig{
+			Timeout:            time.Second,
+			IsClient:           false,
+			Name:               "edge",
 			CompressionQuality: quality,
-			Logger: log.NewEntry(log.New()),
+			Logger:             log.NewEntry(log.New()),
 		},
-		EdgeConn:        edge,
-		doneC:           make(chan struct{}),
+		EdgeConn: edge,
+		doneC:    make(chan struct{}),
 	}
 }

@@ -230,7 +236,6 @@ func TestSingleStream(t *testing.T) {
 func TestSingleStreamLargeResponseBody(t *testing.T) {
 	muxPair := NewDefaultMuxerPair()
 	bodySize := 1 << 24
-	streamReady := make(chan struct{})
 	muxPair.OriginMuxConfig.Handler = MuxedStreamFunc(func(stream *MuxedStream) error {
 		if len(stream.Headers) != 1 {
 			t.Fatalf("expected %d headers, got %d", 1, len(stream.Headers))
@@ -257,8 +262,6 @@ func TestSingleStreamLargeResponseBody(t *testing.T) {
 		if n != len(payload) {
 			t.Fatalf("origin short write: %d/%d bytes", n, len(payload))
 		}
-		t.Log("Payload written; signaling that the stream is ready")
-		streamReady <- struct{}{}

 		return nil
 	})
@@ -282,9 +285,6 @@ func TestSingleStreamLargeResponseBody(t *testing.T) {
 	}
 	responseBody := make([]byte, bodySize)

-	<-streamReady
-	t.Log("Received stream ready signal; resuming the test")
-
 	n, err := io.ReadFull(stream, responseBody)
 	if err != nil {
 		t.Fatalf("error from (*MuxedStream).Read: %s", err)
@@ -367,14 +367,13 @@ func TestMultipleStreams(t *testing.T) {
 		log.Error(err)
 	}
 	if testFail {
-		t.Fatalf("TestMultipleStreamsFlowControl failed")
+		t.Fatalf("TestMultipleStreams failed")
 	}
 }

 func TestMultipleStreamsFlowControl(t *testing.T) {
 	maxStreams := 32
 	errorsC := make(chan error, maxStreams)
-	streamReady := make(chan struct{})
 	responseSizes := make([]int32, maxStreams)
 	for i := 0; i < maxStreams; i++ {
 		responseSizes[i] = rand.Int31n(int32(defaultWindowSize << 4))
@@ -398,7 +397,6 @@ func TestMultipleStreamsFlowControl(t *testing.T) {
 			payload[i] = byte(i % 256)
 		}
 		n, err := stream.Write(payload)
-		streamReady <- struct{}{}
 		if err != nil {
 			t.Fatalf("origin write error: %s", err)
 		}
@@ -435,7 +433,6 @@ func TestMultipleStreamsFlowControl(t *testing.T) {
 				return
 			}

-			<-streamReady
 			responseBody := make([]byte, responseSizes[(stream.streamID-2)/2])
 			n, err := io.ReadFull(stream, responseBody)
 			if err != nil {
@@ -782,9 +779,11 @@ func TestMultipleStreamsWithDictionaries(t *testing.T) {
 		}

 		wg.Add(len(paths))
+		errorsC := make(chan error, len(paths))

 		for i, s := range paths {
 			go func(i int, path string) {
+				defer wg.Done()
 				stream, err := muxPair.EdgeMux.OpenStream(
 					[]Header{
 						{Name: ":method", Value: "GET"},
@@ -805,24 +804,33 @@ func TestMultipleStreamsWithDictionaries(t *testing.T) {
 				responseBody := make([]byte, len(expectBody)*2)
 				n, err := stream.Read(responseBody)
 				if err != nil {
-					log.Printf("error from (*MuxedStream).Read: %s", err)
-					t.Fatalf("error from (*MuxedStream).Read: %s", err)
+					errorsC <- fmt.Errorf("stream %d error from (*MuxedStream).Read: %s", stream.streamID, err)
+					return
 				}
 				if n != len(expectBody) {
-					log.Printf("expected response body to have %d bytes, got %d", len(expectBody), n)
-					t.Fatalf("expected response body to have %d bytes, got %d", len(expectBody), n)
+					errorsC <- fmt.Errorf("stream %d expected response body to have %d bytes, got %d", stream.streamID, len(expectBody), n)
+					return
 				}
 				if string(responseBody[:n]) != expectBody {
-					log.Printf("expected response body %s, got %s", expectBody, responseBody[:n])
-					t.Fatalf("expected response body %s, got %s", expectBody, responseBody[:n])
+					errorsC <- fmt.Errorf("stream %d expected response body %s, got %s", stream.streamID, expectBody, responseBody[:n])
+					return
 				}
-				wg.Done()
 			}(i, s)
-			time.Sleep(1 * time.Millisecond)
 		}
-		wg.Wait()

-		if q > CompressionNone && muxPair.OriginMux.muxMetricsUpdater.compBytesBefore.Value() <= 10*muxPair.OriginMux.muxMetricsUpdater.compBytesAfter.Value() {
+		wg.Wait()
+		close(errorsC)
+		testFail := false
+		for err := range errorsC {
+			testFail = true
+			log.Error(err)
+		}
+		if testFail {
+			t.Fatalf("TestMultipleStreams failed")
+		}
+
+		originMuxMetrics := muxPair.OriginMux.Metrics()
+		if q > CompressionNone && originMuxMetrics.CompBytesBefore.Value() <= 10*originMuxMetrics.CompBytesAfter.Value() {
 			t.Fatalf("Cross-stream compression is expected to give a better compression ratio")
 		}
 	}
@@ -920,7 +928,8 @@ func TestSampleSiteWithDictionaries(t *testing.T) {
 		}
 		wg.Wait()

-		if q > CompressionNone && muxPair.OriginMux.muxMetricsUpdater.compBytesBefore.Value() <= 10*muxPair.OriginMux.muxMetricsUpdater.compBytesAfter.Value() {
+		originMuxMetrics := muxPair.OriginMux.Metrics()
+		if q > CompressionNone && originMuxMetrics.CompBytesBefore.Value() <= 10*originMuxMetrics.CompBytesAfter.Value() {
 			t.Fatalf("Cross-stream compression is expected to give a better compression ratio")
 		}
 	}
@@ -953,7 +962,8 @@ func TestLongSiteWithDictionaries(t *testing.T) {
 		}
 		wg.Wait()

-		if q > CompressionNone && muxPair.OriginMux.muxMetricsUpdater.compBytesBefore.Value() <= 100*muxPair.OriginMux.muxMetricsUpdater.compBytesAfter.Value() {
+		originMuxMetrics := muxPair.OriginMux.Metrics()
+		if q > CompressionNone && originMuxMetrics.CompBytesBefore.Value() <= 100*originMuxMetrics.CompBytesAfter.Value() {
 			t.Fatalf("Cross-stream compression is expected to give a better compression ratio")
 		}
 	}
@@ -17,32 +17,51 @@ type ReadWriteClosedCloser interface {
 	Closed() bool
 }

+// MuxedStream is logically an HTTP/2 stream, with an additional buffer for outgoing data.
 type MuxedStream struct {
-	Headers []Header
-
 	streamID uint32

+	// The "Receive" end of the stream
+	readBufferLock sync.RWMutex
+	readBuffer     ReadWriteClosedCloser
+	// This is the amount of bytes that are in our receive window
+	// (how much data we can receive into this stream).
+	receiveWindow uint32
+	// current receive window size limit. Exponentially increase it when it's exhausted
+	receiveWindowCurrentMax uint32
+	// hard limit set in http2 spec. 2^31-1
+	receiveWindowMax uint32
+	// The desired size increment for receiveWindow.
+	// If this is nonzero, a WINDOW_UPDATE frame needs to be sent.
+	windowUpdate uint32
+	// The headers that were most recently received.
+	// Particularly:
+	//     * for an eyeball-initiated stream (as passed to TunnelHandler::ServeStream),
+	//       these are the request headers
+	//     * for a cloudflared-initiated stream (as created by Register/UnregisterTunnel),
+	//       these are the response headers.
+	// They are useful in both of these contexts; hence `Headers` is public.
+	Headers []Header
+	// For use in the context of a cloudflared-initiated stream.
 	responseHeadersReceived chan struct{}

-	readBuffer    ReadWriteClosedCloser
-	receiveWindow uint32
-	// current window size limit. Exponentially increase it when it's exhausted
-	receiveWindowCurrentMax uint32
-	// limit set in http2 spec. 2^31-1
-	receiveWindowMax uint32
-
-	// nonzero if a WINDOW_UPDATE frame for a stream needs to be sent
-	windowUpdate uint32
-
-	writeLock sync.Mutex
-	// The zero value for Buffer is an empty buffer ready to use.
+	// The "Send" end of the stream
+	writeLock   sync.Mutex
 	writeBuffer ReadWriteLengther
-
+	// The maximum capacity that the send buffer should grow to.
+	writeBufferMaxLen int
+	// A channel to be notified when the send buffer is not full.
+	writeBufferHasSpace chan struct{}
+	// This is the amount of bytes that are in the peer's receive window
+	// (how much data we can send from this stream).
 	sendWindow uint32
-
-	readyList    *ReadyList
+	// Reference to the muxer's readyList; signal this for stream data to be sent.
+	readyList *ReadyList
+	// The headers that should be sent, and a flag so we only send them once.
 	headersSent  bool
 	writeHeaders []Header
+
+	// EOF-related fields
 	// true if the write end of this stream has been closed
 	writeEOF bool
 	// true if we have sent EOF to the peer
@@ -50,40 +69,63 @@ type MuxedStream struct {
 	// true if the peer sent us an EOF
 	receivedEOF bool

-	// dictionary that was used to compress the stream
+	// Compression-related fields
 	receivedUseDict bool
 	method          string
 	contentType     string
 	path            string
 	dictionaries    h2Dictionaries
-	readBufferLock  sync.RWMutex
 }

 func (s *MuxedStream) Read(p []byte) (n int, err error) {
+	var readBuffer ReadWriteClosedCloser
 	if s.dictionaries.read != nil {
 		s.readBufferLock.RLock()
-		b := s.readBuffer
+		readBuffer = s.readBuffer
 		s.readBufferLock.RUnlock()
-		return b.Read(p)
+	} else {
+		readBuffer = s.readBuffer
 	}
-	return s.readBuffer.Read(p)
+	n, err = readBuffer.Read(p)
+	s.replenishReceiveWindow(uint32(n))
+	return
 }

-func (s *MuxedStream) Write(p []byte) (n int, err error) {
+// Blocks until len(p) bytes have been written to the buffer
+func (s *MuxedStream) Write(p []byte) (int, error) {
+	// If assignDictToStream returns success, then it will have acquired the
+	// writeLock. Otherwise we must acquire it ourselves.
 	ok := assignDictToStream(s, p)
 	if !ok {
 		s.writeLock.Lock()
 	}
 	defer s.writeLock.Unlock()
+
 	if s.writeEOF {
 		return 0, io.EOF
 	}
-	n, err = s.writeBuffer.Write(p)
-	if n != len(p) || err != nil {
-		return n, err
+	totalWritten := 0
+	for totalWritten < len(p) {
+		// If the buffer is full, block till there is more room.
+		// Use a loop to recheck the buffer size after the lock is reacquired.
+		for s.writeBufferMaxLen <= s.writeBuffer.Len() {
+			s.writeLock.Unlock()
+			<-s.writeBufferHasSpace
+			s.writeLock.Lock()
+		}
+		amountToWrite := len(p) - totalWritten
+		spaceAvailable := s.writeBufferMaxLen - s.writeBuffer.Len()
+		if spaceAvailable < amountToWrite {
+			amountToWrite = spaceAvailable
+		}
+		amountWritten, err := s.writeBuffer.Write(p[totalWritten : totalWritten+amountToWrite])
+		totalWritten += amountWritten
+		if err != nil {
+			return totalWritten, err
+		}
+		s.writeNotify()
 	}
-	s.writeNotify()
-	return n, nil
+	return totalWritten, nil
 }

 func (s *MuxedStream) Close() error {
@@ -164,9 +206,9 @@ func (s *MuxedStream) writeNotify() {
 // receive window (how much data we can send).
 func (s *MuxedStream) replenishSendWindow(bytes uint32) {
 	s.writeLock.Lock()
+	defer s.writeLock.Unlock()
 	s.sendWindow += bytes
 	s.writeNotify()
-	s.writeLock.Unlock()
 }

 // Call by muxreader when it receives a data frame
@@ -178,17 +220,30 @@ func (s *MuxedStream) consumeReceiveWindow(bytes uint32) bool {
 		return false
 	}
 	s.receiveWindow -= bytes
-	if s.receiveWindow < s.receiveWindowCurrentMax/2 {
+	if s.receiveWindow < s.receiveWindowCurrentMax/2 && s.receiveWindowCurrentMax < s.receiveWindowMax {
 		// exhausting client send window (how much data client can send)
-		if s.receiveWindowCurrentMax < s.receiveWindowMax {
-			s.receiveWindowCurrentMax <<= 1
+		// and there is room to grow the receive window
+		newMax := s.receiveWindowCurrentMax << 1
+		if newMax > s.receiveWindowMax {
+			newMax = s.receiveWindowMax
 		}
-		s.windowUpdate += s.receiveWindowCurrentMax - s.receiveWindow
+		s.windowUpdate += newMax - s.receiveWindowCurrentMax
+		s.receiveWindowCurrentMax = newMax
+		// notify MuxWriter to write WINDOW_UPDATE frame
 		s.writeNotify()
 	}
 	return true
 }

+// Arranges for the MuxWriter to send a WINDOW_UPDATE
+// Called by MuxedStream::Read when data has left the read buffer.
+func (s *MuxedStream) replenishReceiveWindow(bytes uint32) {
+	s.writeLock.Lock()
+	defer s.writeLock.Unlock()
+	s.windowUpdate += bytes
+	s.writeNotify()
+}
+
 // receiveEOF should be called when the peer indicates no more data will be sent.
 // Returns true if the socket is now closed (i.e. the write side is already closed).
 func (s *MuxedStream) receiveEOF() (closed bool) {
@@ -226,7 +281,8 @@ type streamChunk struct {
 	// true if a HEADERS frame should be sent
 	sendHeaders bool
 	headers     []Header
-	// nonzero if a WINDOW_UPDATE frame should be sent
+	// nonzero if a WINDOW_UPDATE frame should be sent;
+	// in that case, it is the increment value to use
 	windowUpdate uint32
 	// true if data frames should be sent
 	sendData bool
@@ -249,11 +305,23 @@ func (s *MuxedStream) getChunk() *streamChunk {
 		eof:          s.writeEOF && uint32(s.writeBuffer.Len()) <= s.sendWindow,
 	}

-	// Copies at most s.sendWindow bytes
+	// Copy at most s.sendWindow bytes, adjust the sendWindow accordingly
 	writeLen, _ := io.CopyN(&chunk.buffer, s.writeBuffer, int64(s.sendWindow))
 	s.sendWindow -= uint32(writeLen)
+
+	// Non-blocking channel send. This will allow MuxedStream::Write() to continue, if needed
+	if s.writeBuffer.Len() < s.writeBufferMaxLen {
+		select {
+		case s.writeBufferHasSpace <- struct{}{}:
+		default:
+		}
+	}
+
+	// When we write the chunk, we'll write the WINDOW_UPDATE frame if needed
 	s.receiveWindow += s.windowUpdate
 	s.windowUpdate = 0
+
+	// When we write the chunk, we'll write the headers if needed
 	s.headersSent = true

 	// if this chunk contains the end of the stream, close the stream now
@@ -23,47 +23,55 @@ func TestFlowControlSingleStream(t *testing.T) {
 		sendWindow:              testWindowSize,
 		readyList:               NewReadyList(),
 	}
+	var tempWindowUpdate uint32
+	var tempStreamChunk *streamChunk
+
 	assert.True(t, stream.consumeReceiveWindow(testWindowSize/2))
 	dataSent := testWindowSize / 2
 	assert.Equal(t, testWindowSize-dataSent, stream.receiveWindow)
 	assert.Equal(t, testWindowSize, stream.receiveWindowCurrentMax)
-	assert.Equal(t, uint32(0), stream.windowUpdate)
-	tempWindowUpdate := stream.windowUpdate
-
-	streamChunk := stream.getChunk()
-	assert.Equal(t, tempWindowUpdate, streamChunk.windowUpdate)
-	assert.Equal(t, testWindowSize-dataSent, stream.receiveWindow)
-	assert.Equal(t, uint32(0), stream.windowUpdate)
 	assert.Equal(t, testWindowSize, stream.sendWindow)
+	assert.Equal(t, uint32(0), stream.windowUpdate)
+
+	tempStreamChunk = stream.getChunk()
+	assert.Equal(t, uint32(0), tempStreamChunk.windowUpdate)
+	assert.Equal(t, testWindowSize-dataSent, stream.receiveWindow)
+	assert.Equal(t, testWindowSize, stream.receiveWindowCurrentMax)
+	assert.Equal(t, testWindowSize, stream.sendWindow)
+	assert.Equal(t, uint32(0), stream.windowUpdate)

 	assert.True(t, stream.consumeReceiveWindow(2))
 	dataSent += 2
 	assert.Equal(t, testWindowSize-dataSent, stream.receiveWindow)
 	assert.Equal(t, testWindowSize<<1, stream.receiveWindowCurrentMax)
-	assert.Equal(t, (testWindowSize<<1)-stream.receiveWindow, stream.windowUpdate)
+	assert.Equal(t, testWindowSize, stream.sendWindow)
+	assert.Equal(t, testWindowSize, stream.windowUpdate)
 	tempWindowUpdate = stream.windowUpdate

-	streamChunk = stream.getChunk()
-	assert.Equal(t, tempWindowUpdate, streamChunk.windowUpdate)
-	assert.Equal(t, testWindowSize<<1, stream.receiveWindow)
-	assert.Equal(t, uint32(0), stream.windowUpdate)
+	tempStreamChunk = stream.getChunk()
+	assert.Equal(t, tempWindowUpdate, tempStreamChunk.windowUpdate)
+	assert.Equal(t, (testWindowSize<<1)-dataSent, stream.receiveWindow)
+	assert.Equal(t, testWindowSize<<1, stream.receiveWindowCurrentMax)
 	assert.Equal(t, testWindowSize, stream.sendWindow)
+	assert.Equal(t, uint32(0), stream.windowUpdate)

 	assert.True(t, stream.consumeReceiveWindow(testWindowSize+10))
-	dataSent = testWindowSize + 10
+	dataSent += testWindowSize + 10
 	assert.Equal(t, (testWindowSize<<1)-dataSent, stream.receiveWindow)
 	assert.Equal(t, testWindowSize<<2, stream.receiveWindowCurrentMax)
-	assert.Equal(t, (testWindowSize<<2)-stream.receiveWindow, stream.windowUpdate)
+	assert.Equal(t, testWindowSize, stream.sendWindow)
+	assert.Equal(t, testWindowSize<<1, stream.windowUpdate)
 	tempWindowUpdate = stream.windowUpdate

-	streamChunk = stream.getChunk()
-	assert.Equal(t, tempWindowUpdate, streamChunk.windowUpdate)
-	assert.Equal(t, testWindowSize<<2, stream.receiveWindow)
-	assert.Equal(t, uint32(0), stream.windowUpdate)
+	tempStreamChunk = stream.getChunk()
+	assert.Equal(t, tempWindowUpdate, tempStreamChunk.windowUpdate)
+	assert.Equal(t, (testWindowSize<<2)-dataSent, stream.receiveWindow)
+	assert.Equal(t, testWindowSize<<2, stream.receiveWindowCurrentMax)
 	assert.Equal(t, testWindowSize, stream.sendWindow)
+	assert.Equal(t, uint32(0), stream.windowUpdate)

 	assert.False(t, stream.consumeReceiveWindow(testMaxWindowSize+1))
-	assert.Equal(t, testWindowSize<<2, stream.receiveWindow)
+	assert.Equal(t, (testWindowSize<<2)-dataSent, stream.receiveWindow)
 	assert.Equal(t, testMaxWindowSize, stream.receiveWindowCurrentMax)
 }

@@ -17,7 +17,24 @@ const (
 	updateFreq = time.Second
 )

-type muxMetricsUpdater struct {
+type muxMetricsUpdater interface {
+	// metrics returns the latest metrics
+	metrics() *MuxerMetrics
+	// run is a blocking call to start the event loop
+	run(logger *log.Entry) error
+	// updateRTTChan is called by muxReader to report new RTT measurements
+	updateRTT(rtt *roundTripMeasurement)
+	//updateReceiveWindowChan is called by muxReader and muxWriter when receiveWindow size is updated
+	updateReceiveWindow(receiveWindow uint32)
+	//updateSendWindowChan is called by muxReader and muxWriter when sendWindow size is updated
+	updateSendWindow(sendWindow uint32)
+	// updateInBoundBytesChan is called  periodicallyby muxReader to report bytesRead
+	updateInBoundBytes(inBoundBytes uint64)
+	// updateOutBoundBytesChan is called periodically by muxWriter to report bytesWrote
+	updateOutBoundBytes(outBoundBytes uint64)
+}
+
+type muxMetricsUpdaterImpl struct {
 	// rttData keeps record of rtt, rttMin, rttMax and last measured time
 	rttData *rttData
 	// receiveWindowData keeps record of receive window measurement
@@ -28,16 +45,16 @@ type muxMetricsUpdater struct {
 	inBoundRate *rate
 	// outBoundRate is outgoing bytes/sec
 	outBoundRate *rate
-	// updateRTTChan is the channel to receive new RTT measurement from muxReader
-	updateRTTChan <-chan *roundTripMeasurement
-	//updateReceiveWindowChan is the channel to receive updated receiveWindow size from muxReader and muxWriter
-	updateReceiveWindowChan <-chan uint32
-	//updateSendWindowChan is the channel to receive updated sendWindow size from muxReader and muxWriter
-	updateSendWindowChan <-chan uint32
-	// updateInBoundBytesChan us the channel to receive bytesRead from muxReader
-	updateInBoundBytesChan <-chan uint64
-	// updateOutBoundBytesChan us the channel to receive bytesWrote from muxWriter
-	updateOutBoundBytesChan <-chan uint64
+	// updateRTTChan is the channel to receive new RTT measurement
+	updateRTTChan chan *roundTripMeasurement
+	//updateReceiveWindowChan is the channel to receive updated receiveWindow size
+	updateReceiveWindowChan chan uint32
+	//updateSendWindowChan is the channel to receive updated sendWindow size
+	updateSendWindowChan chan uint32
+	// updateInBoundBytesChan us the channel to receive bytesRead
+	updateInBoundBytesChan chan uint64
+	// updateOutBoundBytesChan us the channel to receive bytesWrote
+	updateOutBoundBytesChan chan uint64
 	// shutdownC is to signal the muxerMetricsUpdater to shutdown
 	abortChan <-chan struct{}

@@ -84,15 +101,16 @@ type rate struct {
 }

 func newMuxMetricsUpdater(
-	updateRTTChan <-chan *roundTripMeasurement,
-	updateReceiveWindowChan <-chan uint32,
-	updateSendWindowChan <-chan uint32,
-	updateInBoundBytesChan <-chan uint64,
-	updateOutBoundBytesChan <-chan uint64,
 	abortChan <-chan struct{},
 	compBytesBefore, compBytesAfter *AtomicCounter,
-) *muxMetricsUpdater {
-	return &muxMetricsUpdater{
+) muxMetricsUpdater {
+	updateRTTChan := make(chan *roundTripMeasurement, 1)
+	updateReceiveWindowChan := make(chan uint32, 1)
+	updateSendWindowChan := make(chan uint32, 1)
+	updateInBoundBytesChan := make(chan uint64)
+	updateOutBoundBytesChan := make(chan uint64)
+
+	return &muxMetricsUpdaterImpl{
 		rttData:                 newRTTData(),
 		receiveWindowData:       newFlowControlData(),
 		sendWindowData:          newFlowControlData(),
@@ -109,7 +127,7 @@ func newMuxMetricsUpdater(
 	}
 }

-func (updater *muxMetricsUpdater) Metrics() *MuxerMetrics {
+func (updater *muxMetricsUpdaterImpl) metrics() *MuxerMetrics {
 	m := &MuxerMetrics{}
 	m.RTT, m.RTTMin, m.RTTMax = updater.rttData.metrics()
 	m.ReceiveWindowAve, m.ReceiveWindowMin, m.ReceiveWindowMax = updater.receiveWindowData.metrics()
@@ -120,7 +138,7 @@ func (updater *muxMetricsUpdater) Metrics() *MuxerMetrics {
 	return m
 }

-func (updater *muxMetricsUpdater) run(parentLogger *log.Entry) error {
+func (updater *muxMetricsUpdaterImpl) run(parentLogger *log.Entry) error {
 	logger := parentLogger.WithFields(log.Fields{
 		"subsystem": "mux",
 		"dir":       "metrics",
@@ -152,6 +170,43 @@ func (updater *muxMetricsUpdater) run(parentLogger *log.Entry) error {
 	}
 }

+func (updater *muxMetricsUpdaterImpl) updateRTT(rtt *roundTripMeasurement) {
+	select {
+	case updater.updateRTTChan <- rtt:
+	case <-updater.abortChan:
+	}
+
+}
+
+func (updater *muxMetricsUpdaterImpl) updateReceiveWindow(receiveWindow uint32) {
+	select {
+	case updater.updateReceiveWindowChan <- receiveWindow:
+	case <-updater.abortChan:
+	}
+}
+
+func (updater *muxMetricsUpdaterImpl) updateSendWindow(sendWindow uint32) {
+	select {
+	case updater.updateSendWindowChan <- sendWindow:
+	case <-updater.abortChan:
+	}
+}
+
+func (updater *muxMetricsUpdaterImpl) updateInBoundBytes(inBoundBytes uint64) {
+	select {
+	case updater.updateInBoundBytesChan <- inBoundBytes:
+	case <-updater.abortChan:
+	}
+
+}
+
+func (updater *muxMetricsUpdaterImpl) updateOutBoundBytes(outBoundBytes uint64) {
+	select {
+	case updater.updateOutBoundBytesChan <- outBoundBytes:
+	case <-updater.abortChan:
+	}
+}
+
 func newRTTData() *rttData {
 	return &rttData{}
 }
@@ -86,24 +86,11 @@ func TestFlowControlDataUpdate(t *testing.T) {
 }

 func TestMuxMetricsUpdater(t *testing.T) {
-	t.Skip("Race condition")
-	updateRTTChan := make(chan *roundTripMeasurement)
-	updateReceiveWindowChan := make(chan uint32)
-	updateSendWindowChan := make(chan uint32)
-	updateInBoundBytesChan := make(chan uint64)
-	updateOutBoundBytesChan := make(chan uint64)
-	abortChan := make(chan struct{})
+	t.Skip("Inherently racy test due to muxMetricsUpdaterImpl.run()")
 	errChan := make(chan error)
+	abortChan := make(chan struct{})
 	compBefore, compAfter := NewAtomicCounter(0), NewAtomicCounter(0)
-	m := newMuxMetricsUpdater(updateRTTChan,
-		updateReceiveWindowChan,
-		updateSendWindowChan,
-		updateInBoundBytesChan,
-		updateOutBoundBytesChan,
-		abortChan,
-		compBefore,
-		compAfter,
-	)
+	m := newMuxMetricsUpdater(abortChan, compBefore, compAfter)
 	logger := log.NewEntry(log.New())

 	go func() {
@@ -116,42 +103,44 @@ func TestMuxMetricsUpdater(t *testing.T) {
 	// mock muxReader
 	readerStart := time.Now()
 	rm := &roundTripMeasurement{receiveTime: readerStart, sendTime: readerStart}
-	updateRTTChan <- rm
+	m.updateRTT(rm)
 	go func() {
 		defer wg.Done()
-		// Becareful if dataPoints is not divisibile by 4
+		assert.Equal(t, 0, dataPoints%4,
+			"dataPoints is not divisible by 4; this test should be adjusted accordingly")
 		readerSend := readerStart.Add(time.Millisecond)
 		for i := 1; i <= dataPoints/4; i++ {
 			readerReceive := readerSend.Add(time.Duration(i) * time.Millisecond)
 			rm := &roundTripMeasurement{receiveTime: readerReceive, sendTime: readerSend}
-			updateRTTChan <- rm
+			m.updateRTT(rm)
 			readerSend = readerReceive.Add(time.Millisecond)
+			m.updateReceiveWindow(uint32(i))
+			m.updateSendWindow(uint32(i))

