Release 2018.10.4

AUTH-1188: UX feedback, move warnings to debug
AUTH-1188: add failure page for non-upgrade request (more styling to come) AUTH-1188: hide ssh command for now AUTH-1188: fixes for login page AUTH-1229: printing ssh config instructions AUTH-1249 and AUTH-1250 AUTH-1255, AUTH-1256, AUTH-1257, AUTH-1258 hide commands for release
2026-08-07 23:31:56 +00:00 · 2018-10-25 15:00:34 -05:00 · 2018-10-25 14:51:47 -05:00 · 2018-10-25 13:24:15 -05:00
64 changed files with 789 additions and 3112 deletions
@@ -7,4 +7,3 @@ guide/public
 .idea
 .vscode
 \#*\#
-cscope.*
@@ -2,48 +2,31 @@


 [[projects]]
-  digest = "1:b16fbfbcc20645cb419f78325bb2e85ec729b338e996a228124d68931a6f2a37"
  name = "github.com/BurntSushi/toml"
  packages = ["."]
-  pruneopts = "UT"
  revision = "b26d9c308763d68093482582cea63d69be07a0f0"
  version = "v0.3.0"

 [[projects]]
  branch = "master"
-  digest = "1:d6afaeed1502aa28e80a4ed0981d570ad91b2579193404256ce672ed0a609e0d"
  name = "github.com/beorn7/perks"
  packages = ["quantile"]
-  pruneopts = "UT"
  revision = "3a771d992973f24aa725d07868b467d1ddfceafb"

 [[projects]]
-  digest = "1:fed1f537c2f1269fe475a8556c393fe466641682d73ef8fd0491cd3aa1e47bad"
  name = "github.com/certifi/gocertifi"
  packages = ["."]
-  pruneopts = "UT"
  revision = "deb3ae2ef2610fde3330947281941c562861188b"
  version = "2018.01.18"

 [[projects]]
  branch = "master"
-  digest = "1:e5003c19d396d8b3cf1324ea0bf49b00f13e9466d0297d1268b641f1c617c3a2"
  name = "github.com/cloudflare/brotli-go"
  packages = ["."]
-  pruneopts = "T"
  revision = "18c9f6c67e3dfc12e0ddaca748d2887f97a7ac28"

 [[projects]]
  branch = "master"
-  digest = "1:6dbb2bbc7e6333e691c4d82fd86485f0695a35902fbb9b2df5f72e22ab0040f3"
-  name = "github.com/cloudflare/golibs"
-  packages = ["lrucache"]
-  pruneopts = "UT"
-  revision = "333127dbecfcc23a8db7d9a4f52785d23aff44a1"
-
-[[projects]]
-  branch = "master"
-  digest = "1:af68c8bdac3ceaf46c67f0c43cc1ee5f10e705d8e04f8a63fa41231d0be6b0fb"
  name = "github.com/coredns/coredns"
  packages = [
    "core/dnsserver",
@@ -69,64 +52,52 @@
    "plugin/pkg/uniq",
    "plugin/pkg/watch",
    "plugin/test",
-    "request",
+    "request"
  ]
-  pruneopts = "UT"
  revision = "992e7928c7c258628d2b13b769acc86781b9faea"

 [[projects]]
  branch = "master"
-  digest = "1:6a503e232df389d94ebb97dfb22d4ae463b6e2f351660613e11d9e42f57ab6df"
  name = "github.com/coreos/go-oidc"
  packages = [
    "http",
    "jose",
    "key",
    "oauth2",
-    "oidc",
+    "oidc"
  ]
-  pruneopts = "UT"
  revision = "a93f71fdfe73d2c0f5413c0565eea0af6523a6df"

 [[projects]]
-  digest = "1:1da3a221f0bc090792d3a2a080ff09008427c0e0f0533a4ed6abd8994421da73"
  name = "github.com/coreos/go-systemd"
  packages = ["daemon"]
-  pruneopts = "UT"
  revision = "39ca1b05acc7ad1220e09f133283b8859a8b71ab"
  version = "v17"

 [[projects]]
-  digest = "1:6fda0d7f5e52b081e075775b1ecebf1ea0c923e7be33604ed0225ae078e701b5"
  name = "github.com/coreos/pkg"
  packages = [
    "health",
    "httputil",
-    "timeutil",
+    "timeutil"
  ]
-  pruneopts = "UT"
  revision = "97fdf19511ea361ae1c100dd393cc47f8dcfa1e1"
  version = "v4"

 [[projects]]
-  digest = "1:a2c1d0e43bd3baaa071d1b9ed72c27d78169b2b269f71c105ac4ba34b1be4a39"
  name = "github.com/davecgh/go-spew"
  packages = ["spew"]
-  pruneopts = "UT"
  revision = "346938d642f2ec3594ed81d874461961cd0faa76"
  version = "v1.1.0"

 [[projects]]
  branch = "master"
-  digest = "1:c013ffc6e15f9f898078f9d38441c68b228aa7b899659452170250ccb27f5f1e"
  name = "github.com/elgs/gosqljson"
  packages = ["."]
-  pruneopts = "UT"
  revision = "027aa4915315a0b2825c0f025cea347829b974fa"

 [[projects]]
  branch = "master"
-  digest = "1:15eadee5930d325154e5e1f3c4f4b28ab62f9c0aa949580e8d9edabaf0b64e85"
  name = "github.com/equinox-io/equinox"
  packages = [
    ".",
@@ -134,267 +105,209 @@
    "internal/go-update/internal/binarydist",
    "internal/go-update/internal/osext",
    "internal/osext",
-    "proto",
+    "proto"
  ]
-  pruneopts = "UT"
  revision = "f24972fa72facf59d05c91c848b65eac38815915"

 [[projects]]
  branch = "master"
-  digest = "1:433763f10d88dba9b533a7ea2fe9f5ee11e57e00306eb97a1f6090fd978e8fa1"
  name = "github.com/facebookgo/grace"
  packages = ["gracenet"]
-  pruneopts = "UT"
  revision = "75cf19382434e82df4dd84953f566b8ad23d6e9e"

 [[projects]]
  branch = "master"
-  digest = "1:50a46ab1d5edbbdd55125b4d37f1bf503d0807c26461f9ad7b358d6006641d09"
  name = "github.com/flynn/go-shlex"
  packages = ["."]
-  pruneopts = "UT"
  revision = "3f9db97f856818214da2e1057f8ad84803971cff"

 [[projects]]
  branch = "master"
-  digest = "1:d4623fc7bf7e281d9107367cc4a9e76ed3e86b1eec1a4e30630c870bef1fedd0"
  name = "github.com/getsentry/raven-go"
  packages = ["."]
-  pruneopts = "UT"
  revision = "ed7bcb39ff10f39ab08e317ce16df282845852fa"

 [[projects]]
  branch = "master"
-  digest = "1:3e6afc3ed8a72949aa735c00fddc23427dc9384ccfd51cf0d91a412e668da632"
  name = "github.com/golang-collections/collections"
  packages = ["queue"]
-  pruneopts = "UT"
  revision = "604e922904d35e97f98a774db7881f049cd8d970"

 [[projects]]
-  digest = "1:17fe264ee908afc795734e8c4e63db2accabaf57326dbf21763a7d6b86096260"
  name = "github.com/golang/protobuf"
  packages = [
    "proto",
    "ptypes",
    "ptypes/any",
    "ptypes/duration",
-    "ptypes/timestamp",
+    "ptypes/timestamp"
  ]
-  pruneopts = "UT"
  revision = "b4deda0973fb4c70b50d226b1af49f3da59f5265"
  version = "v1.1.0"

 [[projects]]
-  digest = "1:8f8811f9be822914c3a25c6a071e93beb4c805d7b026cbf298bc577bc1cc945b"
  name = "github.com/google/uuid"
  packages = ["."]
-  pruneopts = "UT"
  revision = "064e2069ce9c359c118179501254f67d7d37ba24"
  version = "0.2"

 [[projects]]
-  digest = "1:c79fb010be38a59d657c48c6ba1d003a8aa651fa56b579d959d74573b7dff8e1"
  name = "github.com/gorilla/context"
  packages = ["."]
-  pruneopts = "UT"
  revision = "08b5f424b9271eedf6f9f0ce86cb9396ed337a42"
  version = "v1.1.1"

 [[projects]]
-  digest = "1:e73f5b0152105f18bc131fba127d9949305c8693f8a762588a82a48f61756f5f"
  name = "github.com/gorilla/mux"
  packages = ["."]
-  pruneopts = "UT"
  revision = "e3702bed27f0d39777b0b37b664b6280e8ef8fbf"
  version = "v1.6.2"

 [[projects]]
-  digest = "1:43dd08a10854b2056e615d1b1d22ac94559d822e1f8b6fcc92c1a1057e85188e"
  name = "github.com/gorilla/websocket"
  packages = ["."]
-  pruneopts = "UT"
  revision = "ea4d1f681babbce9545c9c5f3d5194a789c89f5b"
  version = "v1.2.0"

 [[projects]]
  branch = "master"
-  digest = "1:1a1206efd03a54d336dce7bb8719e74f2f8932f661cb9f57d5813a1d99c083d8"
  name = "github.com/grpc-ecosystem/grpc-opentracing"
  packages = ["go/otgrpc"]
-  pruneopts = "UT"
  revision = "8e809c8a86450a29b90dcc9efbf062d0fe6d9746"

 [[projects]]
-  digest = "1:75ab90ae3f5d876167e60f493beadfe66f0ed861a710f283fb06c86437a09538"
  name = "github.com/jonboulle/clockwork"
  packages = ["."]
-  pruneopts = "UT"
  revision = "2eee05ed794112d45db504eb05aa693efd2b8b09"
  version = "v0.1.0"

 [[projects]]
  branch = "master"
-  digest = "1:37ce7d7d80531b227023331002c0d42b4b4b291a96798c82a049d03a54ba79e4"
  name = "github.com/lib/pq"
  packages = [
    ".",
-    "oid",
+    "oid"
  ]
-  pruneopts = "UT"
  revision = "90697d60dd844d5ef6ff15135d0203f65d2f53b8"

 [[projects]]
-  digest = "1:c658e84ad3916da105a761660dcaeb01e63416c8ec7bc62256a9b411a05fcd67"
  name = "github.com/mattn/go-colorable"
  packages = ["."]
-  pruneopts = "UT"
  revision = "167de6bfdfba052fa6b2d3664c8f5272e23c9072"
  version = "v0.0.9"

 [[projects]]
-  digest = "1:d4d17353dbd05cb52a2a52b7fe1771883b682806f68db442b436294926bbfafb"
  name = "github.com/mattn/go-isatty"
  packages = ["."]
-  pruneopts = "UT"
  revision = "0360b2af4f38e8d38c7fce2a9f4e702702d73a39"
  version = "v0.0.3"