-			updateReceiveWindowChan <- uint32(i)
-			updateSendWindowChan <- uint32(i)
-
-			updateInBoundBytesChan <- uint64(i)
+			m.updateInBoundBytes(uint64(i))
 		}
 	}()

 	// mock muxWriter
 	go func() {
 		defer wg.Done()
+		assert.Equal(t, 0, dataPoints%4,
+			"dataPoints is not divisible by 4; this test should be adjusted accordingly")
 		for j := dataPoints/4 + 1; j <= dataPoints/2; j++ {
-			updateReceiveWindowChan <- uint32(j)
-			updateSendWindowChan <- uint32(j)
+			m.updateReceiveWindow(uint32(j))
+			m.updateSendWindow(uint32(j))

-			// should always be disgard since the send time is before readerSend
+			// should always be disgarded since the send time is before readerSend
 			rm := &roundTripMeasurement{receiveTime: readerStart, sendTime: readerStart.Add(-time.Duration(j*dataPoints) * time.Millisecond)}
-			updateRTTChan <- rm
+			m.updateRTT(rm)

-			updateOutBoundBytesChan <- uint64(j)
+			m.updateOutBoundBytes(uint64(j))
 		}

 	}()
 	wg.Wait()

-	metrics := m.Metrics()
+	metrics := m.metrics()
 	points := dataPoints / 2
 	assert.Equal(t, time.Millisecond, metrics.RTTMin)
 	assert.Equal(t, time.Duration(dataPoints/4)*time.Millisecond, metrics.RTTMax)
@@ -35,18 +35,14 @@ type MuxReader struct {
 	initialStreamWindow uint32
 	// The max value for the send window of a stream.
 	streamWindowMax uint32
+	// The max size for the write buffer of a stream
+	streamWriteBufferMaxLen int
 	// r is a reference to the underlying connection used when shutting down.
 	r io.Closer
-	// updateRTTChan is the channel to send new RTT measurement to muxerMetricsUpdater
-	updateRTTChan chan<- *roundTripMeasurement
-	// updateReceiveWindowChan is the channel to update receiveWindow size to muxerMetricsUpdater
-	updateReceiveWindowChan chan<- uint32
-	// updateSendWindowChan is the channel to update sendWindow size to muxerMetricsUpdater
-	updateSendWindowChan chan<- uint32
-	// bytesRead is the amount of bytes read from data frame since the last time we send bytes read to metrics
+	// metricsUpdater is used to report metrics
+	metricsUpdater muxMetricsUpdater
+	// bytesRead is the amount of bytes read from data frames since the last time we called metricsUpdater.updateInBoundBytes()
 	bytesRead *AtomicCounter
-	// updateOutBoundBytesChan is the channel to send bytesWrote to muxerMetricsUpdater
-	updateInBoundBytesChan chan<- uint64
 	// dictionaries holds the h2 cross-stream compression dictionaries
 	dictionaries h2Dictionaries
 }
@@ -79,7 +75,7 @@ func (r *MuxReader) run(parentLogger *log.Entry) error {
 			case <-r.abortChan:
 				return
 			case <-tickC:
-				r.updateInBoundBytesChan <- r.bytesRead.Count()
+				r.metricsUpdater.updateInBoundBytes(r.bytesRead.Count())
 			}
 		}
 	}()
@@ -153,6 +149,8 @@ func (r *MuxReader) newMuxedStream(streamID uint32) *MuxedStream {
 		streamID:                streamID,
 		readBuffer:              NewSharedBuffer(),
 		writeBuffer:             &bytes.Buffer{},
+		writeBufferMaxLen:       r.streamWriteBufferMaxLen,
+		writeBufferHasSpace:     make(chan struct{}, 1),
 		receiveWindow:           r.initialStreamWindow,
 		receiveWindowCurrentMax: r.initialStreamWindow,
 		receiveWindowMax:        r.streamWindowMax,
@@ -285,7 +283,7 @@ func (r *MuxReader) receiveFrameData(frame *http2.DataFrame, parentLogger *log.E
 	if !stream.consumeReceiveWindow(uint32(len(data))) {
 		return r.streamError(stream.streamID, http2.ErrCodeFlowControl)
 	}
-	r.updateReceiveWindowChan <- stream.getReceiveWindow()
+	r.metricsUpdater.updateReceiveWindow(stream.getReceiveWindow())
 	return nil
 }

@@ -297,13 +295,13 @@ func (r *MuxReader) receivePingData(frame *http2.PingFrame) {
 		return
 	}

-	// Update updates the computed values with a new measurement.
-	// outgoingTime is the time that the probe was sent.
-	// We assume that time.Now() is the time we received that probe.
-	r.updateRTTChan <- &roundTripMeasurement{
+	// Update the computed RTT aggregations with a new measurement.
+	// `ts` is the time that the probe was sent.
+	// We assume that `time.Now()` is the time we received that probe.
+	r.metricsUpdater.updateRTT(&roundTripMeasurement{
 		receiveTime: time.Now(),
 		sendTime:    time.Unix(0, ts),
-	}
+	})
 }

 // Receive a GOAWAY from the peer. Gracefully shut down our connection.
@@ -464,7 +462,7 @@ func (r *MuxReader) updateStreamWindow(frame *http2.WindowUpdateFrame) error {
 		return nil
 	}
 	stream.replenishSendWindow(frame.Increment)
-	r.updateSendWindowChan <- stream.getSendWindow()
+	r.metricsUpdater.updateSendWindow(stream.getSendWindow())
 	return nil
 }

@@ -40,14 +40,11 @@ type MuxWriter struct {
 	headerEncoder *hpack.Encoder
 	// headerBuffer is the temporary buffer used by headerEncoder.
 	headerBuffer bytes.Buffer
-	// updateReceiveWindowChan is the channel to update receiveWindow size to muxerMetricsUpdater
-	updateReceiveWindowChan chan<- uint32
-	// updateSendWindowChan is the channel to update sendWindow size to muxerMetricsUpdater
-	updateSendWindowChan chan<- uint32
-	// bytesWrote is the amount of bytes wrote to data frame since the last time we send bytes wrote to metrics
+
+	// metricsUpdater is used to report metrics
+	metricsUpdater muxMetricsUpdater
+	// bytesWrote is the amount of bytes written to data frames since the last time we called metricsUpdater.updateOutBoundBytes()
 	bytesWrote *AtomicCounter
-	// updateOutBoundBytesChan is the channel to send bytesWrote to muxerMetricsUpdater
-	updateOutBoundBytesChan chan<- uint64

 	useDictChan <-chan useDictRequest
 }
@@ -83,7 +80,7 @@ func (w *MuxWriter) run(parentLogger *log.Entry) error {
 			case <-w.abortChan:
 				return
 			case <-tickC:
-				w.updateOutBoundBytesChan <- w.bytesWrote.Count()
+				w.metricsUpdater.updateOutBoundBytes(w.bytesWrote.Count())
 			}
 		}
 	}()
@@ -172,8 +169,8 @@ func (w *MuxWriter) run(parentLogger *log.Entry) error {
 func (w *MuxWriter) writeStreamData(stream *MuxedStream, logger *log.Entry) error {
 	logger.Debug("writable")
 	chunk := stream.getChunk()
-	w.updateReceiveWindowChan <- stream.getReceiveWindow()
-	w.updateSendWindowChan <- stream.getSendWindow()
+	w.metricsUpdater.updateReceiveWindow(stream.getReceiveWindow())
+	w.metricsUpdater.updateSendWindow(stream.getSendWindow())
 	if chunk.sendHeadersFrame() {
 		err := w.writeHeaders(chunk.streamID, chunk.headers)
 		if err != nil {
@@ -1,15 +1,23 @@
 package h2mux

+import "sync"
+
 // ReadyList multiplexes several event signals onto a single channel.
 type ReadyList struct {
+	// signalC is used to signal that a stream can be enqueued
 	signalC chan uint32
-	waitC   chan uint32
+	// waitC is used to signal the ID of the first ready descriptor
+	waitC chan uint32
+	// doneC is used to signal that run should terminate
+	doneC     chan struct{}
+	closeOnce sync.Once
 }

 func NewReadyList() *ReadyList {
 	rl := &ReadyList{
 		signalC: make(chan uint32),
 		waitC:   make(chan uint32),
+		doneC:   make(chan struct{}),
 	}
 	go rl.run()
 	return rl
@@ -17,7 +25,11 @@ func NewReadyList() *ReadyList {

 // ID is the stream ID
 func (r *ReadyList) Signal(ID uint32) {
-	r.signalC <- ID
+	select {
+	case r.signalC <- ID:
+	// ReadyList already closed
+	case <-r.doneC:
+	}
 }

 func (r *ReadyList) ReadyChannel() <-chan uint32 {
@@ -25,7 +37,9 @@ func (r *ReadyList) ReadyChannel() <-chan uint32 {
 }

 func (r *ReadyList) Close() {
-	close(r.signalC)
+	r.closeOnce.Do(func() {
+		close(r.doneC)
+	})
 }

 func (r *ReadyList) run() {
@@ -35,28 +49,25 @@ func (r *ReadyList) run() {
 	activeDescriptors := newReadyDescriptorMap()
 	for {
 		if firstReady == nil {
-			// Wait for first ready descriptor
-			i, ok := <-r.signalC
-			if !ok {
-				// closed
+			select {
+			case i := <-r.signalC:
+				firstReady = activeDescriptors.SetIfMissing(i)
+			case <-r.doneC:
 				return
 			}
-			firstReady = activeDescriptors.SetIfMissing(i)
 		}
 		select {
 		case r.waitC <- firstReady.ID:
 			activeDescriptors.Delete(firstReady.ID)
 			firstReady = queue.Dequeue()
-		case i, ok := <-r.signalC:
-			if !ok {
-				// closed
-				return
-			}
+		case i := <-r.signalC:
 			newReady := activeDescriptors.SetIfMissing(i)
 			if newReady != nil {
 				// key doesn't exist
 				queue.Enqueue(newReady)
 			}
+		case <-r.doneC:
+			return
 		}
 	}
 }
@@ -3,36 +3,59 @@ package h2mux
 import (
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/assert"
 )

-func TestReadyList(t *testing.T) {
+func assertEmpty(t *testing.T, rl *ReadyList) {
+	select {
+	case <-rl.ReadyChannel():
+		t.Fatal("Spurious wakeup")
+	default:
+	}
+}
+
+func assertClosed(t *testing.T, rl *ReadyList) {
+	select {
+	case _, ok := <-rl.ReadyChannel():
+		assert.False(t, ok, "ReadyChannel was not closed")
+	case <-time.After(100 * time.Millisecond):
+		t.Fatalf("Timeout")
+	}
+}
+
+func receiveWithTimeout(t *testing.T, rl *ReadyList) uint32 {
+	select {
+	case i := <-rl.ReadyChannel():
+		return i
+	case <-time.After(100 * time.Millisecond):
+		t.Fatalf("Timeout")
+		return 0
+	}
+}
+
+func TestReadyListEmpty(t *testing.T) {
 	rl := NewReadyList()
-	c := rl.ReadyChannel()
-	// helper functions
-	assertEmpty := func() {
-		select {
-		case <-c:
-			t.Fatalf("Spurious wakeup")
-		default:
-		}
-	}
-	receiveWithTimeout := func() uint32 {
-		select {
-		case i := <-c:
-			return i
-		case <-time.After(100 * time.Millisecond):
-			t.Fatalf("Timeout")
-			return 0
-		}
-	}
+
 	// no signals, receive should fail
-	assertEmpty()
+	assertEmpty(t, rl)
+}
+func TestReadyListSignal(t *testing.T) {
+	rl := NewReadyList()
+	assertEmpty(t, rl)
+
 	rl.Signal(0)
-	if receiveWithTimeout() != 0 {
+	if receiveWithTimeout(t, rl) != 0 {
 		t.Fatalf("Received wrong ID of signalled event")
 	}
-	// no new signals, receive should fail
-	assertEmpty()
+
+	assertEmpty(t, rl)
+}
+
+func TestReadyListMultipleSignals(t *testing.T) {
+	rl := NewReadyList()
+	assertEmpty(t, rl)
+
 	// Signals should not block;
 	// Duplicate unhandled signals should not cause multiple wakeups
 	signalled := [5]bool{}
@@ -42,12 +65,45 @@ func TestReadyList(t *testing.T) {
 	}
 	// All signals should be received once (in any order)
 	for range signalled {
-		i := receiveWithTimeout()
+		i := receiveWithTimeout(t, rl)
 		if signalled[i] {
 			t.Fatalf("Received signal %d more than once", i)
 		}
 		signalled[i] = true
 	}
+	for i := range signalled {
+		if !signalled[i] {
+			t.Fatalf("Never received signal %d", i)
+		}
+	}
+	assertEmpty(t, rl)
+}
+
+func TestReadyListClose(t *testing.T) {
+	rl := NewReadyList()
+	rl.Close()
+
+	// readyList.run() occurs in a separate goroutine,
+	// so there's no way to directly check that run() has terminated.
+	// Perform an indirect check: is the ready channel closed?
+	assertClosed(t, rl)
+
+	// a second rl.Close() shouldn't cause a panic
+	rl.Close()
+
+	// Signal shouldn't block after Close()
+	done := make(chan struct{})
+	go func() {
+		for i := 0; i < 5; i++ {
+			rl.Signal(uint32(i))
+		}
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("Test timed out")
+	}
 }

 func TestReadyDescriptorQueue(t *testing.T) {
@@ -43,7 +43,7 @@ const indexTemplate = `
    <meta name="description" content="Argo Tunnel Connection">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <style>
-      html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}section{display:block}h1{font-size:2em;margin:.67em 0}a{background-color:transparent;-webkit-text-decoration-skip:objects}/* 1 */::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}/* 1 */a,body,dd,div,dl,dt,h1,h4,html,p,section{box-sizing:border-box}.bt{border-top-style:solid;border-top-width:1px}.bl{border-left-style:solid;border-left-width:1px}.b--orange{border-color:#f38020}.br1{border-radius:.125rem}.bw2{border-width:.25rem}.dib{display:inline-block}.sans-serif{font-family:open sans,-apple-system,BlinkMacSystemFont,avenir next,avenir,helvetica neue,helvetica,ubuntu,roboto,noto,segoe ui,arial,sans-serif}.code{font-family:Consolas,monaco,monospace}.b{font-weight:700}.fw3{font-weight:300}.fw4{font-weight:400}.fw5{font-weight:500}.fw6{font-weight:600}.lh-copy{line-height:1.5}.link{text-decoration:none}.link,.link:active,.link:focus,.link:hover,.link:link,.link:visited{transition:color .15s ease-in}.link:focus{outline:1px dotted currentColor}.mw-100{max-width:100%}.mw4{max-width:8rem}.mw7{max-width:48rem}.bg-light-gray{background-color:#f7f7f7}.link-hover:hover{background-color:#1f679e}.white{color:#fff}.bg-white{background-color:#fff}.bg-blue{background-color:#408bc9}.pb2{padding-bottom:.5rem}.pb6{padding-bottom:8rem}.pt3{padding-top:1rem}.pt5{padding-top:4rem}.pv2{padding-top:.5rem;padding-bottom:.5rem}.ph3{padding-left:1rem;padding-right:1rem}.ph4{padding-left:2rem;padding-right:2rem}.ml0{margin-left:0}.mb1{margin-bottom:.25rem}.mb2{margin-bottom:.5rem}.mb3{margin-bottom:1rem}.mt5{margin-top:4rem}.ttu{text-transform:uppercase}.f4{font-size:1.25rem}.f5{font-size:1rem}.f6{font-size:.875rem}.f7{font-size:.75rem}.measure{max-width:30em}.center{margin-left:auto}.center{margin-right:auto}@media screen and (min-width:30em){.f2-ns{font-size:2.25rem}}@media screen and (min-width:30em) and (max-width:60em){.f5-m{font-size:1rem}}@media screen and (min-width:60em){.f4-l{font-size:1.25rem}}
+      html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}section{display:block}h1{font-size:2em;margin:.67em 0}a{background-color:transparent;-webkit-text-decoration-skip:objects}/* 1 */::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}/* 1 */a,body,dd,div,dl,dt,h1,h4,html,p,section{box-sizing:border-box}.bt{border-top-style:solid;border-top-width:1px}.bl{border-left-style:solid;border-left-width:1px}.b--orange{border-color:#f38020}.br1{border-radius:.125rem}.bw2{border-width:.25rem}.dib{display:inline-block}.sans-serif{font-family:open sans,-apple-system,BlinkMacSystemFont,avenir next,avenir,helvetica neue,helvetica,ubuntu,roboto,noto,segoe ui,arial,sans-serif}.overflow-x-auto{overflow-x:auto}.code{font-family:Consolas,monaco,monospace}.b{font-weight:700}.fw3{font-weight:300}.fw4{font-weight:400}.fw5{font-weight:500}.fw6{font-weight:600}.lh-copy{line-height:1.5}.link{text-decoration:none}.link,.link:active,.link:focus,.link:hover,.link:link,.link:visited{transition:color .15s ease-in}.link:focus{outline:1px dotted currentColor}.mw-100{max-width:100%}.mw4{max-width:8rem}.mw7{max-width:48rem}.bg-light-gray{background-color:#f7f7f7}.link-hover:hover{background-color:#1f679e}.white{color:#fff}.bg-white{background-color:#fff}.bg-blue{background-color:#408bc9}.pb2{padding-bottom:.5rem}.pb6{padding-bottom:8rem}.pt3{padding-top:1rem}.pt5{padding-top:4rem}.pv2{padding-top:.5rem;padding-bottom:.5rem}.ph3{padding-left:1rem;padding-right:1rem}.ph4{padding-left:2rem;padding-right:2rem}.ml0{margin-left:0}.mb1{margin-bottom:.25rem}.mb2{margin-bottom:.5rem}.mb3{margin-bottom:1rem}.mt5{margin-top:4rem}.ttu{text-transform:uppercase}.f4{font-size:1.25rem}.f5{font-size:1rem}.f6{font-size:.875rem}.f7{font-size:.75rem}.measure{max-width:30em}.center{margin-left:auto}.center{margin-right:auto}@media screen and (min-width:30em){.f2-ns{font-size:2.25rem}}@media screen and (min-width:30em) and (max-width:60em){.f5-m{font-size:1rem}}@media screen and (min-width:60em){.f4-l{font-size:1.25rem}}
    .st0{fill:#FFF}.st1{fill:#f48120}.st2{fill:#faad3f}.st3{fill:#404041}
    </style>
  </head>
@@ -91,7 +91,6 @@ const indexTemplate = `
 </html>
 `

-
 func StartHelloWorldServer(logger *logrus.Logger, listener net.Listener, shutdownC <-chan struct{}) error {
 	logger.Infof("Starting Hello World server at %s", listener.Addr())
 	serverName := defaultServerName
@@ -132,7 +131,6 @@ func CreateTLSListener(address string) (net.Listener, error) {
 	return listener, err
 }

-
 func uptimeHandler(startTime time.Time) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// Note that if autoupdate is enabled, the uptime is reset when a new client
@@ -1,6 +1,7 @@
 package metrics

 import (
+	"context"
 	"net"
 	"net/http"
 	_ "net/http/pprof"
@@ -8,7 +9,6 @@ import (
 	"sync"
 	"time"

-	"golang.org/x/net/context"
 	"golang.org/x/net/trace"

 	"github.com/prometheus/client_golang/prometheus"
@@ -1,9 +1,8 @@
 package origin

 import (
+	"context"
 	"time"
-
-	"golang.org/x/net/context"
 )

 // Redeclare time functions so they can be overridden in tests.
@@ -1,10 +1,9 @@
 package origin

 import (
+	"context"
 	"testing"
 	"time"
-
-	"golang.org/x/net/context"
 )

 func immediateTimeAfter(time.Duration) <-chan time.Time {
@@ -0,0 +1,117 @@
+package origin
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/cloudflare/golibs/lrucache"
+)
+
+// StatusPage.io API docs:
+// https://www.cloudflarestatus.com/api/v2/#incidents-unresolved
+const (
+	activeIncidentsURL    = "https://yh6f0r4529hb.statuspage.io/api/v2/incidents/unresolved.json"
+	argoTunnelKeyword     = "argo tunnel"
+	incidentDetailsPrefix = "https://www.cloudflarestatus.com/incidents/"
+)
+
+// IncidentLookup is an object that checks for active incidents in
+// the Cloudflare infrastructure.
+type IncidentLookup interface {
+	ActiveIncidents() []Incident
+}
+
+// NewIncidentLookup returns a new IncidentLookup instance that caches its
+// results with a 1-minute TTL.
+func NewIncidentLookup() IncidentLookup {
+	return newCachedIncidentLookup(fetchActiveIncidents)
+}
+
+type IncidentUpdate struct {
+	Body string
+}
+
+type Incident struct {
+	Name    string
+	ID      string           `json:"id"`
+	Updates []IncidentUpdate `json:"incident_updates"`
+}
+
+type StatusPage struct {
+	Incidents []Incident
+}
+
+func (i Incident) URL() string {
+	return incidentDetailsPrefix + i.ID
+}
+
+func parseStatusPage(data []byte) (*StatusPage, error) {
+	var result StatusPage
+	err := json.Unmarshal(data, &result)
+	return &result, err
+}
+
+func isArgoTunnelIncident(i Incident) bool {
+	if strings.Contains(strings.ToLower(i.Name), argoTunnelKeyword) {
+		return true
+	}
+	for _, u := range i.Updates {
+		if strings.Contains(strings.ToLower(u.Body), argoTunnelKeyword) {
+			return true
+		}
+	}
+	return false
+}
+
+func fetchActiveIncidents() (incidents []Incident) {
+	resp, err := http.Get(activeIncidentsURL)
+	if err != nil {
+		return
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return
+	}
+	statusPage, err := parseStatusPage(body)
+	if err != nil {
+		return
+	}
+	for _, i := range statusPage.Incidents {
+		if isArgoTunnelIncident(i) {
+			incidents = append(incidents, i)
+		}
+	}
+	return incidents
+}
+
+type cachedIncidentLookup struct {
+	cache          *lrucache.LRUCache
+	ttl            time.Duration
+	uncachedLookup func() []Incident
+}
+
+func newCachedIncidentLookup(uncachedLookup func() []Incident) *cachedIncidentLookup {
+	return &cachedIncidentLookup{
+		cache:          lrucache.NewLRUCache(1),
+		ttl:            time.Minute,
+		uncachedLookup: uncachedLookup,
+	}
+}
+
+// We only need one cache entry. Always use the empty string as its key.
+const cacheKey = ""
+
+func (c *cachedIncidentLookup) ActiveIncidents() []Incident {
+	if cached, ok := c.cache.GetNotStale(cacheKey); ok {
+		if incidents, ok := cached.([]Incident); ok {
+			return incidents
+		}
+	}
+	incidents := c.uncachedLookup()
+	c.cache.Set(cacheKey, incidents, time.Now().Add(c.ttl))
+	return incidents
+}
@@ -0,0 +1,386 @@
+package origin
+
+import (
+	"testing"
+	"time"
+
+	"github.com/cloudflare/golibs/lrucache"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseStatusPage(t *testing.T) {
+	testCases := []struct {
+		input  []byte
+		output *StatusPage
+		fail   bool
+	}{
+		{
+			input: []byte(`<html>
+				<head><title>504 Gateway Time-out</title></head>
+				<body><center><h1>504 Gateway Time-out</h1></center></body>
+			</html>`),
+			output: nil,
+			fail:   true,
+		},
+		{
+			input: []byte(`{
+				"page": {
+					"id": "yh6f0r4529hb",
+					"name": "Cloudflare",
+					"url": "https://www.cloudflarestatus.com",
+					"time_zone": "Etc/UTC",
+					"updated_at": "2019-01-10T20:11:38.750Z"
+				},
+				"incidents": [
+					{
+						"name": "Cloudflare API service issues",
+						"status": "resolved",
+						"created_at": "2018-09-17T19:29:21.132Z",
+						"updated_at": "2018-09-18T07:45:41.313Z",
+						"monitoring_at": "2018-09-17T21:35:06.492Z",
+						"resolved_at": "2018-09-18T07:45:41.290Z",
+						"shortlink": "http://stspg.io/7f079791e",
+						"id": "q746ybtyb6q0",
+						"page_id": "yh6f0r4529hb",
+						"incident_updates": [
+							{
+								"status": "resolved",
+								"body": "Cloudflare has resolved the issue and the service have resumed normal operation.",
+								"created_at": "2018-09-18T07:45:41.290Z",
+								"updated_at": "2018-09-18T07:45:41.290Z",
+								"display_at": "2018-09-18T07:45:41.290Z",
+								"affected_components": [
+									{
+										"code": "g4tb35rs9yw7",
+										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
+										"old_status": "operational",
+										"new_status": "operational"
+									}
+								],
+								"deliver_notifications": true,
+								"tweet_id": null,
+								"id": "zl5g2pl5zhfs",
+								"incident_id": "q746ybtyb6q0",
+								"custom_tweet": null
+							},
+							{
+								"status": "monitoring",
+								"body": "Cloudflare has implemented a fix for this issue and is currently monitoring the results.\r\n\r\nWe will update the status once the issue is resolved.",
+								"created_at": "2018-09-17T21:35:06.492Z",
+								"updated_at": "2018-09-17T21:35:06.492Z",
+								"display_at": "2018-09-17T21:35:06.492Z",
+								"affected_components": [
+									{
+										"code": "g4tb35rs9yw7",
+										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
+										"old_status": "degraded_performance",
+										"new_status": "operational"
+									}
+								],
+								"deliver_notifications": false,
+								"tweet_id": null,
+								"id": "0001sv3chdnx",
+								"incident_id": "q746ybtyb6q0",
+								"custom_tweet": null
+							},
+							{
+								"status": "investigating",
+								"body": "We are continuing to investigate this issue.",
+								"created_at": "2018-09-17T19:30:08.049Z",
+								"updated_at": "2018-09-17T19:30:08.049Z",
+								"display_at": "2018-09-17T19:30:08.049Z",
+								"affected_components": [
+									{
+										"code": "g4tb35rs9yw7",
+										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
+										"old_status": "operational",
+										"new_status": "degraded_performance"
+									}
+								],
+								"deliver_notifications": false,
+								"tweet_id": null,
+								"id": "qdr164tfpq7m",
+								"incident_id": "q746ybtyb6q0",
+								"custom_tweet": null
+							},
+							{
+								"status": "investigating",
+								"body": "Cloudflare is investigating issues with APIs and Page Rule delays for Page Rule updates.  Cloudflare Page Rule service delivery is unaffected and is operating normally.  Also, these issues do not affect the Cloudflare CDN and therefore, do not impact customer websites.",
+								"created_at": "2018-09-17T19:29:21.201Z",
+								"updated_at": "2018-09-17T19:29:21.201Z",
+								"display_at": "2018-09-17T19:29:21.201Z",
+								"affected_components": [
+									{
+										"code": "g4tb35rs9yw7",
+										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
+										"old_status": "operational",
+										"new_status": "operational"
+									}
+								],
+								"deliver_notifications": false,
+								"tweet_id": null,
+								"id": "qzl2n0q8tskg",
+								"incident_id": "q746ybtyb6q0",
+								"custom_tweet": null
+							}
+						],
+						"components": [
+							{
+								"status": "operational",
+								"name": "Cloudflare APIs",
+								"created_at": "2014-10-09T03:32:07.158Z",
+								"updated_at": "2019-01-01T22:58:30.846Z",
+								"position": 2,
+								"description": null,
+								"showcase": false,
+								"id": "g4tb35rs9yw7",
+								"page_id": "yh6f0r4529hb",
+								"group_id": "1km35smx8p41",
+								"group": false,
+								"only_show_if_degraded": false,
+								"automation_email": "component+g4tb35rs9yw7@notifications.statuspage.io"
+							}
+						],
+						"impact": "minor"
+					},
+					{
+						"name": "Web Analytics Delays",
+						"status": "resolved",
+						"created_at": "2018-09-17T18:05:39.907Z",
+						"updated_at": "2018-09-17T22:53:05.078Z",
+						"monitoring_at": null,
+						"resolved_at": "2018-09-17T22:53:05.057Z",
+						"shortlink": "http://stspg.io/cb208928c",
+						"id": "wqfk9mzs5qt1",
+						"page_id": "yh6f0r4529hb",
+						"incident_updates": [
+							{
+								"status": "resolved",
+								"body": "Cloudflare has resolved the issue and Web Analytics have resumed normal operation.",
+								"created_at": "2018-09-17T22:53:05.057Z",
+								"updated_at": "2018-09-17T22:53:05.057Z",
+								"display_at": "2018-09-17T22:53:05.057Z",
+								"affected_components": [
+									{
+										"code": "4c231tkdlpcl",
+										"name": "Cloudflare customer dashboard and APIs - Analytics",
+										"old_status": "degraded_performance",
+										"new_status": "operational"
+									}
+								],
+								"deliver_notifications": false,
+								"tweet_id": null,
+								"id": "93y1w00yqzk4",
+								"incident_id": "wqfk9mzs5qt1",
+								"custom_tweet": null
+							},
+							{
+								"status": "investigating",
+								"body": "There is a delay in processing Cloudflare Web Analytics. This affects timely delivery of customer data.\n\nThese delays do not impact analytics for DNS and Rate Limiting.",
+								"created_at": "2018-09-17T18:05:40.033Z",
+								"updated_at": "2018-09-17T18:05:40.033Z",
+								"display_at": "2018-09-17T18:05:40.033Z",
+								"affected_components": [
+									{
+										"code": "4c231tkdlpcl",
+										"name": "Cloudflare customer dashboard and APIs - Analytics",
+										"old_status": "operational",
+										"new_status": "degraded_performance"
+									}
+								],
+								"deliver_notifications": false,
+								"tweet_id": null,
+								"id": "362t6lv0vrpk",
+								"incident_id": "wqfk9mzs5qt1",
+								"custom_tweet": null
+							}
+						],
+						"components": [
+							{
+								"status": "operational",
+								"name": "Analytics",
+								"created_at": "2014-11-13T11:54:10.191Z",
+								"updated_at": "2018-12-31T08:20:52.349Z",
+								"position": 3,
+								"description": "Customer data",
+								"showcase": false,
+								"id": "4c231tkdlpcl",
+								"page_id": "yh6f0r4529hb",
+								"group_id": "1km35smx8p41",
+								"group": false,
+								"only_show_if_degraded": false,
+								"automation_email": "component+4c231tkdlpcl@notifications.statuspage.io"
+							}
+						],
+						"impact": "minor"
+					}
+				]
+			}`),
+			output: &StatusPage{
+				Incidents: []Incident{
+					Incident{
+						Name: "Cloudflare API service issues",
+						ID:   "q746ybtyb6q0",
+						Updates: []IncidentUpdate{
+							IncidentUpdate{
+								Body: "Cloudflare has resolved the issue and the service have resumed normal operation.",
+							},
+							IncidentUpdate{
+								Body: "Cloudflare has implemented a fix for this issue and is currently monitoring the results.\r\n\r\nWe will update the status once the issue is resolved.",
+							},
+							IncidentUpdate{
+								Body: "We are continuing to investigate this issue.",
+							},
+							IncidentUpdate{
+								Body: "Cloudflare is investigating issues with APIs and Page Rule delays for Page Rule updates.  Cloudflare Page Rule service delivery is unaffected and is operating normally.  Also, these issues do not affect the Cloudflare CDN and therefore, do not impact customer websites.",
+							},
+						},
+					},
+					Incident{
+						Name: "Web Analytics Delays",
+						ID:   "wqfk9mzs5qt1",
+						Updates: []IncidentUpdate{
+							IncidentUpdate{
+								Body: "Cloudflare has resolved the issue and Web Analytics have resumed normal operation.",
+							},
+							IncidentUpdate{
+								Body: "There is a delay in processing Cloudflare Web Analytics. This affects timely delivery of customer data.\n\nThese delays do not impact analytics for DNS and Rate Limiting.",
+							},
+						},
+					},
+				},
+			},
+			fail: false,
+		},
+	}
+
+	for _, testCase := range testCases {
+		output, err := parseStatusPage(testCase.input)
+		if testCase.fail {
+			assert.Error(t, err)
+		} else {
+			assert.Nil(t, err)
+			assert.Equal(t, testCase.output, output)
+		}
+	}
+}
+
+func TestIsArgoTunnelIncident(t *testing.T) {
+	testCases := []struct {
+		input  Incident
+		output bool
+	}{
+		{
+			input:  Incident{},
+			output: false,
+		},
+		{
+			input:  Incident{Name: "An Argo Tunnel incident"},
+			output: true,
+		},
+		{
+			input:  Incident{Name: "an argo tunnel incident"},
+			output: true,
+		},
+		{
+			input:  Incident{Name: "an aRgO TuNnEl incident"},
+			output: true,
+		},
+		{
+			input:  Incident{Name: "an argotunnel incident"},
+			output: false,
+		},
+		{
+			input:  Incident{Name: "irrelevant"},
+			output: false,
+		},
+		{
+			input: Incident{
+				Name: "irrelevant",
+				Updates: []IncidentUpdate{
+					IncidentUpdate{Body: "irrelevant"},
+					IncidentUpdate{Body: "an Argo Tunnel incident"},
+					IncidentUpdate{Body: "irrelevant"},
+				},
+			},
+			output: true,
+		},
+		{
+			input: Incident{
+				Name: "an Argo Tunnel incident",
+				Updates: []IncidentUpdate{
+					IncidentUpdate{Body: "irrelevant"},
+					IncidentUpdate{Body: "irrelevant"},
+					IncidentUpdate{Body: "irrelevant"},
+				},
+			},
+			output: true,
+		},
+	}
+	for _, testCase := range testCases {
+		actual := isArgoTunnelIncident(testCase.input)
+		assert.Equal(t, testCase.output, actual, "Test case failed: %v", testCase.input)
+	}
+}
+
+func TestIncidentURL(t *testing.T) {
+	incident := Incident{
+		ID: "s6k0dnn5347b",
+	}
+	assert.Equal(t, "https://www.cloudflarestatus.com/incidents/s6k0dnn5347b", incident.URL())
+}
+
+func TestNewCachedIncidentLookup(t *testing.T) {
+	c := newCachedIncidentLookup(func() []Incident { return nil })
+	assert.Equal(t, time.Minute, c.ttl)
+	assert.Equal(t, 1, c.cache.Capacity())
+}
+
+func TestCachedIncidentLookup(t *testing.T) {
+	expected := []Incident{
+		Incident{
+			Name: "An incident",
+			ID:   "incidentID",
+		},
+	}
+
+	var shouldCallUncachedLookup bool
+	c := &cachedIncidentLookup{
+		cache: lrucache.NewLRUCache(1),
+		ttl:   50 * time.Millisecond,
+		uncachedLookup: func() []Incident {
+			if !shouldCallUncachedLookup {
+				t.Fatal("uncachedLookup shouldn't have been called")
+			}
+			return expected
+		},
+	}
+
+	shouldCallUncachedLookup = true
+	assert.Equal(t, expected, c.ActiveIncidents())
+
+	shouldCallUncachedLookup = false
+	assert.Equal(t, expected, c.ActiveIncidents())
+	assert.Equal(t, expected, c.ActiveIncidents())
+
+	time.Sleep(50 * time.Millisecond)
+	shouldCallUncachedLookup = true
+	assert.Equal(t, expected, c.ActiveIncidents())
+}
+
+func TestCachedIncidentLookupDoesntPanic(t *testing.T) {
+	expected := []Incident{
+		Incident{
+			Name: "An incident",
+			ID:   "incidentID",
+		},
+	}
+	c := &cachedIncidentLookup{
+		cache:          lrucache.NewLRUCache(1),
+		ttl:            50 * time.Millisecond,
+		uncachedLookup: func() []Incident { return expected },
+	}
+	c.cache.Set(cacheKey, 42, time.Now().Add(30*time.Minute))
+	actual := c.ActiveIncidents()
+	assert.Equal(t, expected, actual)
+}
@@ -52,6 +52,7 @@ type TunnelMetrics struct {
 	oldServerLocations map[string]string

 	muxerMetrics *muxerMetrics
+	tunnelsHA    tunnelsForHA
 }

 func newMuxerMetrics() *muxerMetrics {
@@ -355,6 +356,7 @@ func NewTunnelMetrics() *TunnelMetrics {
 		serverLocations:                serverLocations,
 		oldServerLocations:             make(map[string]string),
 		muxerMetrics:                   newMuxerMetrics(),
+		tunnelsHA:                      NewTunnelsForHA(),
 	}
 }

@@ -375,7 +377,7 @@ func (t *TunnelMetrics) incrementRequests(connectionID string) {
 	var concurrentRequests uint64
 	var ok bool
 	if concurrentRequests, ok = t.concurrentRequests[connectionID]; ok {
-		t.concurrentRequests[connectionID] += 1
+		t.concurrentRequests[connectionID]++
 		concurrentRequests++
 	} else {
 		t.concurrentRequests[connectionID] = 1
@@ -395,7 +397,7 @@ func (t *TunnelMetrics) incrementRequests(connectionID string) {
 func (t *TunnelMetrics) decrementConcurrentRequests(connectionID string) {
 	t.concurrentRequestsLock.Lock()
 	if _, ok := t.concurrentRequests[connectionID]; ok {
-		t.concurrentRequests[connectionID] -= 1
+		t.concurrentRequests[connectionID]--
 	}
 	t.concurrentRequestsLock.Unlock()

@@ -1,11 +1,12 @@
 package origin

 import (
+	"context"
 	"fmt"
 	"net"
 	"time"

-	"golang.org/x/net/context"
+	"github.com/google/uuid"
 )

 const (
@@ -50,9 +51,9 @@ func NewSupervisor(config *TunnelConfig) *Supervisor {
 	}
 }

-func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}) error {
+func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) error {
 	logger := s.config.Logger
-	if err := s.initialize(ctx, connectedSignal); err != nil {
+	if err := s.initialize(ctx, connectedSignal, u); err != nil {
 		return err
 	}
 	var tunnelsWaiting []int
@@ -95,7 +96,7 @@ func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}) err
 		case <-backoffTimer:
 			backoffTimer = nil
 			for _, index := range tunnelsWaiting {
-				go s.startTunnel(ctx, index, s.newConnectedTunnelSignal(index))
+				go s.startTunnel(ctx, index, s.newConnectedTunnelSignal(index), u)
 			}
 			tunnelsActive += len(tunnelsWaiting)
 			tunnelsWaiting = nil
@@ -119,7 +120,7 @@ func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}) err
 	}
 }

-func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct{}) error {
+func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) error {
 	logger := s.config.Logger
 	edgeIPs, err := ResolveEdgeIPs(s.config.EdgeAddrs)
 	if err != nil {
@@ -134,7 +135,7 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 	s.lastResolve = time.Now()
 	// check entitlement and version too old error before attempting to register more tunnels
 	s.nextUnusedEdgeIP = s.config.HAConnections
-	go s.startFirstTunnel(ctx, connectedSignal)
+	go s.startFirstTunnel(ctx, connectedSignal, u)
 	select {
 	case <-ctx.Done():
 		<-s.tunnelErrors
@@ -146,7 +147,7 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 	}
 	// At least one successful connection, so start the rest
 	for i := 1; i < s.config.HAConnections; i++ {
-		go s.startTunnel(ctx, i, make(chan struct{}))
+		go s.startTunnel(ctx, i, make(chan struct{}), u)
 		time.Sleep(registrationInterval)
 	}
 	return nil
@@ -154,8 +155,8 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct

 // startTunnel starts the first tunnel connection. The resulting error will be sent on
 // s.tunnelErrors. It will send a signal via connectedSignal if registration succeed
-func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan struct{}) {
-	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal)
+func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) {
+	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal, u)
 	defer func() {
 		s.tunnelErrors <- tunnelError{index: 0, err: err}
 	}()
@@ -176,14 +177,14 @@ func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan
 		default:
 			return
 		}
-		err = ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal)
+		err = ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal, u)
 	}
 }

 // startTunnel starts a new tunnel connection. The resulting error will be sent on
 // s.tunnelErrors.
-func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal chan struct{}) {
-	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(index), uint8(index), connectedSignal)
+func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal chan struct{}, u uuid.UUID) {
+	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(index), uint8(index), connectedSignal, u)
 	s.tunnelErrors <- tunnelError{index: index, err: err}
 }

@@ -2,6 +2,7 @@ package origin

 import (
 	"bufio"
+	"context"
 	"crypto/tls"
 	"fmt"
 	"io"
@@ -12,7 +13,6 @@ import (
 	"strings"
 	"time"

-	"golang.org/x/net/context"
 	"golang.org/x/sync/errgroup"

 	"github.com/cloudflare/cloudflared/h2mux"
@@ -22,6 +22,7 @@ import (
 	"github.com/cloudflare/cloudflared/websocket"

 	raven "github.com/getsentry/raven-go"
+	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	_ "github.com/prometheus/client_golang/prometheus"
 	log "github.com/sirupsen/logrus"
@@ -54,7 +55,7 @@ type TunnelConfig struct {
 	HTTPTransport      http.RoundTripper
 	Metrics            *TunnelMetrics
 	MetricsUpdateFreq  time.Duration
-	ProtocolLogger     *log.Logger
+	TransportLogger    *log.Logger
 	Logger             *log.Logger
 	IsAutoupdated      bool
 	GracePeriod        time.Duration
@@ -62,6 +63,7 @@ type TunnelConfig struct {
 	NoChunkedEncoding  bool
 	WSGI               bool
 	CompressionQuality uint64
+	IncidentLookup     IncidentLookup
 }

 type dialError struct {
@@ -103,7 +105,7 @@ func (e clientRegisterTunnelError) Error() string {
 	return e.cause.Error()
 }

-func (c *TunnelConfig) RegistrationOptions(connectionID uint8, OriginLocalIP string) *tunnelpogs.RegistrationOptions {
+func (c *TunnelConfig) RegistrationOptions(connectionID uint8, OriginLocalIP string, uuid uuid.UUID) *tunnelpogs.RegistrationOptions {
 	policy := tunnelrpc.ExistingTunnelPolicy_balance
 	if c.HAConnections <= 1 && c.LBPool == "" {
 		policy = tunnelrpc.ExistingTunnelPolicy_disconnect
@@ -120,6 +122,7 @@ func (c *TunnelConfig) RegistrationOptions(connectionID uint8, OriginLocalIP str
 		IsAutoupdated:        c.IsAutoupdated,
 		RunFromTerminal:      c.RunFromTerminal,
 		CompressionQuality:   c.CompressionQuality,
+		UUID:                 uuid.String(),
 	}
 }

@@ -129,15 +132,21 @@ func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connecte
 		<-shutdownC
 		cancel()
 	}()
+
+	u, err := uuid.NewRandom()
+	if err != nil {
+		return err
+	}
+
 	// If a user specified negative HAConnections, we will treat it as requesting 1 connection
 	if config.HAConnections > 1 {
-		return NewSupervisor(config).Run(ctx, connectedSignal)
+		return NewSupervisor(config).Run(ctx, connectedSignal, u)
 	} else {
 		addrs, err := ResolveEdgeIPs(config.EdgeAddrs)
 		if err != nil {
 			return err
 		}
-		return ServeTunnelLoop(ctx, config, addrs[0], 0, connectedSignal)
+		return ServeTunnelLoop(ctx, config, addrs[0], 0, connectedSignal, u)
 	}
 }

@@ -146,6 +155,7 @@ func ServeTunnelLoop(ctx context.Context,
 	addr *net.TCPAddr,
 	connectionID uint8,
 	connectedSignal chan struct{},
+	u uuid.UUID,
 ) error {
 	logger := config.Logger
 	config.Metrics.incrementHaConnections()
@@ -161,7 +171,7 @@ func ServeTunnelLoop(ctx context.Context,
 	// Ensure the above goroutine will terminate if we return without connecting
 	defer connectedFuse.Fuse(false)
 	for {
-		err, recoverable := ServeTunnel(ctx, config, addr, connectionID, connectedFuse, &backoff)
+		err, recoverable := ServeTunnel(ctx, config, addr, connectionID, connectedFuse, &backoff, u)
 		if recoverable {
 			if duration, ok := backoff.GetBackoffDuration(ctx); ok {
 				logger.Infof("Retrying in %s seconds", duration)
@@ -180,6 +190,7 @@ func ServeTunnel(
 	connectionID uint8,
 	connectedFuse *h2mux.BooleanFuse,
 	backoff *BackoffHandler,
+	u uuid.UUID,
 ) (err error, recoverable bool) {
 	// Treat panics as recoverable errors
 	defer func() {
@@ -219,7 +230,7 @@ func ServeTunnel(
 	errGroup, serveCtx := errgroup.WithContext(ctx)

 	errGroup.Go(func() error {
-		err := RegisterTunnel(serveCtx, handler.muxer, config, connectionID, originLocalIP)
+		err := RegisterTunnel(serveCtx, handler.muxer, config, connectionID, originLocalIP, u)
 		if err == nil {
 			connectedFuse.Fuse(true)
 			backoff.SetGracePeriod()
@@ -233,7 +244,7 @@ func ServeTunnel(
 			select {
 			case <-serveCtx.Done():
 				// UnregisterTunnel blocks until the RPC call returns
-				err := UnregisterTunnel(handler.muxer, config.GracePeriod, config.Logger)
+				err := UnregisterTunnel(handler.muxer, config.GracePeriod, config.TransportLogger)
 				handler.muxer.Shutdown()
 				return err
 			case <-updateMetricsTickC:
@@ -263,6 +274,9 @@ func ServeTunnel(
 			logger.WithError(castedErr.cause).Error("Register tunnel error from server side")
 			// Don't send registration error return from server to Sentry. They are
 			// logged on server side
+			if incidents := config.IncidentLookup.ActiveIncidents(); len(incidents) > 0 {
+				logger.Error(activeIncidentsMsg(incidents))
+			}
 			return castedErr.cause, !castedErr.permanent
 		case clientRegisterTunnelError:
 			logger.WithError(castedErr.cause).Error("Register tunnel error on client side")
@@ -290,8 +304,15 @@ func IsRPCStreamResponse(headers []h2mux.Header) bool {
 	return true
 }

-func RegisterTunnel(ctx context.Context, muxer *h2mux.Muxer, config *TunnelConfig, connectionID uint8, originLocalIP string) error {
-	config.Logger.Debug("initiating RPC stream to register")
+func RegisterTunnel(
+	ctx context.Context,
+	muxer *h2mux.Muxer,
+	config *TunnelConfig,
+	connectionID uint8,
+	originLocalIP string,
+	uuid uuid.UUID,
+) error {
+	config.TransportLogger.Debug("initiating RPC stream to register")
 	stream, err := muxer.OpenStream([]h2mux.Header{
 		{Name: ":method", Value: "RPC"},
 		{Name: ":scheme", Value: "capnp"},
@@ -306,8 +327,8 @@ func RegisterTunnel(ctx context.Context, muxer *h2mux.Muxer, config *TunnelConfi
 		return clientRegisterTunnelError{cause: err}
 	}
 	conn := rpc.NewConn(
-		tunnelrpc.NewTransportLogger(config.Logger.WithField("subsystem", "rpc-register"), rpc.StreamTransport(stream)),
-		tunnelrpc.ConnLog(config.Logger.WithField("subsystem", "rpc-transport")),
+		tunnelrpc.NewTransportLogger(config.TransportLogger.WithField("subsystem", "rpc-register"), rpc.StreamTransport(stream)),
+		tunnelrpc.ConnLog(config.TransportLogger.WithField("subsystem", "rpc-transport")),
 	)
 	defer conn.Close()
 	ts := tunnelpogs.TunnelServer_PogsClient{Client: conn.Bootstrap(ctx)}
@@ -320,7 +341,7 @@ func RegisterTunnel(ctx context.Context, muxer *h2mux.Muxer, config *TunnelConfi
 		ctx,
 		config.OriginCert,
 		config.Hostname,
-		config.RegistrationOptions(connectionID, originLocalIP),
+		config.RegistrationOptions(connectionID, originLocalIP, uuid),
 	)
 	LogServerInfo(serverInfoPromise.Result(), connectionID, config.Metrics, config.Logger)
 	if err != nil {
@@ -339,7 +360,23 @@ func RegisterTunnel(ctx context.Context, muxer *h2mux.Muxer, config *TunnelConfi
 		}
 	}

-	config.Logger.Info("Tunnel ID: " + registration.TunnelID)
+	if registration.TunnelID != "" {
+		config.Metrics.tunnelsHA.AddTunnelID(connectionID, registration.TunnelID)
+		config.Logger.Infof("Each HA connection's tunnel IDs: %v", config.Metrics.tunnelsHA.String())
+	}
+
+	// Print out the user's trial zone URL in a nice box (if they requested and got one)
+	if isTrialTunnel := config.Hostname == ""; isTrialTunnel {
+		if url, err := url.Parse(registration.Url); err == nil {
+			for _, line := range asciiBox(trialZoneMsg(url.String()), 2) {
+				config.Logger.Infoln(line)
+			}
+		} else {
+			config.Logger.Errorln("Failed to connect tunnel, please try again.")
+			return fmt.Errorf("empty URL in response from Cloudflare edge")
+		}
+	}
+
 	config.Logger.Infof("Route propagating, it may take up to 1 minute for your new route to become functional")
 	return nil
 }
@@ -410,6 +447,12 @@ func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
 				return fmt.Errorf("invalid path")
 			}
 			h1.URL = resolved
+		case "content-length":
+			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
+			if err != nil {
+				return fmt.Errorf("unparseable content length")
+			}
+			h1.ContentLength = contentLength
 		default:
 			h1.Header.Add(http.CanonicalHeaderKey(header.Name), header.Value)
 		}
@@ -454,7 +497,7 @@ func NewTunnelHandler(ctx context.Context,
 ) (*TunnelHandler, string, error) {
 	originURL, err := validation.ValidateUrl(config.OriginUrl)
 	if err != nil {
-		return nil, "", fmt.Errorf("Unable to parse origin url %#v", originURL)
+		return nil, "", fmt.Errorf("unable to parse origin URL %#v", originURL)
 	}
 	h := &TunnelHandler{
 		originUrl:         originURL,
@@ -493,7 +536,7 @@ func NewTunnelHandler(ctx context.Context,
 		IsClient:           true,
 		HeartbeatInterval:  config.HeartbeatInterval,
 		MaxHeartbeats:      config.MaxHeartbeats,
-		Logger:             config.ProtocolLogger.WithFields(log.Fields{}),
+		Logger:             config.TransportLogger.WithFields(log.Fields{}),
 		CompressionQuality: h2mux.CompressionSetting(config.CompressionQuality),
 	})
 	if err != nil {
@@ -598,25 +641,41 @@ func (h *TunnelHandler) logError(stream *h2mux.MuxedStream, err error) {
 }

 func (h *TunnelHandler) logRequest(req *http.Request, cfRay string, lbProbe bool) {
+	logger := log.NewEntry(h.logger)
 	if cfRay != "" {
-		h.logger.WithField("CF-RAY", cfRay).Debugf("%s %s %s", req.Method, req.URL, req.Proto)
+		logger = logger.WithField("CF-RAY", cfRay)
+		logger.Debugf("%s %s %s", req.Method, req.URL, req.Proto)
 	} else if lbProbe {
-		h.logger.Debugf("Load Balancer health check %s %s %s", req.Method, req.URL, req.Proto)
+		logger.Debugf("Load Balancer health check %s %s %s", req.Method, req.URL, req.Proto)
 	} else {
-		h.logger.Warnf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", req.Method, req.URL, req.Proto)
+		logger.Warnf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", req.Method, req.URL, req.Proto)
+	}
+	logger.Debugf("Request Headers %+v", req.Header)
+
+	if contentLen := req.ContentLength; contentLen == -1 {
+		logger.Debugf("Request Content length unknown")
+	} else {
+		logger.Debugf("Request content length %d", contentLen)
 	}
-	h.logger.Debugf("Request Headers %+v", req.Header)
 }

 func (h *TunnelHandler) logResponse(r *http.Response, cfRay string, lbProbe bool) {
+	logger := log.NewEntry(h.logger)
 	if cfRay != "" {
-		h.logger.WithField("CF-RAY", cfRay).Debugf("%s", r.Status)
+		logger = logger.WithField("CF-RAY", cfRay)
+		logger.Debugf("%s", r.Status)
 	} else if lbProbe {
-		h.logger.Debugf("Response to Load Balancer health check %s", r.Status)
+		logger.Debugf("Response to Load Balancer health check %s", r.Status)
 	} else {
-		h.logger.Infof("%s", r.Status)
+		logger.Infof("%s", r.Status)
+	}
+	logger.Debugf("Response Headers %+v", r.Header)
+
+	if contentLen := r.ContentLength; contentLen == -1 {
+		logger.Debugf("Response content length unknown")
+	} else {
+		logger.Debugf("Response content length %d", contentLen)
 	}
-	h.logger.Debugf("Response Headers %+v", r.Header)
 }

 func (h *TunnelHandler) UpdateMetrics(connectionID string) {
@@ -630,3 +689,49 @@ func uint8ToString(input uint8) string {
 func isLBProbeRequest(req *http.Request) bool {
 	return strings.HasPrefix(req.UserAgent(), lbProbeUserAgentPrefix)
 }
+
+// Print out the given lines in a nice ASCII box.
+func asciiBox(lines []string, padding int) (box []string) {
+	maxLen := maxLen(lines)
+	spacer := strings.Repeat(" ", padding)
+
+	border := "+" + strings.Repeat("-", maxLen+(padding*2)) + "+"
+
+	box = append(box, border)
+	for _, line := range lines {
+		box = append(box, "|"+spacer+line+strings.Repeat(" ", maxLen-len(line))+spacer+"|")
+	}
+	box = append(box, border)
+	return
+}
+
+func maxLen(lines []string) int {
+	max := 0
+	for _, line := range lines {
+		if len(line) > max {
+			max = len(line)
+		}
+	}
+	return max
+}
+
+func trialZoneMsg(url string) []string {
+	return []string{
+		"Your free tunnel has started! Visit it:",
+		"  " + url,
+	}
+}
+
+func activeIncidentsMsg(incidents []Incident) string {
+	preamble := "There is an active Cloudflare incident that may be related:"
+	if len(incidents) > 1 {
+		preamble = "There are active Cloudflare incidents that may be related:"
+	}
+	incidentStrings := []string{}
+	for _, incident := range incidents {
+		incidentString := fmt.Sprintf("%s (%s)", incident.Name, incident.URL())
+		incidentStrings = append(incidentStrings, incidentString)
+	}
+	return preamble + " " + strings.Join(incidentStrings, "; ")
+
+}
@@ -0,0 +1,50 @@
+package origin
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// tunnelsForHA maps this cloudflared instance's HA connections to the tunnel IDs they serve.
+type tunnelsForHA struct {
+	sync.Mutex
+	metrics *prometheus.GaugeVec
+	entries map[uint8]string
+}
+
+// NewTunnelsForHA initializes the Prometheus metrics etc for a tunnelsForHA.
+func NewTunnelsForHA() tunnelsForHA {
+	metrics := prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: "tunnel_ids",
+			Help: "The ID of all tunnels (and their corresponding HA connection ID) running in this instance of cloudflared.",
+		},
+		[]string{"tunnel_id", "ha_conn_id"},
+	)
+	prometheus.MustRegister(metrics)
+
+	return tunnelsForHA{
+		metrics: metrics,
+		entries: make(map[uint8]string),
+	}
+}
+
+// Track a new tunnel ID, removing the disconnected tunnel (if any) and update metrics.
+func (t *tunnelsForHA) AddTunnelID(haConn uint8, tunnelID string) {
+	t.Lock()
+	defer t.Unlock()
+	haStr := fmt.Sprintf("%v", haConn)
+	if oldTunnelID, ok := t.entries[haConn]; ok {
+		t.metrics.WithLabelValues(oldTunnelID, haStr).Dec()
+	}
+	t.entries[haConn] = tunnelID
+	t.metrics.WithLabelValues(tunnelID, haStr).Inc()
+}
+
+func (t *tunnelsForHA) String() string {
+	t.Lock()
+	defer t.Unlock()
+	return fmt.Sprintf("%v", t.entries)
+}
@@ -2,14 +2,10 @@ package tlsconfig

 import (
 	"crypto/tls"
-	"errors"
 	"fmt"
 	"sync"