 [[projects]]
-  digest = "1:ff5ebae34cfbf047d505ee150de27e60570e8c394b3b8fdbb720ff6ac71985fc"
  name = "github.com/matttproud/golang_protobuf_extensions"
  packages = ["pbutil"]
-  pruneopts = "UT"
  revision = "c12348ce28de40eed0136aa2b644d0ee0650e56c"
  version = "v1.0.1"

 [[projects]]
  branch = "master"
-  digest = "1:75fa16a231ef40da3e462d651c20b9df20bde0777bdc1ac0982242c79057ee71"
  name = "github.com/mholt/caddy"
  packages = [
    ".",
    "caddyfile",
-    "telemetry",
+    "telemetry"
  ]
-  pruneopts = "UT"
  revision = "d3b731e9255b72d4571a5aac125634cf1b6031dc"

 [[projects]]
-  digest = "1:463e4140189f8194f9121ca1c7fe3b8e9e9a2ab3d949b43c835c21034927dc62"
  name = "github.com/miekg/dns"
  packages = ["."]
-  pruneopts = "UT"
  revision = "5a2b9fab83ff0f8bfc99684bd5f43a37abe560f1"
  version = "v1.0.8"

 [[projects]]
  branch = "master"
-  digest = "1:8eb17c2ec4df79193ae65b621cd1c0c4697db3bc317fe6afdc76d7f2746abd05"
  name = "github.com/mitchellh/go-homedir"
  packages = ["."]
-  pruneopts = "UT"
  revision = "3864e76763d94a6df2f9960b16a20a33da9f9a66"

 [[projects]]
-  digest = "1:450b7623b185031f3a456801155c8320209f75d0d4c4e633c6b1e59d44d6e392"
  name = "github.com/opentracing/opentracing-go"
  packages = [
    ".",
    "ext",
-    "log",
+    "log"
  ]
-  pruneopts = "UT"
  revision = "1949ddbfd147afd4d964a9f00b24eb291e0e7c38"
  version = "v1.0.2"

 [[projects]]
-  digest = "1:40e195917a951a8bf867cd05de2a46aaf1806c50cf92eebf4c16f78cd196f747"
  name = "github.com/pkg/errors"
  packages = ["."]
-  pruneopts = "UT"
  revision = "645ef00459ed84a119197bfb8d8205042c6df63d"
  version = "v0.8.0"

 [[projects]]
-  digest = "1:0028cb19b2e4c3112225cd871870f2d9cf49b9b4276531f03438a88e94be86fe"
  name = "github.com/pmezard/go-difflib"
  packages = ["difflib"]
-  pruneopts = "UT"
  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
  version = "v1.0.0"

 [[projects]]
-  digest = "1:c968b29db5d68ec97de404b6d058d5937fa015a141b3b4f7a0d87d5f8226f04c"
  name = "github.com/prometheus/client_golang"
  packages = [
    "prometheus",
-    "prometheus/promhttp",
+    "prometheus/promhttp"
  ]
-  pruneopts = "UT"
  revision = "967789050ba94deca04a5e84cce8ad472ce313c1"
  version = "v0.9.0-pre1"

 [[projects]]
  branch = "master"
-  digest = "1:32d10bdfa8f09ecf13598324dba86ab891f11db3c538b6a34d1c3b5b99d7c36b"
  name = "github.com/prometheus/client_model"
  packages = ["go"]
-  pruneopts = "UT"
  revision = "99fa1f4be8e564e8a6b613da7fa6f46c9edafc6c"

 [[projects]]
  branch = "master"
-  digest = "1:e469cd65badf7694aeb44874518606d93c1d59e7735d3754ad442782437d3cc3"
  name = "github.com/prometheus/common"
  packages = [
    "expfmt",
    "internal/bitbucket.org/ww/goautoneg",
-    "model",
+    "model"
  ]
-  pruneopts = "UT"
  revision = "7600349dcfe1abd18d72d3a1770870d9800a7801"

 [[projects]]
  branch = "master"
-  digest = "1:20d9bb50dbee172242f9bcd6ec24a917dd7a5bb17421bf16a79c33111dea7db1"
  name = "github.com/prometheus/procfs"
  packages = [
    ".",
    "internal/util",
    "nfs",
-    "xfs",
+    "xfs"
  ]
-  pruneopts = "UT"
  revision = "ae68e2d4c00fed4943b5f6698d504a5fe083da8a"

 [[projects]]
-  digest = "1:9a6f766efd8d5752adb7052aebb6e3d85255b31a8dff5e58ab4efa740ba9efa0"
  name = "github.com/rifflock/lfshook"
  packages = ["."]
-  pruneopts = "UT"
  revision = "bf539943797a1f34c1f502d07de419b5238ae6c6"
  version = "v2.3"

 [[projects]]
-  digest = "1:9e9193aa51197513b3abcb108970d831fbcf40ef96aa845c4f03276e1fa316d2"
  name = "github.com/sirupsen/logrus"
  packages = ["."]
-  pruneopts = "UT"
  revision = "c155da19408a8799da419ed3eeb0cb5db0ad5dbc"
  version = "v1.0.5"

 [[projects]]
-  digest = "1:18752d0b95816a1b777505a97f71c7467a8445b8ffb55631a7bf779f6ba4fa83"
  name = "github.com/stretchr/testify"
  packages = ["assert"]
-  pruneopts = "UT"
  revision = "f35b8ab0b5a2cef36673838d662e249dd9c94686"
  version = "v1.2.2"