-	tunnellog "github.com/cloudflare/cloudflared/log"
 	"github.com/getsentry/raven-go"
-	log "github.com/sirupsen/logrus"
-	"gopkg.in/urfave/cli.v2"
 )

 // CertReloader can load and reload a TLS certificate from a particular filepath.
@@ -21,18 +17,14 @@ type CertReloader struct {
 	keyPath     string
 }

-// NewCertReloader makes a CertReloader, memorizing the filepaths in the context/flags.
-func NewCertReloader(c *cli.Context, f CLIFlags) (*CertReloader, error) {
-	if !c.IsSet(f.Cert) {
-		return nil, errors.New("CertReloader: cert not provided")
-	}
-	if !c.IsSet(f.Key) {
-		return nil, errors.New("CertReloader: key not provided")
-	}
+// NewCertReloader makes a CertReloader. It loads the cert during initialization to make sure certPath and keyPath are valid
+func NewCertReloader(certPath, keyPath string) (*CertReloader, error) {
 	cr := new(CertReloader)
-	cr.certPath = c.String(f.Cert)
-	cr.keyPath = c.String(f.Key)
-	cr.LoadCert()
+	cr.certPath = certPath
+	cr.keyPath = keyPath
+	if err := cr.LoadCert(); err != nil {
+		return nil, err
+	}
 	return cr, nil
 }

@@ -45,18 +37,17 @@ func (cr *CertReloader) Cert(clientHello *tls.ClientHelloInfo) (*tls.Certificate

 // LoadCert loads a TLS certificate from the CertReloader's specified filepath.
 // Call this after writing a new certificate to the disk (e.g. after renewing a certificate)
-func (cr *CertReloader) LoadCert() {
+func (cr *CertReloader) LoadCert() error {
 	cr.Lock()
 	defer cr.Unlock()

-	log.SetFormatter(&tunnellog.JSONFormatter{})
-	log.Info("Reloading certificate")
 	cert, err := tls.LoadX509KeyPair(cr.certPath, cr.keyPath)

 	// Keep the old certificate if there's a problem reading the new one.
 	if err != nil {
 		raven.CaptureError(fmt.Errorf("Error parsing X509 key pair: %v", err), nil)
-		return
+		return err
 	}
 	cr.certificate = &cert
+	return nil
 }
@@ -2,6 +2,7 @@ package tlsconfig

 import (
 	"crypto/x509"
+	"encoding/pem"
 )

 // TODO: remove the Origin CA root certs when migrated to Authenticated Origin Pull certs
@@ -85,11 +86,26 @@ QzMmZpRpIBB321ZBlcnlxiTJvWxvbCPHKHj20VwwAz7LONF59s84ZsOqfoBv8gKM
 s0s5dsq5zpLeaw==
 -----END CERTIFICATE-----`)

-func GetCloudflareRootCA() *x509.CertPool {
-	ca := x509.NewCertPool()
-	if !ca.AppendCertsFromPEM([]byte(cloudflareRootCA)) {
-		// should never happen
-		panic("failure loading Cloudflare origin CA pem")
+func GetCloudflareRootCA() ([]*x509.Certificate, error) {
+	var certs []*x509.Certificate
+	pemBlocks := cloudflareRootCA
+	for len(pemBlocks) > 0 {
+		var block *pem.Block
+		block, pemBlocks = pem.Decode(pemBlocks)
+		if block == nil {
+			break
+		}
+		if block.Type != "CERTIFICATE" {
+			continue
+		}
+
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, err
+		}
+
+		certs = append(certs, cert)
 	}
-	return ca
+
+	return certs, nil
 }
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICBjCCAbCgAwIBAgIJAPKk4bYMrSFMMA0GCSqGSIb3DQEBCwUAMF0xCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEPMA0GA1UEBwwGQXVzdGluMRkwFwYDVQQK
+DBBDbG91ZGZsYXJlLCBJbmMuMRIwEAYDVQQDDAlsb2NhbGhvc3QwHhcNMTgxMTE1
+MjA1NzU3WhcNMjgxMTEyMjA1NzU3WjBdMQswCQYDVQQGEwJVUzEOMAwGA1UECAwF
+VGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xvdWRmbGFyZSwgSW5j
+LjESMBAGA1UEAwwJbG9jYWxob3N0MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOQN
+pTRn5wLf8SSI5x2kpDvbdDy7lfhamJ2En4Q+wy1cSKp8bn8/oyhVF7QTsimDGTI4
+45pV9nDfNJPYB3IW0x0CAwEAAaNTMFEwHQYDVR0OBBYEFE4jIa97mIEiYFa02X++
+uu5mCEn+MB8GA1UdIwQYMBaAFE4jIa97mIEiYFa02X++uu5mCEn+MA8GA1UdEwEB
+/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADQQAkE+pDee0o5cNcZRUszy8sTQzB1Wlp
+J6ucfmo16crqRaK7uGvhkMyibIc4D8z2Cxw3aI3IMMFoIIlYoYKiUcbd
+-----END CERTIFICATE-----
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICBjCCAbCgAwIBAgIJAN6cXRTbJtFnMA0GCSqGSIb3DQEBCwUAMF0xCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEPMA0GA1UEBwwGQXVzdGluMRgwFgYDVQQK
+DA9DbG91ZGZsYXJlLCBJbmMxEzARBgNVBAMMCmxvY2FsaG9zdDIwHhcNMTgxMTE1
+MjExMTU4WhcNMjgxMTEyMjExMTU4WjBdMQswCQYDVQQGEwJVUzEOMAwGA1UECAwF
+VGV4YXMxDzANBgNVBAcMBkF1c3RpbjEYMBYGA1UECgwPQ2xvdWRmbGFyZSwgSW5j
+MRMwEQYDVQQDDApsb2NhbGhvc3QyMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKQx
+IMZ6QgXoul2ITF/7sly4fW2Ol+a/AYw42zCWhVqOXv8AhY21I0Q8lkRR6wOroQwZ
+O7jKKOcE5TnR/NRcZr8CAwEAAaNTMFEwHQYDVR0OBBYEFONKxLZc2RUD0KTHkAz4
+8nrb5688MB8GA1UdIwQYMBaAFONKxLZc2RUD0KTHkAz48nrb5688MA8GA1UdEwEB
+/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADQQA56pwhvGpNPjyLcWfJHu/vI3ZjdoLB
+LnrkRaMjJmv0H0Beh4upJhoz8u6lhMACerKQrrdQhEPB2u+maFrEBtmN
+-----END CERTIFICATE-----
@@ -0,0 +1,10 @@
+-----BEGIN PRIVATE KEY-----
+MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEA5A2lNGfnAt/xJIjn
+HaSkO9t0PLuV+FqYnYSfhD7DLVxIqnxufz+jKFUXtBOyKYMZMjjjmlX2cN80k9gH
+chbTHQIDAQABAkAoeDtu91lJa1AxuZG58vOqI6GW/Xr5naojmdts7m5YaAhDa7DE
+zJUp4d8SP5cGBf1/PB3x6Cu9UviFNQ16wmzJAiEA8gUm4UYpWZD4Ze2l/xb+BK8D
+IglSUIy1VxW+X1G55wMCIQDxOfXiFzPqnv/e5avKGv6CU11Dhmbi1OpiyybZTjGz
+XwIhAM3bE/cJdqJ4bNBGE6umIupY8pFA3IMnLBempwbsvPOBAiEAgzJ+5OSxu92W
+VGidsmJUIhWtF9i1hJFAmVLcYjwBFAkCICtjP/vv0qOZWk4mAAn2zz9UVWp45DSR
+p/FA8V77ohXD
+-----END PRIVATE KEY-----
@@ -6,150 +6,86 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"io/ioutil"
-	"net"

-	"github.com/cloudflare/cloudflared/log"
 	"github.com/pkg/errors"
-	"gopkg.in/urfave/cli.v2"
-	"runtime"
 )

-var logger = log.CreateLogger()
-
-// CLIFlags names the flags used to configure TLS for a command or subsystem.
-// The nil value for a field means the flag is ignored.
-type CLIFlags struct {
-	Cert       string
-	Key        string
-	ClientCert string
-	RootCA     string
+// Config is the user provided parameters to create a tls.Config
+type TLSParameters struct {
+	Cert             string
+	Key              string
+	GetCertificate   *CertReloader
+	ClientCAs        []string
+	RootCAs          []string
+	ServerName       string
+	CurvePreferences []tls.CurveID
 }

-// GetConfig returns a TLS configuration according to the flags defined in f and
-// set by the user.
-func (f CLIFlags) GetConfig(c *cli.Context) *tls.Config {
-	config := &tls.Config{}
-
-	if c.IsSet(f.Cert) && c.IsSet(f.Key) {
-		cert, err := tls.LoadX509KeyPair(c.String(f.Cert), c.String(f.Key))
+// GetConfig returns a TLS configuration according to the Config set by the user.
+func GetConfig(p *TLSParameters) (*tls.Config, error) {
+	tlsconfig := &tls.Config{}
+	if p.Cert != "" && p.Key != "" {
+		cert, err := tls.LoadX509KeyPair(p.Cert, p.Key)
 		if err != nil {
-			logger.WithError(err).Fatal("Error parsing X509 key pair")
+			return nil, errors.Wrap(err, "Error parsing X509 key pair")
 		}
-		config.Certificates = []tls.Certificate{cert}
-		config.BuildNameToCertificate()
+		tlsconfig.Certificates = []tls.Certificate{cert}
+		// BuildNameToCertificate parses Certificates and builds NameToCertificate from common name
+		// and SAN fields of leaf certificates
+		tlsconfig.BuildNameToCertificate()
 	}
-	return f.finishGettingConfig(c, config)
-}

-func (f CLIFlags) GetConfigReloadableCert(c *cli.Context, cr *CertReloader) *tls.Config {
-	config := &tls.Config{
-		GetCertificate: cr.Cert,
+	if p.GetCertificate != nil {
+		// GetCertificate is called when client supplies SNI info or Certificates is empty.
+		// Order of retrieving certificate is GetCertificate, NameToCertificate and lastly first element of Certificates
+		tlsconfig.GetCertificate = p.GetCertificate.Cert
 	}
-	config.BuildNameToCertificate()
-	return f.finishGettingConfig(c, config)
-}

-func (f CLIFlags) finishGettingConfig(c *cli.Context, config *tls.Config) *tls.Config {
-	if c.IsSet(f.ClientCert) {
+	if len(p.ClientCAs) > 0 {
 		// set of root certificate authorities that servers use if required to verify a client certificate
 		// by the policy in ClientAuth
-		config.ClientCAs = LoadCert(c.String(f.ClientCert))
+		clientCAs, err := LoadCert(p.ClientCAs)
+		if err != nil {
+			return nil, errors.Wrap(err, "Error loading client CAs")
+		}
+		tlsconfig.ClientCAs = clientCAs
 		// server's policy for TLS Client Authentication. Default is no client cert
-		config.ClientAuth = tls.RequireAndVerifyClientCert
+		tlsconfig.ClientAuth = tls.RequireAndVerifyClientCert
 	}
-	// set of root certificate authorities that clients use when verifying server certificates
-	if c.IsSet(f.RootCA) {
-		config.RootCAs = LoadCert(c.String(f.RootCA))
+
+	if len(p.RootCAs) > 0 {
+		rootCAs, err := LoadCert(p.RootCAs)
+		if err != nil {
+			return nil, errors.Wrap(err, "Error loading root CAs")
+		}
+		tlsconfig.RootCAs = rootCAs
 	}
-	// we optimize CurveP256
-	config.CurvePreferences = []tls.CurveID{tls.CurveP256}
-	return config
+
+	if p.ServerName != "" {
+		tlsconfig.ServerName = p.ServerName
+	}
+
+	if len(p.CurvePreferences) > 0 {
+		tlsconfig.CurvePreferences = p.CurvePreferences
+	} else {
+		// Cloudflare optimize CurveP256
+		tlsconfig.CurvePreferences = []tls.CurveID{tls.CurveP256}
+	}
+
+	return tlsconfig, nil
 }

 // LoadCert creates a CertPool containing all certificates in a PEM-format file.
-func LoadCert(certPath string) *x509.CertPool {
-	caCert, err := ioutil.ReadFile(certPath)
-	if err != nil {
-		logger.WithError(err).Fatalf("Error reading certificate %s", certPath)
-	}
+func LoadCert(certPaths []string) (*x509.CertPool, error) {
 	ca := x509.NewCertPool()
-	if !ca.AppendCertsFromPEM(caCert) {
-		logger.WithError(err).Fatalf("Error parsing certificate %s", certPath)
-	}
-	return ca
-}
-
-func LoadGlobalCertPool() (*x509.CertPool, error) {
-	success := false
-
-	// First, obtain the system certificate pool
-	certPool, systemCertPoolErr := x509.SystemCertPool()
-	if systemCertPoolErr != nil {
-		if runtime.GOOS != "windows" {
-			logger.Warnf("error obtaining the system certificates: %s", systemCertPoolErr)
+	for _, certPath := range certPaths {
+		caCert, err := ioutil.ReadFile(certPath)
+		if err != nil {
+			return nil, errors.Wrapf(err, "Error reading certificate %s", certPath)
 		}
-		certPool = x509.NewCertPool()
-	} else {
-		success = true
-	}
-
-	// Next, append the Cloudflare CA pool into the system pool
-	if !certPool.AppendCertsFromPEM(cloudflareRootCA) {
-		logger.Warn("could not append the CF certificate to the cloudflared certificate pool")
-	} else {
-		success = true
-	}
-
-	if success != true { // Obtaining any of the CAs has failed; this is a fatal error
-		return nil, errors.New("error loading any of the CAs into the global certificate pool")
-	}
-
-	// Finally, add the Hello certificate into the pool (since it's self-signed)
-	helloCertificate, err := GetHelloCertificateX509()
-	if err != nil {
-		logger.Warn("error obtaining the Hello server certificate")
-	}
-
-	certPool.AddCert(helloCertificate)
-
-	return certPool, nil
-}
-
-func LoadOriginCertPool(originCAPoolPEM []byte) (*x509.CertPool, error) {
-	success := false
-
-	// Get the global pool
-	certPool, globalPoolErr := LoadGlobalCertPool()
-	if globalPoolErr != nil {
-		certPool = x509.NewCertPool()
-	} else {
-		success = true
-	}
-
-	// Then, add any custom origin CA pool the user may have passed
-	if originCAPoolPEM != nil {
-		if !certPool.AppendCertsFromPEM(originCAPoolPEM) {
-			logger.Warn("could not append the provided origin CA to the cloudflared certificate pool")
-		} else {
-			success = true
+		if !ca.AppendCertsFromPEM(caCert) {
+			return nil, errors.Wrapf(err, "Error parsing certificate %s", certPath)
 		}
 	}
-
-	if success != true {
-		return nil, errors.New("error loading any of the CAs into the origin certificate pool")
-	}
-
-	return certPool, nil
-}
-
-func CreateTunnelConfig(c *cli.Context, addrs []string) *tls.Config {
-	tlsConfig := CLIFlags{RootCA: "cacert"}.GetConfig(c)
-	if tlsConfig.RootCAs == nil {
-		tlsConfig.RootCAs = GetCloudflareRootCA()
-		tlsConfig.ServerName = "cftunnel.com"
-	} else if len(addrs) > 0 {
-		// Set for development environments and for testing specific origintunneld instances
-		tlsConfig.ServerName, _, _ = net.SplitHostPort(addrs[0])
-	}
-	return tlsConfig
+	return ca, nil
 }
@@ -1,214 +1,84 @@
-// +build ignore
 // TODO: Remove the above build tag and include this test when we start compiling with Golang 1.10.0+

 package tlsconfig

 import (
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"os"
+	"crypto/tls"
 	"testing"

 	"github.com/stretchr/testify/assert"
 )

-// Generated using `openssl req -newkey rsa:512 -nodes -x509 -days 3650`
-var samplePEM = []byte(`
-----BEGIN CERTIFICATE-----
-MIIB4DCCAYoCCQCb/H0EUrdXEjANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
-UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
-dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
-AwwIVGVzdCBPbmUwHhcNMTgwNDI2MTYxMDUxWhcNMjgwNDIzMTYxMDUxWjB3MQsw
-CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
-A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
-eTERMA8GA1UEAwwIVGVzdCBPbmUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAwVQD
-K0SJ25UFLznm2pU3zhzMEvpDEofHVNnCjk4mlDrtVop7PkKZ8pDEmuQANltUrxC8
-yHBE2wXMv+GlH+bDtwIDAQABMA0GCSqGSIb3DQEBCwUAA0EAjVYQzozIFPkt/HRY
-uUoZ8zEHIDICb0syFf5VAjm9AgTwIPzUmD+c5vl6LWDnxq7L45nLCzhhQ6YmiwDz
-X7Wcyg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIB4DCCAYoCCQDZfCdAJ+mwzDANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
-UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
-dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
-AwwIVGVzdCBUd28wHhcNMTgwNDI2MTYxMTIwWhcNMjgwNDIzMTYxMTIwWjB3MQsw
-CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
-A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
-eTERMA8GA1UEAwwIVGVzdCBUd28wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAoHKp
-ROVK3zCSsH7ocYeyRAML4V7SFAbZcb4WIwDnE08oMBVRkQVcW5tqEkvG3RiClfzV
-wZIJ3CfqKIeSNSDU9wIDAQABMA0GCSqGSIb3DQEBCwUAA0EAJw2gUbnPiq4C2p5b
-iWzlA9Q7aKo+VQ4H7IZS7tTccr59nVjvH/TG3eWujpnocr4TOqW9M3CK1DF9mUGP
-3pQ3Jg==
-----END CERTIFICATE-----
-`)
+// testcert.pem and testcert2.pem are Generated using `openssl req -newkey rsa:512 -nodes -x509 -days 3650`
+const (
+	testcertCommonName = "localhost"
+)

-var systemCertPoolSubjects []*pkix.Name
+func TestGetFromEmptyConfig(t *testing.T) {
+	c := &TLSParameters{}

-type certificateFixture struct {
-	ou string
-	cn string
+	tlsConfig, err := GetConfig(c)
+	assert.NoError(t, err)
+	assert.Empty(t, tlsConfig.Certificates)
+
+	assert.Empty(t, tlsConfig.NameToCertificate)
+
+	assert.Nil(t, tlsConfig.ClientCAs)
+	assert.Equal(t, tls.NoClientCert, tlsConfig.ClientAuth)
+
+	assert.Nil(t, tlsConfig.RootCAs)
+
+	assert.Len(t, tlsConfig.CurvePreferences, 1)
+	assert.Equal(t, tls.CurveP256, tlsConfig.CurvePreferences[0])
 }

-func TestMain(m *testing.M) {
-	systemCertPool, err := x509.SystemCertPool()
-	if isUnrecoverableError(err) {
-		os.Exit(1)
-	}
+func TestGetConfig(t *testing.T) {
+	cert, err := tls.LoadX509KeyPair("testcert.pem", "testkey.pem")
+	assert.NoError(t, err)

-	if systemCertPool == nil {
-		// On Windows, let's just assume the system cert pool was empty
-		systemCertPool = x509.NewCertPool()
+	c := &TLSParameters{
+		Cert:             "testcert.pem",
+		Key:              "testkey.pem",
+		ClientCAs:        []string{"testcert.pem", "testcert2.pem"},
+		RootCAs:          []string{"testcert.pem", "testcert2.pem"},
+		ServerName:       "test",
+		CurvePreferences: []tls.CurveID{tls.CurveP384},
 	}
+	tlsConfig, err := GetConfig(c)
+	assert.NoError(t, err)
+	assert.Len(t, tlsConfig.Certificates, 1)
+	assert.Equal(t, cert, tlsConfig.Certificates[0])

-	systemCertPoolSubjects, err = getCertPoolSubjects(systemCertPool)
-	if err != nil {
-		os.Exit(1)
-	}
+	assert.Equal(t, cert, *tlsConfig.NameToCertificate[testcertCommonName])

-	os.Exit(m.Run())
+	assert.NotNil(t, tlsConfig.ClientCAs)
+	assert.Equal(t, tls.RequireAndVerifyClientCert, tlsConfig.ClientAuth)
+
+	assert.NotNil(t, tlsConfig.RootCAs)
+
+	assert.Len(t, tlsConfig.CurvePreferences, 1)
+	assert.Equal(t, tls.CurveP384, tlsConfig.CurvePreferences[0])
 }

-func TestLoadOriginCertPoolJustSystemPool(t *testing.T) {
-	certPoolSubjects := loadCertPoolSubjects(t, nil)
-	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
+func TestCertReloader(t *testing.T) {
+	expectedCert, err := tls.LoadX509KeyPair("testcert.pem", "testkey.pem")
+	assert.NoError(t, err)

-	// Remove extra subjects from the cert pool
-	var filteredSystemCertPoolSubjects []*pkix.Name
+	certReloader, err := NewCertReloader("testcert.pem", "testkey.pem")
+	assert.NoError(t, err)

-	t.Log(extraSubjects)
+	chi := &tls.ClientHelloInfo{ServerName: testcertCommonName}
+	cert, err := certReloader.Cert(chi)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedCert, *cert)

-OUTER:
-	for _, subject := range certPoolSubjects {
-		for _, extraSubject := range extraSubjects {
-			if subject == extraSubject {
-				t.Log(extraSubject)
-				continue OUTER
-			}
-		}
-
-		filteredSystemCertPoolSubjects = append(filteredSystemCertPoolSubjects, subject)
+	c := &TLSParameters{
+		GetCertificate: certReloader,
 	}
+	tlsConfig, err := GetConfig(c)
+	assert.NoError(t, err)

-	assert.Equal(t, len(filteredSystemCertPoolSubjects), len(systemCertPoolSubjects))
-
-	difference := subjectSubtract(systemCertPoolSubjects, filteredSystemCertPoolSubjects)
-	assert.Equal(t, 0, len(difference))
-}
-
-func TestLoadOriginCertPoolCFCertificates(t *testing.T) {
-	certPoolSubjects := loadCertPoolSubjects(t, nil)
-
-	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
-
-	expected := []*certificateFixture{
-		{ou: "CloudFlare Origin SSL ECC Certificate Authority"},
-		{ou: "CloudFlare Origin SSL Certificate Authority"},
-		{cn: "origin-pull.cloudflare.net"},
-		{cn: "Argo Tunnel Sample Hello Server Certificate"},
-	}
-
-	assertFixturesMatchSubjects(t, expected, extraSubjects)
-}
-
-func TestLoadOriginCertPoolWithExtraPEMs(t *testing.T) {
-	certPoolWithoutPEMSubjects := loadCertPoolSubjects(t, nil)
-	certPoolWithPEMSubjects := loadCertPoolSubjects(t, samplePEM)
-
-	difference := subjectSubtract(certPoolWithoutPEMSubjects, certPoolWithPEMSubjects)
-
-	assert.Equal(t, 2, len(difference))
-
-	expected := []*certificateFixture{
-		{cn: "Test One"},
-		{cn: "Test Two"},
-	}
-
-	assertFixturesMatchSubjects(t, expected, difference)
-}
-
-func loadCertPoolSubjects(t *testing.T, originCAPoolPEM []byte) []*pkix.Name {
-	certPool, err := LoadOriginCertPool(originCAPoolPEM)
-	if isUnrecoverableError(err) {
-		t.Fatal(err)
-	}
-	assert.NotEmpty(t, certPool.Subjects())
-	certPoolSubjects, err := getCertPoolSubjects(certPool)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return certPoolSubjects
-}
-
-func assertFixturesMatchSubjects(t *testing.T, fixtures []*certificateFixture, subjects []*pkix.Name) {
-	assert.Equal(t, len(fixtures), len(subjects))
-
-	for _, fixture := range fixtures {
-		found := false
-		for _, subject := range subjects {
-			found = found || fixtureMatchesSubjectPredicate(fixture, subject)
-		}
-
-		if !found {
-			t.Fail()
-		}
-	}
-}
-
-func fixtureMatchesSubjectPredicate(fixture *certificateFixture, subject *pkix.Name) bool {
-	cnMatch := true
-	if fixture.cn != "" {
-		cnMatch = fixture.cn == subject.CommonName
-	}
-
-	ouMatch := true
-	if fixture.ou != "" {
-		ouMatch = len(subject.OrganizationalUnit) > 0 && fixture.ou == subject.OrganizationalUnit[0]
-	}
-
-	return cnMatch && ouMatch
-}
-
-func subjectSubtract(left []*pkix.Name, right []*pkix.Name) []*pkix.Name {
-	var difference []*pkix.Name
-
-	var found bool
-	for _, r := range right {
-		found = false
-		for _, l := range left {
-			if (*l).String() == (*r).String() {
-				found = true
-			}
-		}
-
-		if !found {
-			difference = append(difference, r)
-		}
-	}
-
-	return difference
-}
-
-func getCertPoolSubjects(certPool *x509.CertPool) ([]*pkix.Name, error) {
-	var subjects []*pkix.Name
-
-	for _, subject := range certPool.Subjects() {
-		var sequence pkix.RDNSequence
-		_, err := asn1.Unmarshal(subject, &sequence)
-		if err != nil {
-			return nil, err
-		}
-
-		name := pkix.Name{}
-		name.FillFromRDNSequence(&sequence)
-
-		subjects = append(subjects, &name)
-	}
-
-	return subjects, nil
-}
-
-func isUnrecoverableError(err error) bool {
-	return err != nil && err.Error() != "crypto/x509: system root pool is not available on Windows"
+	cert, err = tlsConfig.GetCertificate(chi)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedCert, *cert)
 }
@@ -1,10 +1,11 @@
 package tunneldns

 import (
+	"context"
+
 	"github.com/coredns/coredns/plugin"
 	"github.com/miekg/dns"
 	"github.com/pkg/errors"
-	"golang.org/x/net/context"
 )

 // Upstream is a simplified interface for proxy destination
@@ -2,6 +2,7 @@ package tunneldns

 import (
 	"bytes"
+	"context"
 	"crypto/tls"
 	"fmt"
 	"io/ioutil"
@@ -12,7 +13,6 @@ import (
 	"github.com/miekg/dns"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"golang.org/x/net/http2"
 )