 [[projects]]
  branch = "master"
-  digest = "1:1182d12da264c8fe593504f150c3a479297767991fc1c06796cb67e4f61c4366"
  name = "golang.org/x/crypto"
  packages = [
    "curve25519",
@@ -405,14 +318,12 @@
    "nacl/secretbox",
    "poly1305",
    "salsa20/salsa",
-    "ssh/terminal",
+    "ssh/terminal"
  ]
-  pruneopts = "UT"
  revision = "a49355c7e3f8fe157a85be2f77e6e269a0f89602"

 [[projects]]
  branch = "master"
-  digest = "1:011ee76ffb757c7c91a3e61cf5d6f367d1fd5dd08e16a4e6ae688e7759f8509a"
  name = "golang.org/x/net"
  packages = [
    "bpf",
@@ -427,22 +338,18 @@
    "ipv4",
    "ipv6",
    "trace",
-    "websocket",
+    "websocket"
  ]
-  pruneopts = "UT"
  revision = "32a936f46389aa10549d60bd7833e54b01685d09"

 [[projects]]
  branch = "master"
-  digest = "1:39ebcc2b11457b703ae9ee2e8cca0f68df21969c6102cb3b705f76cca0ea0239"
  name = "golang.org/x/sync"
  packages = ["errgroup"]
-  pruneopts = "UT"
  revision = "1d60e4601c6fd243af51cc01ddf169918a5407ca"

 [[projects]]
  branch = "master"
-  digest = "1:2e8e74aa73847379a370c2704ff08baf4a7303ae682766e70c23ded3fd9b3f37"
  name = "golang.org/x/sys"
  packages = [
    "unix",
@@ -450,13 +357,11 @@
    "windows/registry",
    "windows/svc",
    "windows/svc/eventlog",
-    "windows/svc/mgr",
+    "windows/svc/mgr"
  ]
-  pruneopts = "UT"
  revision = "ce36f3865eeb42541ce3f87f32f8462c5687befa"

 [[projects]]
-  digest = "1:a2ab62866c75542dd18d2b069fec854577a20211d7c0ea6ae746072a1dccdd18"
  name = "golang.org/x/text"
  packages = [
    "collate",
@@ -472,22 +377,18 @@
    "unicode/bidi",
    "unicode/cldr",
    "unicode/norm",
-    "unicode/rangetable",
+    "unicode/rangetable"
  ]
-  pruneopts = "UT"
  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
  version = "v0.3.0"

 [[projects]]
  branch = "master"
-  digest = "1:601e63e7d4577f907118bec825902505291918859d223bce015539e79f1160e3"
  name = "google.golang.org/genproto"
  packages = ["googleapis/rpc/status"]
-  pruneopts = "UT"
  revision = "ff3583edef7de132f219f0efc00e097cabcc0ec0"

 [[projects]]
-  digest = "1:2dab32a43451e320e49608ff4542fdfc653c95dcc35d0065ec9c6c3dd540ed74"
  name = "google.golang.org/grpc"
  packages = [
    ".",
@@ -514,34 +415,28 @@
    "stats",
    "status",
    "tap",
-    "transport",
+    "transport"
  ]
-  pruneopts = "UT"
  revision = "168a6198bcb0ef175f7dacec0b8691fc141dc9b8"
  version = "v1.13.0"

 [[projects]]
  branch = "altsrc-parse-durations"
-  digest = "1:0370b1bceda03dbfade3abbde639a43f1113bab711ec760452e5c0dcc0c14787"
  name = "gopkg.in/urfave/cli.v2"
  packages = [
    ".",
-    "altsrc",
+    "altsrc"
  ]
-  pruneopts = "UT"
  revision = "d604b6ffeee878fbf084fd2761466b6649989cee"
  source = "https://github.com/cbranch/cli"

 [[projects]]
-  digest = "1:342378ac4dcb378a5448dd723f0784ae519383532f5e70ade24132c4c8693202"
  name = "gopkg.in/yaml.v2"
  packages = ["."]
-  pruneopts = "UT"
  revision = "5420a8b6744d3b0345ab293f6fcba19c978f1183"
  version = "v2.2.1"

 [[projects]]
-  digest = "1:8ffc3ddc31414c0a71220957bb723b16510d7fcb5b3880dc0da4cf6d39c31642"
  name = "zombiezen.com/go/capnproto2"
  packages = [
    ".",
@@ -557,9 +452,8 @@
    "rpc/internal/refcount",
    "schemas",
    "server",
-    "std/capnp/rpc",
+    "std/capnp/rpc"
  ]
-  pruneopts = "UT"
  revision = "7cfd211c19c7f5783c695f3654efa46f0df259c3"
  source = "https://github.com/zombiezen/go-capnproto2"
  version = "v2.17.1"
@@ -567,59 +461,6 @@
 [solve-meta]
  analyzer-name = "dep"
  analyzer-version = 1
-  input-imports = [
-    "github.com/cloudflare/brotli-go",
-    "github.com/cloudflare/golibs/lrucache",
-    "github.com/coredns/coredns/core/dnsserver",
-    "github.com/coredns/coredns/plugin",
-    "github.com/coredns/coredns/plugin/cache",
-    "github.com/coredns/coredns/plugin/metrics/vars",
-    "github.com/coredns/coredns/plugin/pkg/dnstest",
-    "github.com/coredns/coredns/plugin/pkg/rcode",
-    "github.com/coredns/coredns/request",
-    "github.com/coreos/go-oidc/jose",
-    "github.com/coreos/go-oidc/oidc",
-    "github.com/coreos/go-systemd/daemon",
-    "github.com/elgs/gosqljson",
-    "github.com/equinox-io/equinox",
-    "github.com/facebookgo/grace/gracenet",
-    "github.com/getsentry/raven-go",
-    "github.com/golang-collections/collections/queue",
-    "github.com/google/uuid",
-    "github.com/gorilla/mux",
-    "github.com/gorilla/websocket",
-    "github.com/lib/pq",
-    "github.com/mattn/go-colorable",
-    "github.com/miekg/dns",
-    "github.com/mitchellh/go-homedir",
-    "github.com/pkg/errors",
-    "github.com/prometheus/client_golang/prometheus",
-    "github.com/prometheus/client_golang/prometheus/promhttp",
-    "github.com/rifflock/lfshook",
-    "github.com/sirupsen/logrus",
-    "github.com/stretchr/testify/assert",
-    "golang.org/x/crypto/nacl/box",
-    "golang.org/x/crypto/ssh/terminal",
-    "golang.org/x/net/context",
-    "golang.org/x/net/http2",
-    "golang.org/x/net/http2/hpack",
-    "golang.org/x/net/idna",
-    "golang.org/x/net/trace",
-    "golang.org/x/net/websocket",
-    "golang.org/x/sync/errgroup",
-    "golang.org/x/sys/windows",
-    "golang.org/x/sys/windows/svc",
-    "golang.org/x/sys/windows/svc/eventlog",
-    "golang.org/x/sys/windows/svc/mgr",
-    "gopkg.in/urfave/cli.v2",
-    "gopkg.in/urfave/cli.v2/altsrc",
-    "zombiezen.com/go/capnproto2",
-    "zombiezen.com/go/capnproto2/encoding/text",
-    "zombiezen.com/go/capnproto2/pogs",
-    "zombiezen.com/go/capnproto2/rpc",
-    "zombiezen.com/go/capnproto2/schemas",
-    "zombiezen.com/go/capnproto2/server",
-    "zombiezen.com/go/capnproto2/std/capnp/rpc",
-  ]
+  inputs-digest = "ee681bef3527e49801c841e313f98b40116eafe8b60be21273956eeb96487486"
  solver-name = "gps-cdcl"
  solver-version = 1
@@ -73,7 +73,3 @@
 [[constraint]]
  branch = "master"
  name = "golang.org/x/crypto"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/cloudflare/golibs"
@@ -23,10 +23,6 @@ endif
 .PHONY: all
 all: cloudflared test

-.PHONY: clean
-clean:
-	go clean
-
 .PHONY: cloudflared
 cloudflared:
 	go build -v $(VERSION_FLAGS) $(IMPORT_PATH)/cmd/cloudflared
@@ -1,48 +1,14 @@
-2019.1.0
- 2018-12-10 TUN-1231: Horizontal overflow wrapping on the Hello page
- 2018-12-17 TUN-1140: Show usage if invoked with no args or config
- 2018-11-06 TUN-632 Filter out common network exceptions from going to Sentry on StartServer
- 2019-01-07 TUN-1138: Install cloudflared service directory with 755 permissions
- 2019-01-07 TUN-1265: Silent exit when failing to parse config
- 2019-01-10 TUN-1350: Enhance error messages with cloudflarestatus.com link, if relevant
- 2019-01-16 TUN-1358: Close readyList after Muxer.Serve() has stopped running
- 2019-01-24 AUTH-1423: move from stdout to stderr
- 2019-01-24 AUTH-1404: reauth if the token is about to expire within 15 minutes
- 2019-01-24 AUTH-1459: improved ssh streaming error message
- 2019-01-24 AUTH-1211: print all the versions
- 2019-01-24 AUTH-1337: fix url path
- 2019-01-28 TUN-1418: Rename ProtocolLogger to TransportLogger, and use TransportLogger to log RPC events.
- 2019-01-28 TUN-1419: Identify request/response headers/content length with ray ID
-
-2018.12.1
- 2018-12-11 TUN-1270: cloudflared panic (HA metrics missing label)
-
-2018.12.0
- 2018-11-15 TUN-1196: Allow TLS config client CA and root CA to be constructed from multiple certificates
- 2018-11-20 TUN-1209: TLS Config Certificates and GetCertificate can both be set
- 2018-11-26 TUN-1212: Expose tunnel_id in metrics
- 2018-11-30 TUN-1204: remove 'cloudflared hello' command
- 2018-12-04 Fix license URL typo
- 2018-12-07 TUN-1250: ValidateHTTPService shouldn't follow 302s
-
-2018.11.0
- 2018-10-31 AUTH-1282: Fixed an issue where we were receiving as opposed sending on the channel.
- 2018-11-06 TUN-1179: Fix log message in cmd/cloudflared/transfer.Run
- 2018-11-13 AUTH-1308: get jwt even when you are already logged in
- 2018-11-12 TUN-1190: check URL parse error when starting SSH proxy server
- 2018-11-15 AUTH-1320: Fixed request issue and unhide the ssh command
-
-2018.10.5
- 2018-10-18 TUN-968: Flow control for large requests/responses
- 2018-10-26 TUN-1158: Windows: use process arguments rather than trivial service arguments
- 2018-10-20 #30: Fix the Content-Length header for HTTP2->HTTP1
- 2018-10-29 TUN-1160: pass Host header during origin url validation
+2018.10.4
+- 2018-09-21 AUTH-1070: added SSH/protocol forwarding
+- 2018-10-19 AUTH-1235: fixed packaging of deb dev file
+- 2018-10-19 TUN-1097: Host missing from WebSocket request
+- 2018-10-25 Release 2018.10.4
+- 2018-10-19 AUTH-1188: UX feedback, move warnings to debug