@@ -1,6 +1,8 @@
 package tunneldns

 import (
+	"context"
+
 	"github.com/coredns/coredns/plugin"
 	"github.com/coredns/coredns/plugin/metrics/vars"
 	"github.com/coredns/coredns/plugin/pkg/dnstest"
@@ -8,7 +10,6 @@ import (
 	"github.com/coredns/coredns/request"
 	"github.com/miekg/dns"
 	"github.com/prometheus/client_golang/prometheus"
-	"golang.org/x/net/context"
 )

 // MetricsPlugin is an adapter for CoreDNS and built-in metrics
@@ -1,8 +1,9 @@
 package tunnelrpc

 import (
+	"context"
+
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"golang.org/x/net/trace"
 	"zombiezen.com/go/capnproto2/rpc"
 )
@@ -3,9 +3,9 @@ package tunnelrpc

 import (
 	"bytes"
+	"context"

 	log "github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"zombiezen.com/go/capnproto2/encoding/text"
 	"zombiezen.com/go/capnproto2/rpc"
 	rpccapnp "zombiezen.com/go/capnproto2/std/capnp/rpc"
@@ -1,9 +1,11 @@
 package pogs

 import (
+	"context"
+
 	"github.com/cloudflare/cloudflared/tunnelrpc"
+
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/net/context"
 	"zombiezen.com/go/capnproto2"
 	"zombiezen.com/go/capnproto2/pogs"
 	"zombiezen.com/go/capnproto2/rpc"
@@ -56,6 +58,7 @@ type RegistrationOptions struct {
 	IsAutoupdated        bool   `capnp:"isAutoupdated"`
 	RunFromTerminal      bool   `capnp:"runFromTerminal"`
 	CompressionQuality   uint64 `capnp:"compressionQuality"`
+	UUID                 string `capnp:"uuid"`
 }

 func MarshalRegistrationOptions(s tunnelrpc.RegistrationOptions, p *RegistrationOptions) error {
@@ -43,6 +43,7 @@ struct RegistrationOptions {
    runFromTerminal @9 :Bool;
    # cross stream compression setting, 0 - off, 3 - high
    compressionQuality @10 :UInt64;
+    uuid @11 :Text;
 }

 struct Tag {
@@ -105,6 +105,11 @@ func (s Authentication_List) At(i int) Authentication { return Authentication{s.

 func (s Authentication_List) Set(i int, v Authentication) error { return s.List.SetStruct(i, v.Struct) }

+func (s Authentication_List) String() string {
+	str, _ := text.MarshalList(0xc082ef6e0d42ed1d, s.List)
+	return str
+}
+
 // Authentication_Promise is a wrapper for a Authentication promised by a client call.
 type Authentication_Promise struct{ *capnp.Pipeline }

@@ -245,6 +250,11 @@ func (s TunnelRegistration_List) Set(i int, v TunnelRegistration) error {
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s TunnelRegistration_List) String() string {
+	str, _ := text.MarshalList(0xf41a0f001ad49e46, s.List)
+	return str
+}
+
 // TunnelRegistration_Promise is a wrapper for a TunnelRegistration promised by a client call.
 type TunnelRegistration_Promise struct{ *capnp.Pipeline }

@@ -259,12 +269,12 @@ type RegistrationOptions struct{ capnp.Struct }
 const RegistrationOptions_TypeID = 0xc793e50592935b4a

 func NewRegistrationOptions(s *capnp.Segment) (RegistrationOptions, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 16, PointerCount: 6})
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 16, PointerCount: 7})
 	return RegistrationOptions{st}, err
 }

 func NewRootRegistrationOptions(s *capnp.Segment) (RegistrationOptions, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 16, PointerCount: 6})
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 16, PointerCount: 7})
 	return RegistrationOptions{st}, err
 }

@@ -438,12 +448,31 @@ func (s RegistrationOptions) SetCompressionQuality(v uint64) {
 	s.Struct.SetUint64(8, v)
 }

+func (s RegistrationOptions) Uuid() (string, error) {
+	p, err := s.Struct.Ptr(6)
+	return p.Text(), err
+}
+
+func (s RegistrationOptions) HasUuid() bool {
+	p, err := s.Struct.Ptr(6)
+	return p.IsValid() || err != nil
+}
+
+func (s RegistrationOptions) UuidBytes() ([]byte, error) {
+	p, err := s.Struct.Ptr(6)
+	return p.TextBytes(), err
+}
+
+func (s RegistrationOptions) SetUuid(v string) error {
+	return s.Struct.SetText(6, v)
+}
+
 // RegistrationOptions_List is a list of RegistrationOptions.
 type RegistrationOptions_List struct{ capnp.List }

 // NewRegistrationOptions creates a new list of RegistrationOptions.
 func NewRegistrationOptions_List(s *capnp.Segment, sz int32) (RegistrationOptions_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 16, PointerCount: 6}, sz)
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 16, PointerCount: 7}, sz)
 	return RegistrationOptions_List{l}, err
 }

@@ -455,6 +484,11 @@ func (s RegistrationOptions_List) Set(i int, v RegistrationOptions) error {
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s RegistrationOptions_List) String() string {
+	str, _ := text.MarshalList(0xc793e50592935b4a, s.List)
+	return str
+}
+
 // RegistrationOptions_Promise is a wrapper for a RegistrationOptions promised by a client call.
 type RegistrationOptions_Promise struct{ *capnp.Pipeline }

@@ -539,6 +573,11 @@ func (s Tag_List) At(i int) Tag { return Tag{s.List.Struct(i)} }

 func (s Tag_List) Set(i int, v Tag) error { return s.List.SetStruct(i, v.Struct) }

+func (s Tag_List) String() string {
+	str, _ := text.MarshalList(0xcbd96442ae3bb01a, s.List)
+	return str
+}
+
 // Tag_Promise is a wrapper for a Tag promised by a client call.
 type Tag_Promise struct{ *capnp.Pipeline }

@@ -664,6 +703,11 @@ func (s ServerInfo_List) At(i int) ServerInfo { return ServerInfo{s.List.Struct(

 func (s ServerInfo_List) Set(i int, v ServerInfo) error { return s.List.SetStruct(i, v.Struct) }

+func (s ServerInfo_List) String() string {
+	str, _ := text.MarshalList(0xf2c68e2547ec3866, s.List)
+	return str
+}
+
 // ServerInfo_Promise is a wrapper for a ServerInfo promised by a client call.
 type ServerInfo_Promise struct{ *capnp.Pipeline }

@@ -925,6 +969,11 @@ func (s TunnelServer_registerTunnel_Params_List) Set(i int, v TunnelServer_regis
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s TunnelServer_registerTunnel_Params_List) String() string {
+	str, _ := text.MarshalList(0xb70431c0dc014915, s.List)
+	return str
+}
+
 // TunnelServer_registerTunnel_Params_Promise is a wrapper for a TunnelServer_registerTunnel_Params promised by a client call.
 type TunnelServer_registerTunnel_Params_Promise struct{ *capnp.Pipeline }

@@ -1004,6 +1053,11 @@ func (s TunnelServer_registerTunnel_Results_List) Set(i int, v TunnelServer_regi
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s TunnelServer_registerTunnel_Results_List) String() string {
+	str, _ := text.MarshalList(0xf2c122394f447e8e, s.List)
+	return str
+}
+
 // TunnelServer_registerTunnel_Results_Promise is a wrapper for a TunnelServer_registerTunnel_Results promised by a client call.
 type TunnelServer_registerTunnel_Results_Promise struct{ *capnp.Pipeline }

@@ -1058,6 +1112,11 @@ func (s TunnelServer_getServerInfo_Params_List) Set(i int, v TunnelServer_getSer
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s TunnelServer_getServerInfo_Params_List) String() string {
+	str, _ := text.MarshalList(0xdc3ed6801961e502, s.List)
+	return str
+}
+
 // TunnelServer_getServerInfo_Params_Promise is a wrapper for a TunnelServer_getServerInfo_Params promised by a client call.
 type TunnelServer_getServerInfo_Params_Promise struct{ *capnp.Pipeline }

@@ -1133,6 +1192,11 @@ func (s TunnelServer_getServerInfo_Results_List) Set(i int, v TunnelServer_getSe
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s TunnelServer_getServerInfo_Results_List) String() string {
+	str, _ := text.MarshalList(0xe3e37d096a5b564e, s.List)
+	return str
+}
+
 // TunnelServer_getServerInfo_Results_Promise is a wrapper for a TunnelServer_getServerInfo_Results promised by a client call.
 type TunnelServer_getServerInfo_Results_Promise struct{ *capnp.Pipeline }

@@ -1195,6 +1259,11 @@ func (s TunnelServer_unregisterTunnel_Params_List) Set(i int, v TunnelServer_unr
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s TunnelServer_unregisterTunnel_Params_List) String() string {
+	str, _ := text.MarshalList(0x9b87b390babc2ccf, s.List)
+	return str
+}
+
 // TunnelServer_unregisterTunnel_Params_Promise is a wrapper for a TunnelServer_unregisterTunnel_Params promised by a client call.
 type TunnelServer_unregisterTunnel_Params_Promise struct{ *capnp.Pipeline }

@@ -1245,6 +1314,11 @@ func (s TunnelServer_unregisterTunnel_Results_List) Set(i int, v TunnelServer_un
 	return s.List.SetStruct(i, v.Struct)
 }

+func (s TunnelServer_unregisterTunnel_Results_List) String() string {
+	str, _ := text.MarshalList(0xa29a916d4ebdd894, s.List)
+	return str
+}
+
 // TunnelServer_unregisterTunnel_Results_Promise is a wrapper for a TunnelServer_unregisterTunnel_Results promised by a client call.
 type TunnelServer_unregisterTunnel_Results_Promise struct{ *capnp.Pipeline }

@@ -1253,92 +1327,94 @@ func (p TunnelServer_unregisterTunnel_Results_Promise) Struct() (TunnelServer_un
 	return TunnelServer_unregisterTunnel_Results{s}, err
 }

-const schema_db8274f9144abc7e = "x\xda\x9cV]\x8c\x14\xd5\x12\xae\xef\x9c\x99\xedY\xb2" +
-	"\xcbl\xa7\x87\\\x98\\2\x09Y\xc2OX.\\\xe0" +
-	"f\xd9{\xaf\xfb\xe3\x82\x99uY\xa6\x190\x08\x98\xd0" +
-	"\xcc\x1c\x86^{\xba'\xdd=\x08D~$\x18\x95(" +
-	"Q\x91\x071\x18$1Qc\xfc\x89&\x06\x83\x09\xbe" +
-	"H\x0c1\xbc\xa8\x91Hb\x94\xec\x03DC\xdc\xe8\x83" +
-	"&\xa6\xcd\xe9\xd9\x9ei\x16\x05\xf4\xed\xccw\xeaT}" +
-	"U]\xf5\xd5,\xfb\x07\x1f`\xcb\x93\xdf$\x89\xf4\xe1" +
-	"d[\xf0\xbf\xea\xa53\xff9q\xf1\x08\xa9Y\x16\x1c" +
-	"87\x92\xf9\xc5?\xfc5\x11V|\xc1\xf6A\xbb\xc6" +
-	"\x14\"m\x82\xad'\x04\x97\x96\x9c\xfb\xf0\xd9\xf7\x9ex" +
-	"\x89\xf4\x05\x00QB!Z\xf1\x1b\xfb\x15\x04M\xe5\xfd" +
-	"\x84\xe0\x85\xaf>\x1a\xab>w\xf2\x0c\xa9\x0b\xa2\xfb\xd5" +
-	"\x9c1J\x04\xb3\xf2\xb8r~y\xe2\x83\xc6M\x92\xcb" +
-	"\xab\x1e~]>\x1d\xe4o\x13\x82\xb9?\x0cu\xda7" +
-	"\x0e\x9f'5\x8b\x16\x8b\x86\xe1\xb7|\x04\xda\xcf\xf2\xa8" +
-	"\xfd\x18\x1a\x8fl=\xfe|r\xe2\xf8\x05\xd2\xb3\x88q" +
-	"N\xb6I\xebg\x12.\xb4W\xc2\xe0\xa7\x12\x0e#\x04" +
-	"\xd9w\xfe\xfb\xd6P\xf9\xf2\xc5i\xbe\xc3\xcc\xd6)\x93" +
-	"\xda\x83\x8a<mR\x1e!\x04l\xc2\x98s\xe8\xcb{" +
-	"\xae\xc4RxW\xf9\x0e\x94\x08\xc6\x1e\xd8:\xde\xbe\xff" +
-	"\xea\xd5\xa9\x14 \xaf^U\xc2\x14\xce*2\xfbU\xdb" +
-	"\x07\xc5\xb6\xde\xcd\xd7I\xcd\xf2\x9b\x0ayY\xe9\x83v" +
-	"-\x0c2\xa1\\\xd0\xaa)\x85(8v`x\xfd\xea" +
-	"y\x1fO\xc6\xddmJMJwfJ\xba\xdb\xd9\xfb" +
-	"\xfd}\xf3\x8f}29\x8duh\xf8Tj1\xb4\x17" +
-	"\xa5\x1f\xed\x844\xbe\xb1\xf6\xe5\xcf\xb3\xe9\xecOz\x16" +
-	"q\xdb\x90\xfe\xd9\xd48\xb4\xcf\xa4\xed\x8aOS9P" +
-	"O\xe0\xd7m[Xn-Q\xfaWt,--\x19" +
-	"5\xbb\xd6\xb7f\x8f\xe9\xf9\xa6]\xd9\x18\xe2\xfd\x05\xc7" +
-	"2K{\x0b\x80\xde\x01F\xa4\xce\xed#\x02\xd4Y[" +
-	"\x88\xc0Tu\x88\xa8\xdf\xac\xd8\x8e+\x82\xb2\xe9\x95\x1c" +
-	"\xdb\x16\xc4K\xfe\xc1\x1d\x86e\xd8%\xd1\x0c\xd4vk" +
-	"\xa0F\x80\xa2pw\x0bwi\xddvE\xc5\xf4|\xe1" +
-	"6\xe0\xee\xfe\x82\xe1\x1aUOO\xf0\x04Q\x02Dj" +
-	"\xe7I\"\xbd\x8bC\xff'CPq\x8d\x92(\x08\x17" +
-	"\xa6S\x1e3l\xa7\xc8E\x09IbH\x12\x9aAg" +
-	"\xfe\xd5\xa0\x1b\x84W\xb7|\x8f\x9a\xafn\xff~\xda\xeb" +
-	"\x82\x91\x0e)w4)\xaf\xd9\"'\x8cC/0\xa8" +
-	"@F\xce\x8c\xban\x84H\x1f\xe5\xd073\xa8\x8ce" +
-	"\xc2\xb2n\x1a\"\xd2\x0b\x1c\xfa6\x86\xc0q\xcd\x8ai" +
-	"\xdf+\x88\xbb>:\x89\xa1\x93\x10\xecr<\xdf6\xaa" +
-	"\x82\x88\xd0A\x0c\x1d\x84\x83N\xcd7\x1d\xdbCWk" +
-	"\x1e\x08\xe8\x8a\x95\xe0\x0f>\xf0`\xdd\xdf%l\xdf," +
-	"\x19\xf21Q\xf8m[\x94\xe7\x11\xe9\x03\x1c\xfah\x8c" +
-	"r\xfe\xdf\xb1<\"\xca\xebv\xb4\xf2P\x1e\x16{#" +
-	"V9Q5L+\xfa\x15%3H\xca\xfd-\x9b\xdb" +
-	"\xf1\xdb\x10V\xd5\x0d\xd9\xad\xaf\xe5\xc2\x0c%\xc7%\x11" +
-	"Gm>F\x88\x8a\xdd\xe0(.C\x8b\xa6\xd6\x83!" +
-	"\xa2\xe2B\x89\xafD\x8b\xa9\xb6\x1cY\xa2\xe2\x12\x89\xf7" +
-	"\x82\x01<\x03N\xa4\xad\xc2\x1bD\xc5^\x09\x0fK\xf3" +
-	"\x04\xcf A\xa4\x0d\x86\xee\x07$>*\xf1d\"\x83" +
-	"$\x91\x96\xc7b\xa2\xe2\xb0\xc4\xb7K\xbc\x8de\xd0F" +
-	"\xa4=\x84q\xa2\xe26\x89\xef\x92\xb8\x92\xcc\xc8\x11\xd5" +
-	"\x04\\\xa2bY\xe25\x89\xa7fg\x90\"\xd2\xaa!" +
-	"nI|\x8f\xc4\xdb\xe7d\xd0N\xa4\xd5q\x98\xa8\xe8" +
-	"K\xfc\x90\xc4g \x83\x19D\xda~\x9c$*\x1e\x92" +
-	"\xf8\xd3`\x08J\x96)l?_\x8ew\xc2n\xe1z" +
-	"\xa6cG\xbf\xb9\xe35K-\xa6\x06\x1a\x8d6-8" +
-	"i9\xd1H\xb7d\x9f\x804!\xa89\x8e5vs" +
-	"\x87\xa5}\xa3\xe2a&\xa1\xc0\x81\xae\x96\x8c\x12$\x18" +
-	"\x84\xf3^\xf2MJ;v\xbe\x8c6bhk~\xf2" +
-	"Q\x87r%\xc3\xca\xd7\x9aLLo\xb0\xee;\xf5\x1a" +
-	"\xe5\xca\x86/\xca\x001\x80\x10\xb8u{\xad\xebT7" +
-	"B\xb8U\xd36,j\xde\x94\x9cj\xcd\x15\x9e\x07\xd3" +
-	"\xb1\xf5\xbaa\x99\xdc\xdf\x8bvbh\x8f\xf5\x10\x9b\xde" +
-	"C\xb9Z\xdfF\xa3\"{&\xd5\xec\xebE\x8b\x89\xf4" +
-	"n\x0e}Y\xac\xaf{d_/\xe4\xd0W2\xa4\xe5" +
-	"p5{x\xb7a\xd5\xc5-\xddz'\x15\xab\x08\xbf" +
-	"q\xca\xdb;\x9d\xee\x82\xe1*F\xd5\xfb\x9b\xaf7\x08" +
-	"/-\xc5(\xae\x80}Dz\x8aC\xcf0\xf4\xbb\xa1" +
-	"V\xa1\xab\xb5%\xa6\x8d>\xff\xb3p\xfd\x8d(\x8d\xb9" +
-	"O\x125W3\xa2\x8d\xa4\xea\xfb\x88\xa9y\x05\xadm" +
-	"\x88h\xf9\xa9\xffw\x89\xa9\xab\x14\xb0\xe6\xbf\x01D[" +
-	"_]t\x94\x98:_\x09\"e\xa4\xfeF\xc8\x01\x04" +
-	"Qv\x94\x0b\xf3\x1b@\x10\xc9/\"\x05%\x1a@\x01" +
-	"w_\xee[\xd4;\xe7\xddM\xc5\xa2Uy\xe7z5" +
-	"\xe2\xa4%_Y\xad\x98\xdfq\"\xbd\x83C\x9f\xcd\x10" +
-	"X\xce\x94\x94\xa6\xc7b-t;\x89k\x10\x8e\x84." +
-	"-\x1fK\xff\x99\xa6\xff\xfdR\x85\xf7p\xe8Gb\xdd" +
-	"\xfa\x98\x04\x1f\xe5\xd0\x9f\x8c\xa9\xf0\xe3r\x9b\x1c\xe1\xd0" +
-	"O7\x85M=u\x94H?\xcd\xa1\xbf\xd9R5\xf5" +
-	"ui\xf8\x1a\x87\xfe>\x83\"\\7\xe2\xa9\xd4\xdd\x96" +
-	"X[Ne\xd4\xb4\x85'%`j\xea\xe5\x95\x9c\xf5" +
-	"\x9ap\xab\x86-l\xf8k\x0d\xd3\xaa\xbb\x82Zc\xda" +
-	"\xc8/?\x1cS\x8e\xdf\x03\x00\x00\xff\xff#\xa3\xb8\x8f"
+const schema_db8274f9144abc7e = "x\xda\x9cV_\x8c\x13U\x17?\xbf{\xdb\x9d\x16v" +
+	"\xe9N\xa6$\xd0|\xa4\xf9\x08||\x10A\x101\xb0" +
+	"\xfe\xd9?.h\xd7e\xe9\xd0\xd5\x10\xc0\x84\xa1\xbd\x94" +
+	"Y\xdb\x99ff\x8a,\xe1\x7f\xd6\x88D\x09\x08<\x88" +
+	"`\x90\x84\x08\x86\xa8\x89&&\x06\x13|P\x1ex " +
+	"&b4\x92\x18%<H$\xc4\x8d<hb\xc6\xdc" +
+	"\xe9N[v\x15\xd0\xb7\xdb\xdf=\xf7\x9c\xdf9s\xce" +
+	"\xeft\xe1\xffx\x17[\x14\xfd>J\xa4\xf7F[\xfc" +
+	"\xc7\xca\x97O=r\xf4\xd2\x08\xa9)\xe6\xef<\xdf\x97" +
+	"\xfc\xcd\xdb\xfb\x1d\x11\x16_a\xdb\xa0\xfd\xc4\x14\"\xed" +
+	":[E\xf0/?p\xfe\x93\x83\x1f\xbe\xfc&\xe9s" +
+	"\x00\xa2\x88B\xb4\xf8\x0f\xf6;\x08\x9a\xca;\x09\xfe\x91" +
+	"o>\x1d(\x1f:v\x8a\xd49\xe1\xfd2\xce\x18E" +
+	"\xfc\xa9\x19\\\xbd\xb0(\xf2q\xed&\xca\xe5\xd5|~" +
+	"C>\xed\xe6\xef\x13\xfc\x197{\xda\xac[{/\x90" +
+	"\x9aB\x83E\xcd\xf0\x07\xde\x07\xed\xb6<j\xbf\x04\xc6" +
+	"}\xeb\x0e\xbf\x1e\xbd~\xf8\"\xe9)4q\x8e*\xd2" +
+	"\xfa\xb5\x88\x03\xed\xed \xf8\x89\xc8;\x8c\xe0\xa7>x" +
+	"\xf4\xbd\x9e\xc2\xb7\x97\xc6\xf9\x0e2{E\x19\xd5\x8e\xca" +
+	"w\xda!\xe5E\x82\xcf\xae\x1b\xd3w\x7f\xfd\xc4\xd5\xa6" +
+	"\x14n*?\x82\"\xfe\xc0s\xeb\x86\xe2;\xae]\x1b" +
+	"K\x01\x013%H\xe1\xb6\"\xb3_\xb2\xa1[\xac_" +
+	"\xba\xe6\x06\xa9)~G!\xa7\xc6:\xa0\xcd\x8e\xc9 " +
+	"\xff\x8d]\xd4\xce\xca\x93\x7f`g\xef\xaae3?\x1b" +
+	"mvw(6*\xdd\x9d\x8eIw\x9b\x96\xfe\xfc\xd4" +
+	"\xec\x03_\x8c\x8ec\x1d\x18~\x1e\x9b\x07\xedJ\xe0\xf1" +
+	"Ki|k\xc5[_\xa5\x12\xa9_\xf5\x14\x9am\x03" +
+	"\xfa\xb7cC\xd0\xe2qy\x8c\xc6\xd3\xa0\xf9\xbeW\xb5" +
+	",Qr*\x91\xfc\x83\xe11\xbf oT\xacJ\xc7" +
+	"\xf2\xad\xa6\xeb\x99Vq0\xc0;\xb3v\xc9\xcc\x0fg" +
+	"\x01\xbd\x15\x8cH\x9d\xd1A\x04\xa8S\xd7\x12\x81\xa9j" +
+	"\x0fQ\xa7Y\xb4lG\xf8\x05\xd3\xcd\xdb\x96%\x88\xe7" +
+	"\xbd]\x1b\x8d\x92a\xe5E=P\xcb\xc4@\xb5\x009" +
+	"\xe1l\x11\xce\x82\xaa\xe5\x88\xa2\xe9z\xc2\xa9\xc1\xb3:" +
+	"\xb3\x86c\x94]=\xc2#D\x11\x10\xa9m\xc7\x88\xf4" +
+	"v\x0e\xfd?\x0c~\xd11\xf2\"+\x1c\x98va\xc0" +
+	"\xb0\xec\x1c\x17yD\x89!J\xa8\x07\x9d\xf2O\x83\xae" +
+	"\x16n\xb5\xe4\xb9T\x7fu\xf7\xf7\xe3^g\x8dD@" +
+	"\xb9\xb5Ny\xf9Z9a\x1cz\x96A\x05\x92rf" +
+	"\xd4\x95}Dz?\x87\xbe\x86Ae,\x19\x94\xf5\xd9" +
+	"\x1e\"=\xcb\xa1\xafg\xf0m\xc7,\x9a\xd6\x93\x82\xb8" +
+	"\xe3\xa1\x8d\x18\xda\x08\xfef\xdb\xf5,\xa3,\x88\x08\xad" +
+	"\xc4\xd0J\xd8eW<\xd3\xb6\\\xb47\xe6\x81\x80\xf6" +
+	"\xa6\x12\xfc\xc5\x07\xee\xaez\x9b\x85\xe5\x99yC>&" +
+	"\x0a\xbem\x83\xf2L\"\xbd\x8bC\xefo\xa2\x9cy\xa8" +
+	")\x8f\x90\xf2\xca\x8d\x8d<\x94\x17\xc4p\xc8*-\xca" +
+	"\x86Y\x0a\x7f\x85\xc9t\x93\xf2L\xc3\xe6n\xfcV\x07" +
+	"Uu\x02v\xab*\xe9 C\xc9qa\xc8Q\xebF" +
+	"\x1fQ\xae\x0b\x1c\xb9~4hj\x19\xf4\x10\xe5z%" +
+	"\x9eE\x83\xa9\xb6\x12)\xa2\xdc\xd3\x12\x1f\x04\x03x\x12" +
+	"\x9cH\xd3\xf1.QnP\xc2\x1b\xa4y\x84'\x11!" +
+	"\xd2\x9e\x0f\xdc\xaf\x97\xf8f\x89G#ID\x894\x81" +
+	"yD\xb9\x0d\x12\xdf.\xf1\x16\x96D\x0b\x916\x8c!" +
+	"\xa2\xdcV\x89\x8fH\\\x89&\xe5\x88j{\xe0\x10\xe5" +
+	"vK\xfcU\x89\xc7\xa6%\x11\x93\x82\x13\xe0\xfb$~" +
+	"D\xe2\xf1\xe9I\xc4\xa5\xfc`/Q\xee\xa0\xc4\x8fK" +
+	"|\x12\x92\x98D\xa4\xbd\x81cD\xb9\xe3\x12?#\xf1" +
+	"\xc9-IL&\xd2N\x07|NJ\xfc\x1c\x18\xfc|" +
+	"\xc9\x14\x96\x97)4w\xc8\x16\xe1\xb8\xa6m\x85\xbf\xb9" +
+	"\xed\xd6?\x81\x18\x1bt\xd4\xda7k'\xe4\xa4#\xd1" +
+	"X\x07\x04$\x08~\xc5\xb6K\x03wv^\xc23\x8a" +
+	".\xa6\x10\xb2\x1cho\xc8+A\x82~\xa0\x03y\xcf" +
+	"\xa4\x84me\x0ah!\x86\x96z+\xf4\xdb\x94\xce\x1b" +
+	"\xa5L\xa5\xce\xc4t\xbb\xab\x9e]\xadP\xba`x\xa2" +
+	"\x00\x10\x03\x08\xbeS\xb5V8vy\x10\xc2)\x9b\x96" +
+	"Q\xa2\xfaM\xde.W\x1c\xe1\xba0mK\xaf\x1a%" +
+	"\x93{\xc3\x88\x13C\x9c\x90\xa8V\xcd\xc2\x84Fc\xe3" +
+	"\x1b-]\xe9\x184\x8a\xb2\xb1b\xf5\xe6\x9f;\x8fH" +
+	"\x9f\xc5\xa1/lj\xfe\xf9\xb2\xf9\xff\xcf\xa1?\xcc\x90" +
+	"\x90\x13Xo\xf4-F\xa9*&D\xba\x97\xd4\x15\x85" +
+	"W;e\xacM\xf6\xac\xac\xe1(F\xd9\xfd\x97\xafW" +
+	"\x0b7!\x15\xabY&;\x88\xf4\x18\x87\x9ed\xe8t" +
+	"\x02AC{c\x95\x8c\xd3\x07\xfew\xe1:kQj" +
+	"\xe2\x10%\xaa\xefo\x84kK\xd5\xb7\x11S3\x0a\x1a" +
+	"+\x13\xe1\x86T\x1fw\x88\xa9K\x14\xb0\xfa_\x06\x84" +
+	"\x7f\x0d\xd4\xb9\xfb\x89\xa9\xb3\x15?\x94O\xea\xac\x85\xec" +
+	"\x82\x1ffG\xe9 \xbf.\xf8\xa1F#\x94Y\xa2." +
+	"dq\xff\xe5\x9e \xf1i\xf7~*\x16\xee\xd3{\xd7" +
+	"\xab\x16'!\xf9\xcaj5\xf9\x1d\"\xd2[9\xf4i" +
+	"\x0c~\xc9\x1e\xd3\xdb\xc4@S\x0b\xddM\x07k\x84C" +
+	"5L\xc8\xc7\xd2\x7f\xb2\xee\x7f\x87\x94\xea\xad\x1c\xfaH" +
+	"S\xb7\xee\x91\xe0v\x0e}_\x93T\xbf$W\xce\x08" +
+	"\x87~\xb2\xae~\xea\x89\xfdD\xfaI\x0e\xfd\\C\xfa" +
+	"\xd4\xb3\xd2\xf0\x0c\x87\xfe\x11\x83\"\x1c'\xe4\xa9T\x9d" +
+	"\x86\xa2\x97\xecb\xbfi\x09W\xea\xc1\x98\x04\xc8+9" +
+	"\xf8\x15\xe1\x94\x0dKX\xf0V\x18f\xa9\xea\x08j\xcc" +
+	"l-\xbfLo\x93\x8c\xfc\x19\x00\x00\xff\xff@V\xc0" +
+	"\xb7"

 func init() {
 	schemas.Register(schema_db8274f9144abc7e,
@@ -6,6 +6,9 @@ import (
 	"net/url"
 	"strings"

+	"net/http"
+
+	"github.com/pkg/errors"
 	"golang.org/x/net/idna"
 )

@@ -15,7 +18,7 @@ var supportedProtocol = [2]string{"http", "https"}

 func ValidateHostname(hostname string) (string, error) {
 	if hostname == "" {
-		return "", fmt.Errorf("Hostname should not be empty")
+		return "", nil
 	}
 	// users gives url(contains schema) not just hostname
 	if strings.Contains(hostname, ":") || strings.Contains(hostname, "%3A") {
@@ -48,7 +51,7 @@ func ValidateHostname(hostname string) (string, error) {

 func ValidateUrl(originUrl string) (string, error) {
 	if originUrl == "" {
-		return "", fmt.Errorf("Url should not be empty")
+		return "", fmt.Errorf("URL should not be empty")
 	}

 	if net.ParseIP(originUrl) != nil {
@@ -134,3 +137,58 @@ func validateIP(scheme, host, port string) (string, error) {
 	}
 	return fmt.Sprintf("%s://%s", scheme, host), nil
 }
+
+func ValidateHTTPService(originURL string, hostname string, transport http.RoundTripper) error {
+	parsedURL, err := url.Parse(originURL)
+	if err != nil {
+		return err
+	}
+
+	client := &http.Client{
+		Transport: transport,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+
+	initialRequest, err := http.NewRequest("GET", parsedURL.String(), nil)
+	if err != nil {
+		return err
+	}
+	initialRequest.Host = hostname
+	_, initialErr := client.Do(initialRequest)
+	if initialErr != nil {
+		// Attempt the same endpoint via the other protocol (http/https); maybe we have better luck?
+		oldScheme := parsedURL.Scheme
+		parsedURL.Scheme = toggleProtocol(parsedURL.Scheme)
+
+		secondRequest, err := http.NewRequest("GET", parsedURL.String(), nil)
+		if err != nil {
+			return err
+		}
+		secondRequest.Host = hostname
+		_, secondErr := client.Do(secondRequest)
+		if secondErr == nil { // Worked this time--advise the user to switch protocols
+			return errors.Errorf(
+				"%s doesn't seem to work over %s, but does seem to work over %s. Consider changing the origin URL to %s",
+				parsedURL.Host,
+				oldScheme,
+				parsedURL.Scheme,
+				parsedURL,
+			)
+		}
+	}
+
+	return initialErr
+}
+
+func toggleProtocol(httpProtocol string) string {
+	switch httpProtocol {
+	case "http":
+		return "https"
+	case "https":
+		return "http"
+	default:
+		return httpProtocol
+	}
+}
@@ -1,16 +1,27 @@
 package validation

 import (
+	"bytes"
 	"fmt"
+	"io/ioutil"
 	"testing"

+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+
 	"github.com/stretchr/testify/assert"
 )

 func TestValidateHostname(t *testing.T) {
 	var inputHostname string
 	hostname, err := ValidateHostname(inputHostname)
-	assert.Equal(t, err, fmt.Errorf("Hostname should not be empty"))
+	assert.Equal(t, err, nil)
 	assert.Empty(t, hostname)

 	inputHostname = "hello.example.com"
@@ -42,7 +53,7 @@ func TestValidateHostname(t *testing.T) {

 func TestValidateUrl(t *testing.T) {
 	validUrl, err := ValidateUrl("")
-	assert.Equal(t, fmt.Errorf("Url should not be empty"), err)
+	assert.Equal(t, fmt.Errorf("URL should not be empty"), err)
 	assert.Empty(t, validUrl)

 	validUrl, err = ValidateUrl("https://localhost:8080")
@@ -134,3 +145,292 @@ func TestValidateUrl(t *testing.T) {
 	assert.Equal(t, "https://hello.example.com:8080", validUrl)