 2018.10.4
 - 2018-09-21 AUTH-1070: added SSH/protocol forwarding
 - 2018-10-19 AUTH-1235: fixed packaging of deb dev file
 - 2018-10-19 TUN-1097: Host missing from WebSocket request
- 2018-10-19 AUTH-1188: UX Review and Changes for CLI SSH Access

 2018.10.3
 - 2018-10-08 TUN-1099: Bring back changes in 2018.10.1
@@ -71,7 +71,7 @@ func serveConnection(logger *logrus.Logger, c net.Conn, originURL string) {
 func serveStream(logger *logrus.Logger, originURL string, conn io.ReadWriter) error {
 	wsConn, err := createWebsocketStream(originURL)
 	if err != nil {
-		logger.WithError(err).Errorf("failed to connect to %s\n", originURL)
+		logger.WithError(err).Error("failed to create websocket stream")
 		return err
 	}
 	defer wsConn.Close()
@@ -89,7 +89,6 @@ func createWebsocketStream(originURL string) (*websocket.Conn, error) {
 	if err != nil {
 		return nil, err
 	}
-
 	wsConn, resp, err := websocket.ClientConnect(req, nil)
 	if err != nil && resp != nil && resp.StatusCode > 300 {
 		location, err := resp.Location()
@@ -126,14 +125,7 @@ func buildAccessRequest(originURL string) (*http.Request, error) {
 	if err != nil {
 		return nil, err
 	}
+	req.Header.Set("cf-access-token", token)

-	// We need to create a new request as FetchToken will modify req (boo mutable)
-	// as it has to follow redirect on the API and such, so here we init a new one
-	originRequest, err := http.NewRequest(http.MethodGet, originURL, nil)
-	if err != nil {
-		return nil, err
-	}
-	originRequest.Header.Set("cf-access-token", token)
-
-	return originRequest, nil
+	return req, nil
 }
@@ -66,16 +66,11 @@ func TestStartServer(t *testing.T) {
 	defer ts.Close()

 	go func() {
-		err := StartServer(logger, listenerAddress, "http://"+ts.Listener.Addr().String(), shutdownC)
-		if err != nil {
-			t.Fatalf("Error starting server: %v", err)
-		}
+		StartServer(logger, listenerAddress, "http://"+ts.Listener.Addr().String(), shutdownC)
 	}()

 	conn, err := net.Dial("tcp", listenerAddress)
-	if err != nil {
-		t.Fatalf("Error connecting to server: %v", err)
-	}
+	assert.NoError(t, err)
 	conn.Write([]byte(message))

 	readBuffer := make([]byte, len(message))
@@ -89,12 +89,14 @@ func Commands() []*cli.Command {
 					Usage:       "",
 					ArgsUsage:   "",
 					Description: `The ssh subcommand sends data over a proxy to the Cloudflare edge.`,
+					Hidden:      true,
 					Flags: []cli.Flag{
 						&cli.StringFlag{
 							Name: "hostname",
 						},
 						&cli.StringFlag{
-							Name: "url",
+							Name:   "url",
+							Hidden: true,
 						},
 					},
 				},
@@ -103,6 +105,7 @@ func Commands() []*cli.Command {
 					Action:      sshConfig,
 					Usage:       "ssh-config",
 					Description: `Prints an example configuration ~/.ssh/config`,
+					Hidden:      true,
 				},
 			},
 		},
@@ -2,7 +2,6 @@ package main

 import (
 	"fmt"
-	"strings"
 	"time"

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/access"
@@ -20,25 +19,13 @@ import (

 const (
 	developerPortal = "https://developers.cloudflare.com/argo-tunnel"
-	licenseUrl      = developerPortal + "/license/"
-	versionText     = "Print the version"
+	licenseUrl      = developerPortal + "/licence/"
 )

 var (
 	Version   = "DEV"
 	BuildTime = "unknown"
 	logger    = log.CreateLogger()
-	// Mostly network errors that we don't want reported back to Sentry, this is done by substring match.
-	ignoredErrors = []string{
-		"connection reset by peer",
-		"An existing connection was forcibly closed by the remote host.",
-		"use of closed connection",
-		"You need to enable Argo Smart Routing",
-		"3001 connection closed",
-		"3002 connection dropped",
-		"rpc exception: dial tcp",
-		"rpc exception: EOF",
-	}
 )

 func main() {
@@ -52,12 +39,6 @@ func main() {
 	// Windows service manager closes this channel when it receives stop command.
 	graceShutdownC := make(chan struct{})

-	cli.VersionFlag = &cli.BoolFlag{
-		Name:    "version",
-		Aliases: []string{"v", "V"},
-		Usage:   versionText,
-	}
-
 	app := &cli.App{}
 	app.Name = "cloudflared"
 	app.Usage = "Cloudflare's command-line tool and agent"
@@ -71,14 +52,14 @@ func main() {
 	app.Flags = flags()
 	app.Action = action(Version, shutdownC, graceShutdownC)
 	app.Before = tunnel.Before
-	app.Commands = commands(cli.ShowVersion)
+	app.Commands = commands()

 	tunnel.Init(Version, shutdownC, graceShutdownC) // we need this to support the tunnel sub command...
 	access.Init(shutdownC, graceShutdownC)
 	runApp(app, shutdownC, graceShutdownC)
 }

-func commands(version func(c *cli.Context)) []*cli.Command {
+func commands() []*cli.Command {
 	cmds := []*cli.Command{
 		{
 			Name:      "update",
@@ -91,15 +72,6 @@ Otherwise, does nothing.