 }
+
+func TestToggleProtocol(t *testing.T) {
+	assert.Equal(t, "https", toggleProtocol("http"))
+	assert.Equal(t, "http", toggleProtocol("https"))
+	assert.Equal(t, "random", toggleProtocol("random"))
+	assert.Equal(t, "", toggleProtocol(""))
+}
+
+// Happy path 1: originURL is HTTP, and HTTP connections work
+func TestValidateHTTPService_HTTP2HTTP(t *testing.T) {
+	originURL := "http://127.0.0.1/"
+	hostname := "example.com"
+
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			return emptyResponse(200), nil
+		}
+		if req.URL.Scheme == "https" {
+			t.Fatal("http works, shouldn't have tried with https")
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			return emptyResponse(503), nil
+		}
+		if req.URL.Scheme == "https" {
+			t.Fatal("http works, shouldn't have tried with https")
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	// Integration-style test with a mock server
+	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, hostname, r.Host)
+		w.WriteHeader(200)
+	}))
+	assert.NoError(t, err)
+	defer server.Close()
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, client.Transport))
+
+	// this will fail if the client follows the 302
+	redirectServer, redirectClient, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/followedRedirect" {
+			t.Fatal("shouldn't have followed the 302")
+		}
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:443", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		w.Header().Set("Location", "/followedRedirect")
+		w.WriteHeader(302)
+	}))
+	assert.NoError(t, err)
+	defer redirectServer.Close()
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
+
+}
+
+// Happy path 2: originURL is HTTPS, and HTTPS connections work
+func TestValidateHTTPService_HTTPS2HTTPS(t *testing.T) {
+	originURL := "https://127.0.0.1/"
+	hostname := "example.com"
+
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			t.Fatal("https works, shouldn't have tried with http")
+		}
+		if req.URL.Scheme == "https" {
+			return emptyResponse(200), nil
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			t.Fatal("https works, shouldn't have tried with http")
+		}
+		if req.URL.Scheme == "https" {
+			return emptyResponse(503), nil
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	// Integration-style test with a mock server
+	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:443", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		w.WriteHeader(200)
+	}))
+	assert.NoError(t, err)
+	defer server.Close()
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, client.Transport))
+
+	// this will fail if the client follows the 302
+	redirectServer, redirectClient, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/followedRedirect" {
+			t.Fatal("shouldn't have followed the 302")
+		}
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:443", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		w.Header().Set("Location", "/followedRedirect")
+		w.WriteHeader(302)
+	}))
+	assert.NoError(t, err)
+	defer redirectServer.Close()
+	assert.Nil(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
+}
+
+// Error path 1: originURL is HTTPS, but HTTP connections work
+func TestValidateHTTPService_HTTPS2HTTP(t *testing.T) {
+	originURL := "https://127.0.0.1:1234/"
+	hostname := "example.com"
+
+	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			return emptyResponse(200), nil
+		}
+		if req.URL.Scheme == "https" {
+			return nil, assert.AnError
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			return emptyResponse(503), nil
+		}
+		if req.URL.Scheme == "https" {
+			return nil, assert.AnError
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	// Integration-style test with a mock server
+	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:1234", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		w.WriteHeader(200)
+	}))
+	assert.NoError(t, err)
+	defer server.Close()
+	assert.Error(t, ValidateHTTPService(originURL, hostname, client.Transport))
+
+	// this will fail if the client follows the 302
+	redirectServer, redirectClient, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/followedRedirect" {
+			t.Fatal("shouldn't have followed the 302")
+		}
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:1234", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		w.Header().Set("Location", "/followedRedirect")
+		w.WriteHeader(302)
+	}))
+	assert.NoError(t, err)
+	defer redirectServer.Close()
+	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
+
+}
+
+// Error path 2: originURL is HTTP, but HTTPS connections work
+func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
+	originURL := "http://127.0.0.1:1234/"
+	hostname := "example.com"
+
+	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			return nil, assert.AnError
+		}
+		if req.URL.Scheme == "https" {
+			return emptyResponse(200), nil
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
+		assert.Equal(t, req.Host, hostname)
+		if req.URL.Scheme == "http" {
+			return nil, assert.AnError
+		}
+		if req.URL.Scheme == "https" {
+			return emptyResponse(503), nil
+		}
+		panic("Shouldn't reach here")
+	})))
+
+	// Integration-style test with a mock server
+	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:1234", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		w.WriteHeader(200)
+	}))
+	assert.NoError(t, err)
+	defer server.Close()
+	assert.Error(t, ValidateHTTPService(originURL, hostname, client.Transport))
+
+	// this will fail if the client follows the 302
+	redirectServer, redirectClient, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/followedRedirect" {
+			t.Fatal("shouldn't have followed the 302")
+		}
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:443", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		w.Header().Set("Location", "/followedRedirect")
+		w.WriteHeader(302)
+	}))
+	assert.NoError(t, err)
+	defer redirectServer.Close()
+	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
+}
+
+type testRoundTripper func(req *http.Request) (*http.Response, error)
+
+func (f testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func emptyResponse(statusCode int) *http.Response {
+	return &http.Response{
+		StatusCode: statusCode,
+		Body:       ioutil.NopCloser(bytes.NewReader(nil)),
+		Header:     make(http.Header),
+	}
+}
+
+func createMockServerAndClient(handler http.Handler) (*httptest.Server, *http.Client, error) {
+	client := http.DefaultClient
+	server := httptest.NewServer(handler)
+
+	client.Transport = &http.Transport{
+		Proxy: func(req *http.Request) (*url.URL, error) {
+			return url.Parse(server.URL)
+		},
+	}
+
+	return server, client, nil
+}
+
+func createSecureMockServerAndClient(handler http.Handler) (*httptest.Server, *http.Client, error) {
+	client := http.DefaultClient
+	server := httptest.NewTLSServer(handler)
+
+	cert, err := x509.ParseCertificate(server.TLS.Certificates[0].Certificate[0])
+	if err != nil {
+		server.Close()
+		return nil, nil, err
+	}
+
+	certpool := x509.NewCertPool()
+	certpool.AddCert(cert)
+
+	client.Transport = &http.Transport{
+		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return net.Dial("tcp", server.URL[strings.LastIndex(server.URL, "/")+1:])
+		},
+		TLSClientConfig: &tls.Config{
+			RootCAs: certpool,
+		},
+	}
+
+	return server, client, nil
+}
@@ -0,0 +1,27 @@
+Copyright (c) 2013 CloudFlare, Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of the CloudFlare, Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -0,0 +1,3 @@
+cover.out~
+benchmark/benchmark
+
@@ -0,0 +1,41 @@
+# Copyright (c) 2013 CloudFlare, Inc.
+
+RACE+=--race
+
+PKGNAME=github.com/cloudflare/golibs/lrucache
+SKIPCOVER=list.go|list_extension.go|priorityqueue.go
+
+.PHONY: all test bench cover clean
+
+all:
+	@echo "Targets:"
+	@echo "  test: run tests with race detector"
+	@echo "  cover: print test coverage"
+	@echo "  bench: run basic benchmarks"
+
+test:
+	@go test $(RACE) -bench=. -v $(PKGNAME)
+
+COVEROUT=cover.out
+cover:
+	@go test -coverprofile=$(COVEROUT) -v $(PKGNAME)
+	@cat $(COVEROUT) | egrep -v '$(SKIPCOVER)' > $(COVEROUT)~
+	@go tool cover -func=$(COVEROUT)~|sed 's|^.*/\([^/]*/[^/]*/[^/]*\)$$|\1|g'
+
+bench:
+	@echo "[*] Scalability of cache/lrucache"
+	@echo "[ ] Operations in shared cache using one core"
+	@GOMAXPROCS=1 go test -run=- -bench='.*LRUCache.*' $(PKGNAME) \
+		| egrep -v "^PASS|^ok"
+
+	@echo "[*] Scalability of cache/multilru"
+	@echo "[ ] Operations in four caches using four cores	"
+	@GOMAXPROCS=4 go test -run=- -bench='.*MultiLRU.*' $(PKGNAME) \
+		| egrep -v "^PASS|^ok"
+
+
+	@(cd benchmark; go build $(PKGNAME)/benchmark)
+	@./benchmark/benchmark
+
+clean:
+	rm -rf $(COVEROUT) $(COVEROUT)~ benchmark/benchmark
@@ -0,0 +1,40 @@
+LRU Cache
+---------
+
+A `golang` implementation of last recently used cache data structure.
+
+To install:
+
+    go get github.com/cloudflare/golibs/lrucache
+
+To test:
+
+    cd $GOPATH/src/github.com/cloudflare/golibs/lrucache
+    make test
+
+For coverage:
+
+    make cover
+
+Basic benchmarks:
+
+    $ make bench  # As tested on my two core i5
+    [*] Scalability of cache/lrucache
+    [ ] Operations in shared cache using one core
+    BenchmarkConcurrentGetLRUCache       5000000               450 ns/op
+    BenchmarkConcurrentSetLRUCache       2000000               821 ns/op
+    BenchmarkConcurrentSetNXLRUCache     5000000               664 ns/op
+
+    [*] Scalability of cache/multilru
+    [ ] Operations in four caches using four cores
+    BenchmarkConcurrentGetMultiLRU-4     5000000               475 ns/op
+    BenchmarkConcurrentSetMultiLRU-4     2000000               809 ns/op
+    BenchmarkConcurrentSetNXMultiLRU-4   5000000               643 ns/op
+
+    [*] Capacity=4096 Keys=30000 KeySpace=15625
+                vitess          LRUCache        MultiLRUCache-4
+    create      1.709us         1.626374ms      343.54us
+    Get (miss)  144.266083ms    132.470397ms    177.277193ms
+    SetNX #1    338.637977ms    380.733302ms    411.709204ms
+    Get (hit)   195.896066ms    173.252112ms    234.109494ms
+    SetNX #2    349.785951ms    367.255624ms    419.129127ms
@@ -0,0 +1,69 @@
+// Copyright (c) 2013 CloudFlare, Inc.
+
+// Package lrucache implements a last recently used cache data structure.
+//
+// This code tries to avoid dynamic memory allocations - all required
+// memory is allocated on creation.  Access to the data structure is
+// O(1). Modification O(log(n)) if expiry is used, O(1)
+// otherwise.
+//
+// This package exports three things:
+//  LRUCache: is the main implementation. It supports multithreading by
+//      using guarding mutex lock.
+//
+//  MultiLRUCache: is a sharded implementation. It supports the same
+//      API as LRUCache and uses it internally, but is not limited to
+//      a single CPU as every shard is separately locked. Use this
+//      data structure instead of LRUCache if you have have lock
+//      contention issues.
+//
+//  Cache interface: Both implementations fulfill it.
+package lrucache
+
+import (
+	"time"
+)
+
+// Cache interface is fulfilled by the LRUCache and MultiLRUCache
+// implementations.
+type Cache interface {
+	// Methods not needing to know current time.
+	//
+	// Get a key from the cache, possibly stale. Update its LRU
+	// score.
+	Get(key string) (value interface{}, ok bool)
+	// Get a key from the cache, possibly stale. Don't modify its LRU score. O(1)
+	GetQuiet(key string) (value interface{}, ok bool)
+	// Get and remove a key from the cache.
+	Del(key string) (value interface{}, ok bool)
+	// Evict all items from the cache.
+	Clear() int
+	// Number of entries used in the LRU
+	Len() int
+	// Get the total capacity of the LRU
+	Capacity() int
+
+	// Methods use time.Now() when neccessary to determine expiry.
+	//
+	// Add an item to the cache overwriting existing one if it
+	// exists.
+	Set(key string, value interface{}, expire time.Time)
+	// Get a key from the cache, make sure it's not stale. Update
+	// its LRU score.
+	GetNotStale(key string) (value interface{}, ok bool)
+	// Evict all the expired items.
+	Expire() int
+
+	// Methods allowing to explicitly specify time used to
+	// determine if items are expired.
+	//
+	// Add an item to the cache overwriting existing one if it
+	// exists. Allows specifing current time required to expire an
+	// item when no more slots are used.
+	SetNow(key string, value interface{}, expire time.Time, now time.Time)
+	// Get a key from the cache, make sure it's not stale. Update
+	// its LRU score.
+	GetNotStaleNow(key string, now time.Time) (value interface{}, ok bool)
+	// Evict items that expire before Now.
+	ExpireNow(now time.Time) int
+}
@@ -0,0 +1,238 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+/* This file is a slightly modified file from the go package sources
+and is released on the following license:
+
+Copyright (c) 2012 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+// Package list implements a doubly linked list.
+//
+// To iterate over a list (where l is a *List):
+//	for e := l.Front(); e != nil; e = e.Next() {
+//		// do something with e.Value
+//	}
+//
+
+package lrucache
+
+// Element is an element of a linked list.
+type element struct {
+	// Next and previous pointers in the doubly-linked list of elements.
+	// To simplify the implementation, internally a list l is implemented
+	// as a ring, such that &l.root is both the next element of the last
+	// list element (l.Back()) and the previous element of the first list
+	// element (l.Front()).
+	next, prev *element
+
+	// The list to which this element belongs.
+	list *list
+
+	// The value stored with this element.
+	Value interface{}
+}
+
+// Next returns the next list element or nil.
+func (e *element) Next() *element {
+	if p := e.next; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// Prev returns the previous list element or nil.
+func (e *element) Prev() *element {
+	if p := e.prev; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// List represents a doubly linked list.
+// The zero value for List is an empty list ready to use.
+type list struct {
+	root element // sentinel list element, only &root, root.prev, and root.next are used
+	len  int     // current list length excluding (this) sentinel element
+}
+
+// Init initializes or clears list l.
+func (l *list) Init() *list {
+	l.root.next = &l.root
+	l.root.prev = &l.root
+	l.len = 0
+	return l
+}
+
+// New returns an initialized list.
+// func New() *list { return new(list).Init() }
+
+// Len returns the number of elements of list l.
+// The complexity is O(1).
+func (l *list) Len() int { return l.len }
+
+// Front returns the first element of list l or nil
+func (l *list) Front() *element {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.next
+}
+
+// Back returns the last element of list l or nil.
+func (l *list) Back() *element {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.prev
+}
+
+// insert inserts e after at, increments l.len, and returns e.
+func (l *list) insert(e, at *element) *element {
+	n := at.next
+	at.next = e
+	e.prev = at
+	e.next = n
+	n.prev = e
+	e.list = l
+	l.len++
+	return e
+}
+
+// insertValue is a convenience wrapper for insert(&Element{Value: v}, at).
+func (l *list) insertValue(v interface{}, at *element) *element {
+	return l.insert(&element{Value: v}, at)
+}
+
+// remove removes e from its list, decrements l.len, and returns e.
+func (l *list) remove(e *element) *element {
+	e.prev.next = e.next
+	e.next.prev = e.prev
+	e.next = nil // avoid memory leaks
+	e.prev = nil // avoid memory leaks
+	e.list = nil
+	l.len--
+	return e
+}
+
+// Remove removes e from l if e is an element of list l.
+// It returns the element value e.Value.
+func (l *list) Remove(e *element) interface{} {
+	if e.list == l {
+		// if e.list == l, l must have been initialized when e was inserted
+		// in l or l == nil (e is a zero Element) and l.remove will crash
+		l.remove(e)
+	}
+	return e.Value
+}
+
+// PushFront inserts a new element e with value v at the front of list l and returns e.
+func (l *list) PushFront(v interface{}) *element {
+	return l.insertValue(v, &l.root)
+}
+
+// PushBack inserts a new element e with value v at the back of list l and returns e.
+func (l *list) PushBack(v interface{}) *element {
+	return l.insertValue(v, l.root.prev)
+}
+
+// InsertBefore inserts a new element e with value v immediately before mark and returns e.
+// If mark is not an element of l, the list is not modified.
+func (l *list) InsertBefore(v interface{}, mark *element) *element {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark.prev)
+}
+
+// InsertAfter inserts a new element e with value v immediately after mark and returns e.
+// If mark is not an element of l, the list is not modified.
+func (l *list) InsertAfter(v interface{}, mark *element) *element {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark)
+}
+
+// MoveToFront moves element e to the front of list l.
+// If e is not an element of l, the list is not modified.
+func (l *list) MoveToFront(e *element) {
+	if e.list != l || l.root.next == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), &l.root)
+}
+
+// MoveToBack moves element e to the back of list l.
+// If e is not an element of l, the list is not modified.
+func (l *list) MoveToBack(e *element) {
+	if e.list != l || l.root.prev == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), l.root.prev)
+}
+
+// MoveBefore moves element e to its new position before mark.
+// If e is not an element of l, or e == mark, the list is not modified.
+func (l *list) MoveBefore(e, mark *element) {
+	if e.list != l || e == mark {
+		return
+	}
+	l.insert(l.remove(e), mark.prev)
+}
+
+// MoveAfter moves element e to its new position after mark.
+// If e is not an element of l, or e == mark, the list is not modified.
+func (l *list) MoveAfter(e, mark *element) {
+	if e.list != l || e == mark {
+		return
+	}
+	l.insert(l.remove(e), mark)
+}
+
+// PushBackList inserts a copy of an other list at the back of list l.
+// The lists l and other may be the same.
+func (l *list) PushBackList(other *list) {
+	for i, e := other.Len(), other.Front(); i > 0; i, e = i-1, e.Next() {
+		l.insertValue(e.Value, l.root.prev)
+	}
+}
+
+// PushFrontList inserts a copy of an other list at the front of list l.
+// The lists l and other may be the same.
+func (l *list) PushFrontList(other *list) {
+	for i, e := other.Len(), other.Back(); i > 0; i, e = i-1, e.Prev() {
+		l.insertValue(e.Value, &l.root)
+	}
+}
@@ -0,0 +1,25 @@
+// Copyright (c) 2013 CloudFlare, Inc.
+
+// Extensions to "container/list" that allowing reuse of Elements.
+
+package lrucache
+
+func (l *list) PushElementFront(e *element) *element {
+	return l.insert(e, &l.root)
+}
+
+func (l *list) PushElementBack(e *element) *element {
+	return l.insert(e, l.root.prev)
+}
+
+func (l *list) PopElementFront() *element {
+	el := l.Front()
+	l.Remove(el)
+	return el
+}
+
+func (l *list) PopFront() interface{} {
+	el := l.Front()
+	l.Remove(el)
+	return el.Value
+}
@@ -0,0 +1,316 @@
+// Copyright (c) 2013 CloudFlare, Inc.
+
+package lrucache
+
+import (
+	"container/heap"
+	"sync"
+	"time"
+)
+
+// Every element in the cache is linked to three data structures:
+// Table map, PriorityQueue heap ordered by expiry and a LruList list
+// ordered by decreasing popularity.
+type entry struct {
+	element element     // list element. value is a pointer to this entry
+	key     string      // key is a key!
+	value   interface{} //
+	expire  time.Time   // time when the item is expired. it's okay to be stale.
+	index   int         // index for priority queue needs. -1 if entry is free
+}
+
+// LRUCache data structure. Never dereference it or copy it by
+// value. Always use it through a pointer.
+type LRUCache struct {
+	lock          sync.Mutex
+	table         map[string]*entry // all entries in table must be in lruList
+	priorityQueue priorityQueue     // some elements from table may be in priorityQueue
+	lruList       list              // every entry is either used and resides in lruList
+	freeList      list              // or free and is linked to freeList
+
+	ExpireGracePeriod time.Duration // time after an expired entry is purged from cache (unless pushed out of LRU)
+}
+
+// Initialize the LRU cache instance. O(capacity)
+func (b *LRUCache) Init(capacity uint) {
+	b.table = make(map[string]*entry, capacity)
+	b.priorityQueue = make([]*entry, 0, capacity)
+	b.lruList.Init()
+	b.freeList.Init()
+	heap.Init(&b.priorityQueue)
+
+	// Reserve all the entries in one giant continous block of memory
+	arrayOfEntries := make([]entry, capacity)
+	for i := uint(0); i < capacity; i++ {
+		e := &arrayOfEntries[i]
+		e.element.Value = e
+		e.index = -1
+		b.freeList.PushElementBack(&e.element)
+	}
+}
+
+// Create new LRU cache instance. Allocate all the needed memory. O(capacity)
+func NewLRUCache(capacity uint) *LRUCache {
+	b := &LRUCache{}
+	b.Init(capacity)
+	return b
+}
+
+// Give me the entry with lowest expiry field if it's before now.
+func (b *LRUCache) expiredEntry(now time.Time) *entry {
+	if len(b.priorityQueue) == 0 {
+		return nil
+	}
+
+	if now.IsZero() {
+		// Fill it only when actually used.
+		now = time.Now()
+	}
+
+	if e := b.priorityQueue[0]; e.expire.Before(now) {
+		return e
+	}
+	return nil
+}
+
+// Give me the least used entry.
+func (b *LRUCache) leastUsedEntry() *entry {
+	return b.lruList.Back().Value.(*entry)
+}
+
+func (b *LRUCache) freeSomeEntry(now time.Time) (e *entry, used bool) {
+	if b.freeList.Len() > 0 {
+		return b.freeList.Front().Value.(*entry), false
+	}
+
+	e = b.expiredEntry(now)
+	if e != nil {
+		return e, true
+	}
+
+	if b.lruList.Len() == 0 {
+		return nil, false
+	}
+
+	return b.leastUsedEntry(), true
+}
+
+// Move entry from used/lru list to a free list. Clear the entry as well.
+func (b *LRUCache) removeEntry(e *entry) {
+	if e.element.list != &b.lruList {
+		panic("list lruList")
+	}
+
+	if e.index != -1 {
+		heap.Remove(&b.priorityQueue, e.index)
+	}
+	b.lruList.Remove(&e.element)
+	b.freeList.PushElementFront(&e.element)
+	delete(b.table, e.key)
+	e.key = ""
+	e.value = nil
+}
+
+func (b *LRUCache) insertEntry(e *entry) {
+	if e.element.list != &b.freeList {
+		panic("list freeList")
+	}
+
+	if !e.expire.IsZero() {
+		heap.Push(&b.priorityQueue, e)
+	}
+	b.freeList.Remove(&e.element)
+	b.lruList.PushElementFront(&e.element)
+	b.table[e.key] = e
+}
+
+func (b *LRUCache) touchEntry(e *entry) {
+	b.lruList.MoveToFront(&e.element)
+}
+
+// Add an item to the cache overwriting existing one if it
+// exists. Allows specifing current time required to expire an item
+// when no more slots are used. O(log(n)) if expiry is set, O(1) when
+// clear.
+func (b *LRUCache) SetNow(key string, value interface{}, expire time.Time, now time.Time) {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	var used bool
+
+	e := b.table[key]
+	if e != nil {
+		used = true
+	} else {
+		e, used = b.freeSomeEntry(now)
+		if e == nil {
+			return
+		}
+	}
+	if used {
+		b.removeEntry(e)
+	}
+
+	e.key = key
+	e.value = value
+	e.expire = expire
+	b.insertEntry(e)
+}
+
+// Add an item to the cache overwriting existing one if it
+// exists. O(log(n)) if expiry is set, O(1) when clear.
+func (b *LRUCache) Set(key string, value interface{}, expire time.Time) {
+	b.SetNow(key, value, expire, time.Time{})
+}
+
+// Get a key from the cache, possibly stale. Update its LRU score. O(1)
+func (b *LRUCache) Get(key string) (v interface{}, ok bool) {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	e := b.table[key]
+	if e == nil {
+		return nil, false
+	}
+
+	b.touchEntry(e)
+	return e.value, true
+}
+
+// Get a key from the cache, possibly stale. Don't modify its LRU score. O(1)
+func (b *LRUCache) GetQuiet(key string) (v interface{}, ok bool) {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	e := b.table[key]
+	if e == nil {
+		return nil, false
+	}
+
+	return e.value, true
+}
+
+// Get a key from the cache, make sure it's not stale. Update its
+// LRU score. O(log(n)) if the item is expired.
+func (b *LRUCache) GetNotStale(key string) (value interface{}, ok bool) {
+	return b.GetNotStaleNow(key, time.Now())
+}
+
+// Get a key from the cache, make sure it's not stale. Update its
+// LRU score. O(log(n)) if the item is expired.
+func (b *LRUCache) GetNotStaleNow(key string, now time.Time) (value interface{}, ok bool) {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	e := b.table[key]
+	if e == nil {
+		return nil, false
+	}
+
+	if e.expire.Before(now) {
+		// Remove entries expired for more than a graceful period
+		if b.ExpireGracePeriod == 0 || e.expire.Sub(now) > b.ExpireGracePeriod {
+			b.removeEntry(e)
+		}
+		return nil, false
+	}
+
+	b.touchEntry(e)
+	return e.value, true
+}
+
+// Get a key from the cache, possibly stale. Update its LRU
+// score. O(1) always.
+func (b *LRUCache) GetStale(key string) (value interface{}, ok, expired bool) {
+	return b.GetStaleNow(key, time.Now())
+}
+
+// Get a key from the cache, possibly stale. Update its LRU
+// score. O(1) always.
+func (b *LRUCache) GetStaleNow(key string, now time.Time) (value interface{}, ok, expired bool) {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	e := b.table[key]
+	if e == nil {
+		return nil, false, false
+	}
+
+	b.touchEntry(e)
+	return e.value, true, e.expire.Before(now)
+}
+
+// Get and remove a key from the cache. O(log(n)) if the item is using expiry, O(1) otherwise.
+func (b *LRUCache) Del(key string) (v interface{}, ok bool) {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	e := b.table[key]
+	if e == nil {
+		return nil, false
+	}
+
+	value := e.value
+	b.removeEntry(e)
+	return value, true
+}
+
+// Evict all items from the cache. O(n*log(n))
+func (b *LRUCache) Clear() int {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	// First, remove entries that have expiry set
+	l := len(b.priorityQueue)
+	for i := 0; i < l; i++ {
+		// This could be reduced to O(n).
+		b.removeEntry(b.priorityQueue[0])
+	}
+
+	// Second, remove all remaining entries
+	r := b.lruList.Len()
+	for i := 0; i < r; i++ {
+		b.removeEntry(b.leastUsedEntry())
+	}
+	return l + r
+}
+
+// Evict all the expired items. O(n*log(n))
+func (b *LRUCache) Expire() int {
+	return b.ExpireNow(time.Now())
+}
+
+// Evict items that expire before `now`. O(n*log(n))
+func (b *LRUCache) ExpireNow(now time.Time) int {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	i := 0
+	for {
+		e := b.expiredEntry(now)
+		if e == nil {
+			break
+		}
+		b.removeEntry(e)
+		i += 1
+	}
+	return i
+}
+
+// Number of entries used in the LRU
+func (b *LRUCache) Len() int {
+	// yes. this stupid thing requires locking
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	return b.lruList.Len()
+}
+
+// Get the total capacity of the LRU
+func (b *LRUCache) Capacity() int {
+	// yes. this stupid thing requires locking
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	return b.lruList.Len() + b.freeList.Len()
+}
@@ -0,0 +1,118 @@
+// Copyright (c) 2013 CloudFlare, Inc.
+
+package lrucache
+
+import (
+	"hash/crc32"
+	"time"
+)
+
+// MultiLRUCache data structure. Never dereference it or copy it by
+// value. Always use it through a pointer.
+type MultiLRUCache struct {
+	buckets uint
+	cache   []*LRUCache
+}
+
+// Using this constructor is almost always wrong. Use NewMultiLRUCache instead.
+func (m *MultiLRUCache) Init(buckets, bucket_capacity uint) {
+	m.buckets = buckets
+	m.cache = make([]*LRUCache, buckets)
+	for i := uint(0); i < buckets; i++ {
+		m.cache[i] = NewLRUCache(bucket_capacity)
+	}
+}
+
+// Set the stale expiry grace period for each cache in the multicache instance.
+func (m *MultiLRUCache) SetExpireGracePeriod(p time.Duration) {
+	for _, c := range m.cache {
+		c.ExpireGracePeriod = p
+	}
+}
+
+func NewMultiLRUCache(buckets, bucket_capacity uint) *MultiLRUCache {
+	m := &MultiLRUCache{}
+	m.Init(buckets, bucket_capacity)
+	return m
+}
+
+func (m *MultiLRUCache) bucketNo(key string) uint {
+	// Arbitrary choice. Any fast hash will do.
+	return uint(crc32.ChecksumIEEE([]byte(key))) % m.buckets
+}
+
+func (m *MultiLRUCache) Set(key string, value interface{}, expire time.Time) {
+	m.cache[m.bucketNo(key)].Set(key, value, expire)
+}
+
+func (m *MultiLRUCache) SetNow(key string, value interface{}, expire time.Time, now time.Time) {
+	m.cache[m.bucketNo(key)].SetNow(key, value, expire, now)
+}
+
+func (m *MultiLRUCache) Get(key string) (value interface{}, ok bool) {
+	return m.cache[m.bucketNo(key)].Get(key)
+}
+
+func (m *MultiLRUCache) GetQuiet(key string) (value interface{}, ok bool) {
+	return m.cache[m.bucketNo(key)].Get(key)
+}
+
+func (m *MultiLRUCache) GetNotStale(key string) (value interface{}, ok bool) {
+	return m.cache[m.bucketNo(key)].GetNotStale(key)
+}
+
+func (m *MultiLRUCache) GetNotStaleNow(key string, now time.Time) (value interface{}, ok bool) {
+	return m.cache[m.bucketNo(key)].GetNotStaleNow(key, now)
+}
+
+func (m *MultiLRUCache) GetStale(key string) (value interface{}, ok, expired bool) {
+	return m.cache[m.bucketNo(key)].GetStale(key)
+}
+
+func (m *MultiLRUCache) GetStaleNow(key string, now time.Time) (value interface{}, ok, expired bool) {
+	return m.cache[m.bucketNo(key)].GetStaleNow(key, now)
+}
+
+func (m *MultiLRUCache) Del(key string) (value interface{}, ok bool) {
+	return m.cache[m.bucketNo(key)].Del(key)
+}
+
+func (m *MultiLRUCache) Clear() int {
+	var s int
+	for _, c := range m.cache {
+		s += c.Clear()
+	}
+	return s
+}
+
+func (m *MultiLRUCache) Len() int {
+	var s int
+	for _, c := range m.cache {
+		s += c.Len()
+	}
+	return s
+}
+
+func (m *MultiLRUCache) Capacity() int {
+	var s int
+	for _, c := range m.cache {
+		s += c.Capacity()
+	}
+	return s
+}
+
+func (m *MultiLRUCache) Expire() int {
+	var s int
+	for _, c := range m.cache {
+		s += c.Expire()
+	}
+	return s
+}
+
+func (m *MultiLRUCache) ExpireNow(now time.Time) int {
+	var s int
+	for _, c := range m.cache {
+		s += c.ExpireNow(now)
+	}
+	return s
+}
@@ -0,0 +1,37 @@
+// Copyright (c) 2013 CloudFlare, Inc.
+
+// This code is based on golang example from "container/heap" package.
+
+package lrucache
+
+type priorityQueue []*entry
+
+func (pq priorityQueue) Len() int {
+	return len(pq)
+}
+
+func (pq priorityQueue) Less(i, j int) bool {
+	return pq[i].expire.Before(pq[j].expire)
+}
+
+func (pq priorityQueue) Swap(i, j int) {
+	pq[i], pq[j] = pq[j], pq[i]
+	pq[i].index = i
+	pq[j].index = j
+}
+
+func (pq *priorityQueue) Push(e interface{}) {
+	n := len(*pq)
+	item := e.(*entry)
+	item.index = n
+	*pq = append(*pq, item)
+}
+
+func (pq *priorityQueue) Pop() interface{} {
+	old := *pq
+	n := len(old)
+	item := old[n-1]
+	item.index = -1
+	*pq = old[0 : n-1]
+	return item
+}
@@ -0,0 +1,202 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
@@ -0,0 +1,5 @@
+CoreOS Project
+Copyright 2014 CoreOS, Inc
+
+This product includes software developed at CoreOS, Inc.
+(http://www.coreos.com/).
@@ -0,0 +1,7 @@
+package http
+
+import "net/http"
+
+type Client interface {
+	Do(*http.Request) (*http.Response, error)
+}
@@ -0,0 +1,2 @@
+// Package http is DEPRECATED. Use net/http instead.
+package http
@@ -0,0 +1,161 @@
+package http
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"log"
+	"net/http"
+	"net/url"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+)
+
+func WriteError(w http.ResponseWriter, code int, msg string) {
+	e := struct {
+		Error string `json:"error"`
+	}{
+		Error: msg,
+	}
+	b, err := json.Marshal(e)
+	if err != nil {
+		log.Printf("go-oidc: failed to marshal %#v: %v", e, err)
+		code = http.StatusInternalServerError
+		b = []byte(`{"error":"server_error"}`)
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	w.Write(b)
+}
+
+// BasicAuth parses a username and password from the request's
+// Authorization header. This was pulled from golang master:
+// https://codereview.appspot.com/76540043
+func BasicAuth(r *http.Request) (username, password string, ok bool) {
+	auth := r.Header.Get("Authorization")
+	if auth == "" {
+		return
+	}
+
+	if !strings.HasPrefix(auth, "Basic ") {
+		return
+	}
+	c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(auth, "Basic "))
+	if err != nil {
+		return
+	}
+	cs := string(c)
+	s := strings.IndexByte(cs, ':')
+	if s < 0 {
+		return
+	}
+	return cs[:s], cs[s+1:], true
+}
+
+func cacheControlMaxAge(hdr string) (time.Duration, bool, error) {
+	for _, field := range strings.Split(hdr, ",") {
+		parts := strings.SplitN(strings.TrimSpace(field), "=", 2)
+		k := strings.ToLower(strings.TrimSpace(parts[0]))
+		if k != "max-age" {
+			continue
+		}
+
+		if len(parts) == 1 {
+			return 0, false, errors.New("max-age has no value")
+		}
+
+		v := strings.TrimSpace(parts[1])
+		if v == "" {
+			return 0, false, errors.New("max-age has empty value")
+		}
+
+		age, err := strconv.Atoi(v)
+		if err != nil {
+			return 0, false, err
+		}
+
+		if age <= 0 {
+			return 0, false, nil
+		}
+
+		return time.Duration(age) * time.Second, true, nil
+	}
+
+	return 0, false, nil
+}
+
+func expires(date, expires string) (time.Duration, bool, error) {
+	if date == "" || expires == "" {
+		return 0, false, nil
+	}
+
+	var te time.Time
+	var err error
+	if expires == "0" {
+		return 0, false, nil
+	}
+	te, err = time.Parse(time.RFC1123, expires)
+	if err != nil {
+		return 0, false, err
+	}
+
+	td, err := time.Parse(time.RFC1123, date)
+	if err != nil {
+		return 0, false, err
+	}
+
+	ttl := te.Sub(td)
+
+	// headers indicate data already expired, caller should not
+	// have to care about this case
+	if ttl <= 0 {
+		return 0, false, nil
+	}
+
+	return ttl, true, nil
+}
+
+func Cacheable(hdr http.Header) (time.Duration, bool, error) {
+	ttl, ok, err := cacheControlMaxAge(hdr.Get("Cache-Control"))
+	if err != nil || ok {
+		return ttl, ok, err
+	}
+
+	return expires(hdr.Get("Date"), hdr.Get("Expires"))
+}
+
+// MergeQuery appends additional query values to an existing URL.
+func MergeQuery(u url.URL, q url.Values) url.URL {
+	uv := u.Query()
+	for k, vs := range q {
+		for _, v := range vs {
+			uv.Add(k, v)
+		}
+	}
+	u.RawQuery = uv.Encode()
+	return u
+}
+
+// NewResourceLocation appends a resource id to the end of the requested URL path.
+func NewResourceLocation(reqURL *url.URL, id string) string {
+	var u url.URL
+	u = *reqURL
+	u.Path = path.Join(u.Path, id)
+	u.RawQuery = ""
+	u.Fragment = ""
+	return u.String()
+}
+
+// CopyRequest returns a clone of the provided *http.Request.
+// The returned object is a shallow copy of the struct and a
+// deep copy of its Header field.
+func CopyRequest(r *http.Request) *http.Request {
+	r2 := *r
+	r2.Header = make(http.Header)
+	for k, s := range r.Header {
+		r2.Header[k] = s
+	}
+	return &r2
+}
@@ -0,0 +1,29 @@
+package http
+
+import (
+	"errors"
+	"net/url"
+)
+
+// ParseNonEmptyURL checks that a string is a parsable URL which is also not empty
+// since `url.Parse("")` does not return an error. Must contian a scheme and a host.
+func ParseNonEmptyURL(u string) (*url.URL, error) {
+	if u == "" {
+		return nil, errors.New("url is empty")
+	}
+
+	ur, err := url.Parse(u)
+	if err != nil {
+		return nil, err
+	}
+
+	if ur.Scheme == "" {
+		return nil, errors.New("url scheme is empty")
+	}
+
+	if ur.Host == "" {
+		return nil, errors.New("url host is empty")
+	}
+
+	return ur, nil
+}
@@ -0,0 +1,126 @@
+package jose
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"time"
+)
+
+type Claims map[string]interface{}
+
+func (c Claims) Add(name string, value interface{}) {
+	c[name] = value
+}
+
+func (c Claims) StringClaim(name string) (string, bool, error) {
+	cl, ok := c[name]
+	if !ok {
+		return "", false, nil
+	}
+
+	v, ok := cl.(string)
+	if !ok {
+		return "", false, fmt.Errorf("unable to parse claim as string: %v", name)
+	}
+
+	return v, true, nil
+}
+
+func (c Claims) StringsClaim(name string) ([]string, bool, error) {
+	cl, ok := c[name]
+	if !ok {
+		return nil, false, nil
+	}
+
+	if v, ok := cl.([]string); ok {
+		return v, true, nil
+	}
+
+	// When unmarshaled, []string will become []interface{}.
+	if v, ok := cl.([]interface{}); ok {
+		var ret []string
+		for _, vv := range v {
+			str, ok := vv.(string)
+			if !ok {
+				return nil, false, fmt.Errorf("unable to parse claim as string array: %v", name)
+			}
+			ret = append(ret, str)
+		}
+		return ret, true, nil
+	}
+
+	return nil, false, fmt.Errorf("unable to parse claim as string array: %v", name)
+}
+
+func (c Claims) Int64Claim(name string) (int64, bool, error) {
+	cl, ok := c[name]
+	if !ok {
+		return 0, false, nil
+	}
+
+	v, ok := cl.(int64)
+	if !ok {
+		vf, ok := cl.(float64)
+		if !ok {
+			return 0, false, fmt.Errorf("unable to parse claim as int64: %v", name)
+		}
+		v = int64(vf)
+	}
+
+	return v, true, nil
+}
+
+func (c Claims) Float64Claim(name string) (float64, bool, error) {
+	cl, ok := c[name]
+	if !ok {
+		return 0, false, nil
+	}
+
+	v, ok := cl.(float64)
+	if !ok {
+		vi, ok := cl.(int64)
+		if !ok {
+			return 0, false, fmt.Errorf("unable to parse claim as float64: %v", name)
+		}
+		v = float64(vi)
+	}
+
+	return v, true, nil
+}
+
+func (c Claims) TimeClaim(name string) (time.Time, bool, error) {
+	v, ok, err := c.Float64Claim(name)
+	if !ok || err != nil {
+		return time.Time{}, ok, err
+	}
+
+	s := math.Trunc(v)
+	ns := (v - s) * math.Pow(10, 9)
+	return time.Unix(int64(s), int64(ns)).UTC(), true, nil
+}
+
+func decodeClaims(payload []byte) (Claims, error) {
+	var c Claims
+	if err := json.Unmarshal(payload, &c); err != nil {
+		return nil, fmt.Errorf("malformed JWT claims, unable to decode: %v", err)
+	}
+	return c, nil
+}
+
+func marshalClaims(c Claims) ([]byte, error) {
+	b, err := json.Marshal(c)
+	if err != nil {
+		return nil, err
+	}
+	return b, nil
+}
+
+func encodeClaims(c Claims) (string, error) {
+	b, err := marshalClaims(c)
+	if err != nil {
+		return "", err
+	}
+
+	return encodeSegment(b), nil
+}
@@ -0,0 +1,2 @@
+// Package jose is DEPRECATED. Use gopkg.in/square/go-jose.v2 instead.
+package jose
@@ -0,0 +1,112 @@
+package jose
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+const (
+	HeaderMediaType    = "typ"
+	HeaderKeyAlgorithm = "alg"
+	HeaderKeyID        = "kid"
+)
+
+const (
+	// Encryption Algorithm Header Parameter Values for JWS
+	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#page-6
+	AlgHS256 = "HS256"
+	AlgHS384 = "HS384"
+	AlgHS512 = "HS512"
+	AlgRS256 = "RS256"
+	AlgRS384 = "RS384"
+	AlgRS512 = "RS512"
+	AlgES256 = "ES256"
+	AlgES384 = "ES384"
+	AlgES512 = "ES512"
+	AlgPS256 = "PS256"
+	AlgPS384 = "PS384"
+	AlgPS512 = "PS512"
+	AlgNone  = "none"
+)
+
+const (
+	// Algorithm Header Parameter Values for JWE
+	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#section-4.1
+	AlgRSA15            = "RSA1_5"
+	AlgRSAOAEP          = "RSA-OAEP"
+	AlgRSAOAEP256       = "RSA-OAEP-256"
+	AlgA128KW           = "A128KW"
+	AlgA192KW           = "A192KW"
+	AlgA256KW           = "A256KW"
+	AlgDir              = "dir"
+	AlgECDHES           = "ECDH-ES"
+	AlgECDHESA128KW     = "ECDH-ES+A128KW"
+	AlgECDHESA192KW     = "ECDH-ES+A192KW"
+	AlgECDHESA256KW     = "ECDH-ES+A256KW"
+	AlgA128GCMKW        = "A128GCMKW"
+	AlgA192GCMKW        = "A192GCMKW"
+	AlgA256GCMKW        = "A256GCMKW"
+	AlgPBES2HS256A128KW = "PBES2-HS256+A128KW"
+	AlgPBES2HS384A192KW = "PBES2-HS384+A192KW"
+	AlgPBES2HS512A256KW = "PBES2-HS512+A256KW"
+)
+
+const (
+	// Encryption Algorithm Header Parameter Values for JWE
+	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#page-22
+	EncA128CBCHS256 = "A128CBC-HS256"
+	EncA128CBCHS384 = "A128CBC-HS384"
+	EncA256CBCHS512 = "A256CBC-HS512"
+	EncA128GCM      = "A128GCM"
+	EncA192GCM      = "A192GCM"
+	EncA256GCM      = "A256GCM"
+)
+
+type JOSEHeader map[string]string
+
+func (j JOSEHeader) Validate() error {
+	if _, exists := j[HeaderKeyAlgorithm]; !exists {
+		return fmt.Errorf("header missing %q parameter", HeaderKeyAlgorithm)
+	}
+
+	return nil
+}
+
+func decodeHeader(seg string) (JOSEHeader, error) {
+	b, err := decodeSegment(seg)
+	if err != nil {
+		return nil, err
+	}
+
+	var h JOSEHeader
+	err = json.Unmarshal(b, &h)
+	if err != nil {
+		return nil, err
+	}
+
+	return h, nil
+}
+
+func encodeHeader(h JOSEHeader) (string, error) {
+	b, err := json.Marshal(h)
+	if err != nil {
+		return "", err
+	}
+
+	return encodeSegment(b), nil
+}
+
+// Decode JWT specific base64url encoding with padding stripped
+func decodeSegment(seg string) ([]byte, error) {
+	if l := len(seg) % 4; l != 0 {
+		seg += strings.Repeat("=", 4-l)
+	}
+	return base64.URLEncoding.DecodeString(seg)
+}
+
+// Encode JWT specific base64url encoding with padding stripped
+func encodeSegment(seg []byte) string {
+	return strings.TrimRight(base64.URLEncoding.EncodeToString(seg), "=")
+}
@@ -0,0 +1,135 @@
+package jose
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/json"
+	"math/big"
+	"strings"
+)
+
+// JSON Web Key
+// https://tools.ietf.org/html/draft-ietf-jose-json-web-key-36#page-5
+type JWK struct {
+	ID       string
+	Type     string
+	Alg      string
+	Use      string
+	Exponent int
+	Modulus  *big.Int
+	Secret   []byte
+}
+
+type jwkJSON struct {
+	ID       string `json:"kid"`
+	Type     string `json:"kty"`
+	Alg      string `json:"alg"`
+	Use      string `json:"use"`
+	Exponent string `json:"e"`
+	Modulus  string `json:"n"`
+}
+
+func (j *JWK) MarshalJSON() ([]byte, error) {
+	t := jwkJSON{
+		ID:       j.ID,
+		Type:     j.Type,
+		Alg:      j.Alg,
+		Use:      j.Use,
+		Exponent: encodeExponent(j.Exponent),
+		Modulus:  encodeModulus(j.Modulus),
+	}
+
+	return json.Marshal(&t)
+}
+
+func (j *JWK) UnmarshalJSON(data []byte) error {
+	var t jwkJSON
+	err := json.Unmarshal(data, &t)
+	if err != nil {
+		return err
+	}
+
+	e, err := decodeExponent(t.Exponent)
+	if err != nil {
+		return err
+	}
+
+	n, err := decodeModulus(t.Modulus)
+	if err != nil {
+		return err
+	}
+
+	j.ID = t.ID
+	j.Type = t.Type
+	j.Alg = t.Alg
+	j.Use = t.Use
+	j.Exponent = e
+	j.Modulus = n
+
+	return nil
+}
+
+type JWKSet struct {
+	Keys []JWK `json:"keys"`
+}
+
+func decodeExponent(e string) (int, error) {
+	decE, err := decodeBase64URLPaddingOptional(e)
+	if err != nil {
+		return 0, err
+	}
+	var eBytes []byte
+	if len(decE) < 8 {
+		eBytes = make([]byte, 8-len(decE), 8)
+		eBytes = append(eBytes, decE...)
+	} else {
+		eBytes = decE
+	}
+	eReader := bytes.NewReader(eBytes)
+	var E uint64
+	err = binary.Read(eReader, binary.BigEndian, &E)
+	if err != nil {
+		return 0, err
+	}
+	return int(E), nil
+}
+
+func encodeExponent(e int) string {
+	b := make([]byte, 8)
+	binary.BigEndian.PutUint64(b, uint64(e))
+	var idx int
+	for ; idx < 8; idx++ {
+		if b[idx] != 0x0 {
+			break
+		}
+	}
+	return base64.RawURLEncoding.EncodeToString(b[idx:])
+}
+
+// Turns a URL encoded modulus of a key into a big int.
+func decodeModulus(n string) (*big.Int, error) {
+	decN, err := decodeBase64URLPaddingOptional(n)
+	if err != nil {
+		return nil, err
+	}
+	N := big.NewInt(0)
+	N.SetBytes(decN)
+	return N, nil
+}
+
+func encodeModulus(n *big.Int) string {
+	return base64.RawURLEncoding.EncodeToString(n.Bytes())
+}
+
+// decodeBase64URLPaddingOptional decodes Base64 whether there is padding or not.
+// The stdlib version currently doesn't handle this.
+// We can get rid of this is if this bug:
+//   https://github.com/golang/go/issues/4237
+// ever closes.
+func decodeBase64URLPaddingOptional(e string) ([]byte, error) {
+	if m := len(e) % 4; m != 0 {
+		e += strings.Repeat("=", 4-m)
+	}
+	return base64.URLEncoding.DecodeString(e)
+}
@@ -0,0 +1,51 @@
+package jose
+
+import (
+	"fmt"
+	"strings"
+)
+
+type JWS struct {
+	RawHeader  string
+	Header     JOSEHeader
+	RawPayload string
+	Payload    []byte
+	Signature  []byte
+}
+
+// Given a raw encoded JWS token parses it and verifies the structure.
+func ParseJWS(raw string) (JWS, error) {
+	parts := strings.Split(raw, ".")
+	if len(parts) != 3 {
+		return JWS{}, fmt.Errorf("malformed JWS, only %d segments", len(parts))
+	}
+
+	rawSig := parts[2]
+	jws := JWS{
+		RawHeader:  parts[0],
+		RawPayload: parts[1],
+	}
+
+	header, err := decodeHeader(jws.RawHeader)
+	if err != nil {
+		return JWS{}, fmt.Errorf("malformed JWS, unable to decode header, %s", err)
+	}
+	if err = header.Validate(); err != nil {
+		return JWS{}, fmt.Errorf("malformed JWS, %s", err)
+	}
+	jws.Header = header
+
+	payload, err := decodeSegment(jws.RawPayload)
+	if err != nil {
+		return JWS{}, fmt.Errorf("malformed JWS, unable to decode payload: %s", err)
+	}
+	jws.Payload = payload
+
+	sig, err := decodeSegment(rawSig)
+	if err != nil {
+		return JWS{}, fmt.Errorf("malformed JWS, unable to decode signature: %s", err)
+	}
+	jws.Signature = sig
+
+	return jws, nil
+}
@@ -0,0 +1,82 @@
+package jose
+
+import "strings"
+
+type JWT JWS
+
+func ParseJWT(token string) (jwt JWT, err error) {
+	jws, err := ParseJWS(token)
+	if err != nil {
+		return
+	}
+
+	return JWT(jws), nil
+}
+
+func NewJWT(header JOSEHeader, claims Claims) (jwt JWT, err error) {
+	jwt = JWT{}
+
+	jwt.Header = header
+	jwt.Header[HeaderMediaType] = "JWT"
+
+	claimBytes, err := marshalClaims(claims)
+	if err != nil {
+		return
+	}
+	jwt.Payload = claimBytes
+
+	eh, err := encodeHeader(header)
+	if err != nil {
+		return
+	}
+	jwt.RawHeader = eh
+
+	ec, err := encodeClaims(claims)
+	if err != nil {
+		return
+	}
+	jwt.RawPayload = ec
+
+	return
+}
+
+func (j *JWT) KeyID() (string, bool) {
+	kID, ok := j.Header[HeaderKeyID]
+	return kID, ok
+}
+
+func (j *JWT) Claims() (Claims, error) {
+	return decodeClaims(j.Payload)
+}
+
+// Encoded data part of the token which may be signed.
+func (j *JWT) Data() string {
+	return strings.Join([]string{j.RawHeader, j.RawPayload}, ".")
+}
+
+// Full encoded JWT token string in format: header.claims.signature
+func (j *JWT) Encode() string {
+	d := j.Data()
+	s := encodeSegment(j.Signature)
+	return strings.Join([]string{d, s}, ".")
+}
+
+func NewSignedJWT(claims Claims, s Signer) (*JWT, error) {
+	header := JOSEHeader{
+		HeaderKeyAlgorithm: s.Alg(),
+		HeaderKeyID:        s.ID(),
+	}
+
+	jwt, err := NewJWT(header, claims)
+	if err != nil {
+		return nil, err
+	}
+
+	sig, err := s.Sign([]byte(jwt.Data()))
+	if err != nil {
+		return nil, err
+	}
+	jwt.Signature = sig
+
+	return &jwt, nil
+}
@@ -0,0 +1,24 @@
+package jose
+
+import (
+	"fmt"
+)
+
+type Verifier interface {
+	ID() string
+	Alg() string
+	Verify(sig []byte, data []byte) error
+}
+
+type Signer interface {
+	Verifier
+	Sign(data []byte) (sig []byte, err error)
+}
+
+func NewVerifier(jwk JWK) (Verifier, error) {
+	if jwk.Type != "RSA" {
+		return nil, fmt.Errorf("unsupported key type %q", jwk.Type)
+	}
+
+	return NewVerifierRSA(jwk)
+}
@@ -0,0 +1,67 @@
+package jose
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"fmt"
+)
+
+type VerifierRSA struct {
+	KeyID     string
+	Hash      crypto.Hash
+	PublicKey rsa.PublicKey
+}
+
+type SignerRSA struct {
+	PrivateKey rsa.PrivateKey
+	VerifierRSA
+}
+
+func NewVerifierRSA(jwk JWK) (*VerifierRSA, error) {
+	if jwk.Alg != "" && jwk.Alg != "RS256" {
+		return nil, fmt.Errorf("unsupported key algorithm %q", jwk.Alg)
+	}
+
+	v := VerifierRSA{
+		KeyID: jwk.ID,
+		PublicKey: rsa.PublicKey{
+			N: jwk.Modulus,
+			E: jwk.Exponent,
+		},
+		Hash: crypto.SHA256,
+	}
+
+	return &v, nil
+}
+
+func NewSignerRSA(kid string, key rsa.PrivateKey) *SignerRSA {
+	return &SignerRSA{
+		PrivateKey: key,
+		VerifierRSA: VerifierRSA{
+			KeyID:     kid,
+			PublicKey: key.PublicKey,
+			Hash:      crypto.SHA256,
+		},
+	}
+}
+
+func (v *VerifierRSA) ID() string {
+	return v.KeyID
+}
+
+func (v *VerifierRSA) Alg() string {
+	return "RS256"
+}
+
+func (v *VerifierRSA) Verify(sig []byte, data []byte) error {
+	h := v.Hash.New()
+	h.Write(data)
+	return rsa.VerifyPKCS1v15(&v.PublicKey, v.Hash, h.Sum(nil), sig)
+}
+
+func (s *SignerRSA) Sign(data []byte) ([]byte, error) {
+	h := s.Hash.New()
+	h.Write(data)
+	return rsa.SignPKCS1v15(rand.Reader, &s.PrivateKey, s.Hash, h.Sum(nil))
+}
@@ -0,0 +1,2 @@
+// Package key is DEPRECATED. Use github.com/coreos/go-oidc instead.
+package key
@@ -0,0 +1,153 @@
+package key
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"time"
+
+	"github.com/coreos/go-oidc/jose"
+)
+
+func NewPublicKey(jwk jose.JWK) *PublicKey {
+	return &PublicKey{jwk: jwk}
+}
+
+type PublicKey struct {
+	jwk jose.JWK
+}
+
+func (k *PublicKey) MarshalJSON() ([]byte, error) {
+	return json.Marshal(&k.jwk)
+}
+
+func (k *PublicKey) UnmarshalJSON(data []byte) error {
+	var jwk jose.JWK
+	if err := json.Unmarshal(data, &jwk); err != nil {
+		return err
+	}
+	k.jwk = jwk
+	return nil
+}
+
+func (k *PublicKey) ID() string {
+	return k.jwk.ID
+}
+
+func (k *PublicKey) Verifier() (jose.Verifier, error) {
+	return jose.NewVerifierRSA(k.jwk)
+}
+
+type PrivateKey struct {
+	KeyID      string
+	PrivateKey *rsa.PrivateKey
+}
+
+func (k *PrivateKey) ID() string {
+	return k.KeyID
+}
+
+func (k *PrivateKey) Signer() jose.Signer {
+	return jose.NewSignerRSA(k.ID(), *k.PrivateKey)
+}
+
+func (k *PrivateKey) JWK() jose.JWK {
+	return jose.JWK{
+		ID:       k.KeyID,
+		Type:     "RSA",
+		Alg:      "RS256",
+		Use:      "sig",
+		Exponent: k.PrivateKey.PublicKey.E,
+		Modulus:  k.PrivateKey.PublicKey.N,
+	}
+}
+
+type KeySet interface {
+	ExpiresAt() time.Time
+}
+
+type PublicKeySet struct {
+	keys      []PublicKey
+	index     map[string]*PublicKey
+	expiresAt time.Time
+}
+
+func NewPublicKeySet(jwks []jose.JWK, exp time.Time) *PublicKeySet {
+	keys := make([]PublicKey, len(jwks))
+	index := make(map[string]*PublicKey)
+	for i, jwk := range jwks {
+		keys[i] = *NewPublicKey(jwk)
+		index[keys[i].ID()] = &keys[i]
+	}
+	return &PublicKeySet{
+		keys:      keys,
+		index:     index,
+		expiresAt: exp,
+	}
+}
+
+func (s *PublicKeySet) ExpiresAt() time.Time {
+	return s.expiresAt
+}
+
+func (s *PublicKeySet) Keys() []PublicKey {
+	return s.keys
+}
+
+func (s *PublicKeySet) Key(id string) *PublicKey {
+	return s.index[id]
+}
+
+type PrivateKeySet struct {
+	keys        []*PrivateKey
+	ActiveKeyID string
+	expiresAt   time.Time
+}
+
+func NewPrivateKeySet(keys []*PrivateKey, exp time.Time) *PrivateKeySet {
+	return &PrivateKeySet{
+		keys:        keys,
+		ActiveKeyID: keys[0].ID(),
+		expiresAt:   exp.UTC(),
+	}
+}
+
+func (s *PrivateKeySet) Keys() []*PrivateKey {
+	return s.keys
+}
+
+func (s *PrivateKeySet) ExpiresAt() time.Time {
+	return s.expiresAt
+}
+
+func (s *PrivateKeySet) Active() *PrivateKey {
+	for i, k := range s.keys {
+		if k.ID() == s.ActiveKeyID {
+			return s.keys[i]
+		}
+	}
+
+	return nil
+}
+
+type GeneratePrivateKeyFunc func() (*PrivateKey, error)
+
+func GeneratePrivateKey() (*PrivateKey, error) {
+	pk, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, err
+	}
+	keyID := make([]byte, 20)
+	if _, err := io.ReadFull(rand.Reader, keyID); err != nil {
+		return nil, err
+	}
+
+	k := PrivateKey{
+		KeyID:      hex.EncodeToString(keyID),
+		PrivateKey: pk,
+	}
+
+	return &k, nil
+}
@@ -0,0 +1,99 @@
+package key
+
+import (
+	"errors"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/coreos/go-oidc/jose"
+	"github.com/coreos/pkg/health"
+)
+
+type PrivateKeyManager interface {
+	ExpiresAt() time.Time
+	Signer() (jose.Signer, error)
+	JWKs() ([]jose.JWK, error)
+	PublicKeys() ([]PublicKey, error)
+
+	WritableKeySetRepo
+	health.Checkable
+}
+
+func NewPrivateKeyManager() PrivateKeyManager {
+	return &privateKeyManager{
+		clock: clockwork.NewRealClock(),
+	}
+}
+
+type privateKeyManager struct {
+	keySet *PrivateKeySet
+	clock  clockwork.Clock
+}
+
+func (m *privateKeyManager) ExpiresAt() time.Time {
+	if m.keySet == nil {
+		return m.clock.Now().UTC()
+	}
+
+	return m.keySet.ExpiresAt()
+}
+
+func (m *privateKeyManager) Signer() (jose.Signer, error) {
+	if err := m.Healthy(); err != nil {
+		return nil, err
+	}
+
+	return m.keySet.Active().Signer(), nil
+}
+
+func (m *privateKeyManager) JWKs() ([]jose.JWK, error) {
+	if err := m.Healthy(); err != nil {
+		return nil, err
+	}
+
+	keys := m.keySet.Keys()
+	jwks := make([]jose.JWK, len(keys))
+	for i, k := range keys {
+		jwks[i] = k.JWK()
+	}
+	return jwks, nil
+}
+
+func (m *privateKeyManager) PublicKeys() ([]PublicKey, error) {
+	jwks, err := m.JWKs()
+	if err != nil {
+		return nil, err
+	}
+	keys := make([]PublicKey, len(jwks))
+	for i, jwk := range jwks {
+		keys[i] = *NewPublicKey(jwk)
+	}
+	return keys, nil
+}
+
+func (m *privateKeyManager) Healthy() error {
+	if m.keySet == nil {
+		return errors.New("private key manager uninitialized")
+	}
+
+	if len(m.keySet.Keys()) == 0 {
+		return errors.New("private key manager zero keys")
+	}
+
+	if m.keySet.ExpiresAt().Before(m.clock.Now().UTC()) {
+		return errors.New("private key manager keys expired")
+	}
+
+	return nil
+}
+
+func (m *privateKeyManager) Set(keySet KeySet) error {
+	privKeySet, ok := keySet.(*PrivateKeySet)
+	if !ok {
+		return errors.New("unable to cast to PrivateKeySet")
+	}
+
+	m.keySet = privKeySet
+	return nil
+}
@@ -0,0 +1,55 @@
+package key
+
+import (
+	"errors"
+	"sync"
+)
+
+var ErrorNoKeys = errors.New("no keys found")
+
+type WritableKeySetRepo interface {
+	Set(KeySet) error
+}
+
+type ReadableKeySetRepo interface {
+	Get() (KeySet, error)
+}
+
+type PrivateKeySetRepo interface {
+	WritableKeySetRepo
+	ReadableKeySetRepo
+}
+
+func NewPrivateKeySetRepo() PrivateKeySetRepo {
+	return &memPrivateKeySetRepo{}
+}
+
+type memPrivateKeySetRepo struct {
+	mu  sync.RWMutex
+	pks PrivateKeySet
+}
+
+func (r *memPrivateKeySetRepo) Set(ks KeySet) error {
+	pks, ok := ks.(*PrivateKeySet)
+	if !ok {
+		return errors.New("unable to cast to PrivateKeySet")
+	} else if pks == nil {
+		return errors.New("nil KeySet")
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.pks = *pks
+	return nil
+}
+
+func (r *memPrivateKeySetRepo) Get() (KeySet, error) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	if r.pks.keys == nil {
+		return nil, ErrorNoKeys
+	}
+	return KeySet(&r.pks), nil
+}
@@ -0,0 +1,159 @@
+package key
+
+import (
+	"errors"
+	"log"
+	"time"
+
+	ptime "github.com/coreos/pkg/timeutil"
+	"github.com/jonboulle/clockwork"
+)
+
+var (
+	ErrorPrivateKeysExpired = errors.New("private keys have expired")
+)
+
+func NewPrivateKeyRotator(repo PrivateKeySetRepo, ttl time.Duration) *PrivateKeyRotator {
+	return &PrivateKeyRotator{
+		repo: repo,
+		ttl:  ttl,
+
+		keep:        2,
+		generateKey: GeneratePrivateKey,
+		clock:       clockwork.NewRealClock(),
+	}
+}
+
+type PrivateKeyRotator struct {
+	repo        PrivateKeySetRepo
+	generateKey GeneratePrivateKeyFunc
+	clock       clockwork.Clock
+	keep        int
+	ttl         time.Duration
+}
+
+func (r *PrivateKeyRotator) expiresAt() time.Time {
+	return r.clock.Now().UTC().Add(r.ttl)
+}
+
+func (r *PrivateKeyRotator) Healthy() error {
+	pks, err := r.privateKeySet()
+	if err != nil {
+		return err
+	}
+
+	if r.clock.Now().After(pks.ExpiresAt()) {
+		return ErrorPrivateKeysExpired
+	}
+
+	return nil
+}
+
+func (r *PrivateKeyRotator) privateKeySet() (*PrivateKeySet, error) {
+	ks, err := r.repo.Get()
+	if err != nil {
+		return nil, err
+	}
+
+	pks, ok := ks.(*PrivateKeySet)
+	if !ok {
+		return nil, errors.New("unable to cast to PrivateKeySet")
+	}
+	return pks, nil
+}
+
+func (r *PrivateKeyRotator) nextRotation() (time.Duration, error) {
+	pks, err := r.privateKeySet()
+	if err == ErrorNoKeys {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, err
+	}
+
+	now := r.clock.Now()
+
+	// Ideally, we want to rotate after half the TTL has elapsed.
+	idealRotationTime := pks.ExpiresAt().Add(-r.ttl / 2)
+
+	// If we are past the ideal rotation time, rotate immediatly.
+	return max(0, idealRotationTime.Sub(now)), nil
+}
+
+func max(a, b time.Duration) time.Duration {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+func (r *PrivateKeyRotator) Run() chan struct{} {
+	attempt := func() {
+		k, err := r.generateKey()
+		if err != nil {
+			log.Printf("go-oidc: failed generating signing key: %v", err)
+			return
+		}
+
+		exp := r.expiresAt()
+		if err := rotatePrivateKeys(r.repo, k, r.keep, exp); err != nil {
+			log.Printf("go-oidc: key rotation failed: %v", err)
+			return
+		}
+	}
+
+	stop := make(chan struct{})
+	go func() {
+		for {
+			var nextRotation time.Duration
+			var sleep time.Duration
+			var err error
+			for {
+				if nextRotation, err = r.nextRotation(); err == nil {
+					break
+				}
+				sleep = ptime.ExpBackoff(sleep, time.Minute)
+				log.Printf("go-oidc: error getting nextRotation, retrying in %v: %v", sleep, err)
+				time.Sleep(sleep)
+			}
+
+			select {
+			case <-r.clock.After(nextRotation):
+				attempt()
+			case <-stop:
+				return
+			}
+		}
+	}()
+
+	return stop
+}
+
+func rotatePrivateKeys(repo PrivateKeySetRepo, k *PrivateKey, keep int, exp time.Time) error {
+	ks, err := repo.Get()
+	if err != nil && err != ErrorNoKeys {
+		return err
+	}
+
+	var keys []*PrivateKey
+	if ks != nil {
+		pks, ok := ks.(*PrivateKeySet)
+		if !ok {
+			return errors.New("unable to cast to PrivateKeySet")
+		}
+		keys = pks.Keys()
+	}
+
+	keys = append([]*PrivateKey{k}, keys...)
+	if l := len(keys); l > keep {
+		keys = keys[0:keep]
+	}
+
+	nks := PrivateKeySet{
+		keys:        keys,
+		ActiveKeyID: k.ID(),
+		expiresAt:   exp,
+	}
+
+	return repo.Set(KeySet(&nks))
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Austin Cherry	99713e3439	Release 2019.2.0	2019-02-11 14:06:56 -06:00
Austin Cherry	27c6977746	AUTH-1403: Print the paths in the ssh-config instructions	2019-02-11 10:56:06 -06:00
Austin Cherry	200f9a3786	AUTH-1503: Added RDP support	2019-02-08 14:28:47 -06:00
Austin Cherry	92defa26d4	AUTH-1511: Add custom headers for ssh command	2019-02-07 16:38:52 -06:00
Areg Harutyunyan	c9f1c1ec70	Merge branch 'master' of github.com:cloudflare/cloudflared	2019-02-01 14:57:53 -06:00
Philippe Grégoire	10e4a2940c	cloudflared/linux_service: Add missing /etc/init.d shebang When using sysv init scripts, `cloudflared` fails to start due to the missing shebang interpreter line. This patch adds the missing shebang.	2019-02-01 14:55:30 -06:00
Adam Chalmers	77f12c7c34	TUN-1456: Only make one UUID	2019-02-01 14:11:12 -06:00
Austin Cherry	ca33ed9f6a	AUTH-1462: better curl arg parsing	2019-02-01 10:46:36 -06:00
Adam Chalmers	6a331b13ba	Release 2019.1.0	2019-01-28 17:03:33 -06:00
Chung-Ting Huang	47c878b9c4	TUN-1419: Identify request/response headers/content length with ray ID	2019-01-28 16:52:17 -06:00
Chung-Ting Huang	61cd4a918d	TUN-1418: Rename ProtocolLogger to TransportLogger, and use TransportLogger to log RPC events.	2019-01-28 16:09:58 -06:00
Austin Cherry	9db4b7fdfb	AUTH-1337: fix url path	2019-01-25 13:47:12 -06:00
Austin Cherry	2f59b8ac22	AUTH-1211: print all the versions	2019-01-25 13:44:26 -06:00
Austin Cherry	f94699e07b	AUTH-1459: improved ssh streaming error message	2019-01-25 10:45:50 -06:00
Austin Cherry	f7cf597f54	AUTH-1404: reauth if the token is about to expire within 15 minutes	2019-01-25 10:43:07 -06:00
Austin Cherry	aeb8dd7e51	AUTH-1423: move from stdout to stderr	2019-01-24 14:48:37 -06:00
Nick Vollmar	5bf6dd8f85	TUN-1358: Close readyList after Muxer.Serve() has stopped running	2019-01-22 15:54:29 -06:00
Nick Vollmar	62b1ab8c98	TUN-1350: Enhance error messages with cloudflarestatus.com link, if relevant	2019-01-18 13:37:05 -06:00
Areg Harutyunyan	8de19dc647	TUN-1265: Silent exit when failing to parse config	2019-01-08 15:51:43 -06:00
Areg Harutyunyan	8a099d8f6e	TUN-1138: Install cloudflared service directory with 755 permissions	2019-01-07 13:46:21 -06:00
Leland Garofalo	ef400afe00	TUN-632 Filter out common network exceptions from going to Sentry on StartServer	2019-01-07 13:36:52 -06:00
Nick Vollmar	bf596c035e	TUN-1140: Show usage if invoked with no args or config	2018-12-17 15:05:03 -06:00
Areg Harutyunyan	36276e957a	TUN-1231: Horizontal overflow wrapping on the Hello page	2018-12-11 16:03:44 -06:00
Chung-Ting Huang	c69437ba83	Release 2018.12.1	2018-12-11 14:20:51 -06:00
Adam Chalmers	b2d0c612a5	TUN-1270: cloudflared panic (HA metrics missing label)	2018-12-11 11:41:49 -06:00
Areg Harutyunyan	8e2908f889	Release 2018.12.0	2018-12-10 13:50:13 -06:00
Nick Vollmar	3e8d886c25	TUN-1250: ValidateHTTPService shouldn't follow 302s	2018-12-07 16:59:15 -06:00
Areg Harutyunyan	446c5cf60c	Merge branch 'master' of github.com:cloudflare/cloudflared	2018-12-07 11:36:41 -06:00
Mohammed Naser	13f88b3739	Fix license URL typo	2018-12-07 11:33:55 -06:00
Nick Vollmar	69ee6c1d88	TUN-1204: remove 'cloudflared hello' command	2018-12-03 16:31:20 -06:00
Adam Chalmers	192ae35728	TUN-1212: Expose tunnel_id in metrics	2018-11-27 15:26:45 -06:00
Chung-Ting Huang	10d547f528	TUN-1209: TLS Config Certificates and GetCertificate can both be set	2018-11-20 14:34:56 -06:00
Chung-Ting Huang	b59fd4b7d8	TUN-1196: Allow TLS config client CA and root CA to be constructed from multiple certificates	2018-11-19 15:38:10 -06:00
Chung-Ting Huang	c85c8526e8	Release 2018.11.0	2018-11-16 09:53:13 -06:00
Austin Cherry	f49d9dcb67	AUTH-1320: Fixed request issue and unhide the ssh command	2018-11-15 13:08:56 -06:00
Nick Vollmar	c2ac282aca	TUN-1190: check URL parse error when starting SSH proxy server	2018-11-14 12:16:12 -06:00
Austin Cherry	58daf6bfed	AUTH-1308: get jwt even when you are already logged in	2018-11-13 17:06:17 -06:00
Nick Vollmar	611b284e20	TUN-1179: Fix log message in cmd/cloudflared/transfer.Run	2018-11-06 09:23:03 -08:00
Austin Cherry	236a0a164d	AUTH-1282: Fixed an issue where we were receiving as opposed sending on the channel.	2018-10-31 13:48:19 -05:00
Nick Vollmar	148eea5899	Release 2018.10.5	2018-10-30 14:15:58 -05:00
Nick Vollmar	83c6c8713b	TUN-1160: pass Host header during origin url validation	2018-10-30 13:58:07 -05:00
Areg Harutyunyan	2b820d790c	Merge remote-tracking branch 'upstream/master'	2018-10-30 12:06:25 -05:00
dstockton	36286301f7	#30 : Fix the Content-Length header for HTTP2->HTTP1	2018-10-30 11:52:11 -05:00
Nick Vollmar	9a48fe959d	TUN-1158: Windows: use process arguments rather than trivial service arguments TUN-1158: Fix segfault when carrier test case fails	2018-10-29 14:14:53 -05:00
Nick Vollmar	f6014cb2b4	TUN-968: Flow control for large requests/responses	2018-10-26 11:16:02 -05:00
Nick Vollmar	9fe21fa906	Release 2018.10.4	2018-10-25 15:56:25 -05:00
Austin Cherry	80a75e91d2	AUTH-1188: UX Review and Changes for CLI SSH Access	2018-10-25 15:50:27 -05:00
Austin Cherry	6acc95f756	TUN-1097: Host missing from WebSocket request	2018-10-19 16:51:54 -05:00
Austin Cherry	72412db4c2	AUTH-1235: fixed packaging of deb dev file	2018-10-19 14:01:08 -05:00
Austin Cherry	fa92441415	AUTH-1070: added SSH/protocol forwarding	2018-10-11 11:34:37 -05:00
Chung-Ting Huang	41916365b6	Release 2018.10.3	2018-10-10 15:19:36 -05:00
Adam Chalmers	41429cc6a8	TUN-1101: False negatives in Cloudflared error reporting	2018-10-10 14:59:33 -05:00
Austin Cherry	da0defcec9	TUN-1098: removed deprecation error	2018-10-08 16:38:33 -05:00
Areg Harutyunyan	ca9902a8d1	TUN-1099: Bring back changes in 2018.10.1	2018-10-08 14:20:28 -05:00
Areg Harutyunyan	995e773096	Release 2018.10.2	2018-10-06 14:36:41 -05:00
Areg Harutyunyan	faeba02e57	TUN-1093: Revert cloudflared to 2018.8.0	2018-10-06 14:30:51 -05:00
Areg Harutyunyan	2fc2f3c927	Release 2018.10.1	2018-10-05 15:27:07 -05:00
Austin Cherry	5cd4fab9dd	TUN-1086: fixed config option	2018-10-05 14:58:21 -05:00
Austin Cherry	71b113cad3	TUN-1083: fixed incorrect help menu	2018-10-05 14:29:57 -05:00
Adam Chalmers	af2f2910b6	TUN-1081: cloudflared now generates UUIDs	2018-10-05 14:19:59 -05:00
Nick Vollmar	f7b1f7cb22	TUN-1012: Normalize config filename for Linux services	2018-10-05 11:58:59 -05:00
Areg Harutyunyan	2f5ac3b556	Release 2018.10.0	2018-10-04 16:15:34 -05:00
Austin Cherry	920fa9d23e	AUTH-1199: unhide access command, added beta label	2018-10-04 15:18:02 -05:00
Chung-Ting Huang	06471132ef	TUN-1076: Pin capnproto2 to version 2.17.1	2018-10-03 15:38:41 -05:00
Adam Chalmers	65d232efda	TUN-1064: Revert OriginCert capnp changes in Cloudflared. Reverts commits a1ee2342e97 and 8c756c45785.	2018-10-02 11:59:37 -05:00
Adam Chalmers	0b78db185b	TUN-1062: Makefile target for regenerating Capn Proto definitions	2018-10-01 17:05:15 -05:00
Adam Chalmers	fc2c7c9718	TUN-1052: Changing type of OriginCert to :Data	2018-09-28 16:07:57 -05:00
Adam Chalmers	3079f27205	TUN-1052: Origintunneld can send back an Origincert to Cloudflared	2018-09-28 16:07:57 -05:00
Adam Chalmers	4c464e1adf	TUN-1056: Lint error broke build	2018-09-28 16:07:57 -05:00
Chung-Ting Huang	1a5e82bc04	TUN-1046: Document that delta compression is a beta feature	2018-09-28 16:07:57 -05:00
Austin Cherry	8364e409a4	AUTH-1165: hide access command	2018-09-28 16:07:57 -05:00
Austin Cherry	170f0acf4f	AUTH-1136: addressing beta feedback	2018-09-28 16:07:57 -05:00
Adam Chalmers	674eb33edc	TUN-1035: New text for cloudflared tunnel --help	2018-09-28 16:07:57 -05:00
Austin Cherry	c10852a5e3	AUTH-1139: refactored cloudflared help menu	2018-09-28 16:07:57 -05:00
Areg Harutyunyan	653f000294	TUN-1028: Unhide cloudflared compression flag	2018-09-28 16:07:57 -05:00
Areg Harutyunyan	dd2b5e4f3e	TUN-868: HTTP/HTTPS mismatch should have a better error message	2018-09-28 16:06:41 -05:00
Adam Chalmers	0e6492342b	TUN-881: Display trial zone URL upon successful registration	2018-09-28 16:06:41 -05:00
Adam Chalmers	f0126d1af2	TUN-985: Don't display tunnel ID if it's empty string	2018-09-28 16:06:41 -05:00
Adam Chalmers	e2194f9417	TUN-810: Cloudflared should open dash/argotunnel not dash/warp	2018-09-28 16:06:20 -05:00
Adam Chalmers	d0bc4d0d96	TUN-890: To support free tunnels, hostname can now be ""	2018-09-28 16:05:54 -05:00
Austin Cherry	4f04f35bd1	AUTH-910, AUTH-1049, AUTH-1068, AUTH-1056: Generate and store Access tokens with E2EE option, curl/cmd wrapper	2018-09-28 16:05:15 -05:00