 To determine if an update happened in a script, check for error code 64.`,
 		},
-		{
-			Name: "version",
-			Action: func(c *cli.Context) (err error) {
-				version(c)
-				return nil
-			},
-			Usage:       versionText,
-			Description: versionText,
-		},
 	}
 	cmds = append(cmds, tunnel.Commands()...)
 	cmds = append(cmds, access.Commands()...)
@@ -111,21 +83,14 @@ func flags() []cli.Flag {
 	return append(flags, access.Flags()...)
 }

-func isEmptyInvocation(c *cli.Context) bool {
-	return c.NArg() == 0 && c.NumFlags() == 0
-}
-
 func action(version string, shutdownC, graceShutdownC chan struct{}) cli.ActionFunc {
 	return func(c *cli.Context) (err error) {
-		if isEmptyInvocation(c) {
-			cli.ShowAppHelpAndExit(c, 1)
-		}
 		tags := make(map[string]string)
 		tags["hostname"] = c.String("hostname")
 		raven.SetTagsContext(tags)
 		raven.CapturePanic(func() { err = tunnel.StartServer(c, version, shutdownC, graceShutdownC) }, nil)
 		if err != nil {
-			handleError(err)
+			raven.CaptureError(err, nil)
 		}
 		return err
 	}
@@ -143,14 +108,3 @@ func userHomeDir() (string, error) {
 	}
 	return homeDir, nil
 }
-
-// In order to keep the amount of noise sent to Sentry low, typical network errors can be filtered out here by a substring match.
-func handleError(err error) {
-	errorMessage := err.Error()
-	for _, ignoredErrorMessage := range ignoredErrors {
-		if strings.Contains(errorMessage, ignoredErrorMessage) {
-			return
-		}
-	}
-	raven.CaptureError(err, nil)
-}
@@ -96,7 +96,7 @@ func runCommand(command string, args ...string) error {
 func ensureConfigDirExists(configDir string) error {
 	ok, err := config.FileExists(configDir)
 	if !ok && err == nil {
-		err = os.Mkdir(configDir, 0755)
+		err = os.Mkdir(configDir, 0700)
 	}
 	return err
 }
@@ -62,8 +62,7 @@ func GetTokenIfExists(url *url.URL) (string, error) {
 		return "", err
 	}
 	ident, err := oidc.IdentityFromClaims(claims)
-	// AUTH-1404, reauth if the token is about to expire within 15 minutes
-	if err == nil && ident.ExpiresAt.After(time.Now().Add(time.Minute*15)) {
+	if err == nil && ident.ExpiresAt.After(time.Now()) {
 		return token.Encode(), nil
 	}
 	return "", err
@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
 	"time"

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/encrypter"
@@ -40,18 +41,17 @@ func Run(transferURL *url.URL, resourceName, key, value, path string, shouldEncr
 		return nil, err
 	}

-	// See AUTH-1423 for why we use stderr (the way git wraps ssh)
 	err = shell.OpenBrowser(requestURL)
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "Please open the following URL and log in with your Cloudflare account:\n\n%s\n\nLeave cloudflared running to download the %s automatically.\n", requestURL, resourceName)
+		fmt.Fprintf(os.Stdout, "Please open the following URL and log in with your Cloudflare account:\n\n%s\n\nLeave cloudflared running to download the %s automatically.\n", resourceName, requestURL)
 	} else {
-		fmt.Fprintf(os.Stderr, "A browser window should have opened at the following URL:\n\n%s\n\nIf the browser failed to open, open it yourself and visit the URL above.\n", requestURL)
+		fmt.Fprintf(os.Stdout, "A browser window should have opened at the following URL:\n\n%s\n\nIf the browser failed to open, open it yourself and visit the URL above.\n", requestURL)
 	}

 	var resourceData []byte

 	if shouldEncrypt {
-		buf, key, err := transferRequest(baseStoreURL + "transfer/" + encrypterClient.PublicKey())
+		buf, key, err := transferRequest(baseStoreURL + filepath.Join("transfer", encrypterClient.PublicKey()))
 		if err != nil {
 			return nil, err
 		}
@@ -67,7 +67,7 @@ func Run(transferURL *url.URL, resourceName, key, value, path string, shouldEncr

 		resourceData = decrypted
 	} else {
-		buf, _, err := transferRequest(baseStoreURL + encrypterClient.PublicKey())
+		buf, _, err := transferRequest(baseStoreURL + filepath.Join(encrypterClient.PublicKey()))
 		if err != nil {
 			return nil, err
 		}
@@ -83,19 +83,21 @@ func Run(transferURL *url.URL, resourceName, key, value, path string, shouldEncr

 // BuildRequestURL creates a request suitable for a resource transfer.
 // it will return a constructed url based off the base url and query key/value provided.
-// cli will build a url for cli transfer request.
-func buildRequestURL(baseURL *url.URL, key, value string, cli bool) (string, error) {
+// follow will follow redirects.
+func buildRequestURL(baseURL *url.URL, key, value string, follow bool) (string, error) {
 	q := baseURL.Query()
 	q.Set(key, value)
 	baseURL.RawQuery = q.Encode()
-	if !cli {
+	if !follow {
 		return baseURL.String(), nil
 	}

-	q.Set("redirect_url", baseURL.String()) // we add the token as a query param on both the redirect_url
-	baseURL.RawQuery = q.Encode()           // and this actual baseURL.
-	baseURL.Path = "cdn-cgi/access/cli"
-	return baseURL.String(), nil
+	response, err := http.Get(baseURL.String())
+	if err != nil {
+		return "", err
+	}
+	return response.Request.URL.String(), nil
+
 }

 // transferRequest downloads the requested resource from the request URL
@@ -25,7 +25,7 @@ import (
 	"github.com/coreos/go-systemd/daemon"
 	"github.com/facebookgo/grace/gracenet"
 	"github.com/pkg/errors"
-	"gopkg.in/urfave/cli.v2"
+	cli "gopkg.in/urfave/cli.v2"
 	"gopkg.in/urfave/cli.v2/altsrc"
 )

@@ -56,6 +56,20 @@ func Commands() []*cli.Command {
 			},
 			Hidden: true,
 		},
+		{
+			Name:   "hello",
+			Action: helloWorld,
+			Usage:  "Run a simple \"Hello World\" server for testing Argo Tunnel.",
+			Flags: []cli.Flag{
+				&cli.IntFlag{
+					Name:  "port",
+					Usage: "Listen on the selected port.",
+					Value: 8080,
+				},
+			},
+			ArgsUsage: " ", // can't be the empty string or we get the default output
+			Hidden:    true,
+		},
 		{
 			Name:   "proxy-dns",
 			Action: tunneldns.Run,
@@ -176,7 +190,7 @@ func Init(v string, s, g chan struct{}) {
 }

 func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan struct{}) error {
-	_ = raven.SetDSN(sentryDSN)
+	raven.SetDSN(sentryDSN)
 	var wg sync.WaitGroup
 	listeners := gracenet.Net{}
 	errC := make(chan error)
@@ -191,9 +205,9 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 		return errors.Wrap(err, "Error configuring logger")
 	}

-	transportLogger, err := configTransportLogger(c)
+	protoLogger, err := configProtoLogger(c)
 	if err != nil {
-		return errors.Wrap(err, "Error configuring transport logger")
+		return errors.Wrap(err, "Error configuring protocol logger")
 	}

 	if c.IsSet("trace-output") {
@@ -209,10 +223,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 			if err := os.Rename(tmpTraceFile.Name(), c.String("trace-output")); err != nil {
 				logger.WithError(err).Errorf("Failed to rename temporary trace output file %s to %s", tmpTraceFile.Name(), c.String("trace-output"))
 			} else {
-				err := os.Remove(tmpTraceFile.Name())
-				if err != nil {
-					logger.WithError(err).Errorf("Failed to remove the temporary trace file %s", tmpTraceFile.Name())
-				}
+				os.Remove(tmpTraceFile.Name())
 			}
 		}()

@@ -224,7 +235,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	}

 	if c.String("logfile") != "" {
-		if err := initLogFile(c, logger, transportLogger); err != nil {
+		if err := initLogFile(c, logger, protoLogger); err != nil {
 			logger.Error(err)
 		}
 	}
@@ -300,7 +311,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 		c.Set("url", "https://"+helloListener.Addr().String())
 	}

-	if uri, err := url.Parse(c.String("url")); err == nil && uri.Scheme == "ssh" {
+	if uri, _ := url.Parse(c.String("url")); uri.Scheme == "ssh" {
 		host := uri.Host
 		if uri.Port() == "" { // default to 22
 			host = uri.Hostname() + ":22"
@@ -318,7 +329,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 		c.Set("url", "http://"+listener.Addr().String())
 	}

-	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, version, logger, transportLogger)
+	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, version, logger, protoLogger)
 	if err != nil {
 		return err
 	}
@@ -338,12 +349,12 @@ func Before(c *cli.Context) error {
 	}
 	inputSource, err := config.FindInputSourceContext(c)
 	if err != nil {
-		logger.WithError(err).Errorf("Cannot load configuration from %s", c.String("config"))
+		logger.WithError(err).Debugf("Cannot load configuration from %s", c.String("config"))
 		return err
 	} else if inputSource != nil {
 		err := altsrc.ApplyInputSourceValues(c, inputSource, c.App.Flags)
 		if err != nil {
-			logger.WithError(err).Errorf("Cannot apply configuration from %s", c.String("config"))
+			logger.WithError(err).Debugf("Cannot apply configuration from %s", c.String("config"))
 			return err
 		}
 		logger.Debugf("Applied configuration from %s", c.String("config"))
@@ -427,7 +438,7 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "cacert",
-			Usage:   "Certificate Authority authenticating connections with Cloudflare's edge network.",
+			Usage:   "Certificate Authority authenticating the Cloudflare tunnel connection.",
 			EnvVars: []string{"TUNNEL_CACERT"},
 			Hidden:  true,
 		}),
@@ -534,16 +545,15 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "loglevel",
 			Value:   "info",
-			Usage:   "Application logging level {panic, fatal, error, warn, info, debug}. " + debugLevelWarning,
+			Usage:   "Application logging level {panic, fatal, error, warn, info, debug}",
 			EnvVars: []string{"TUNNEL_LOGLEVEL"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "transport-loglevel",
-			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
+			Name:    "proto-loglevel",
 			Value:   "warn",
-			Usage:   "Transport logging level(previously called protocol logging level) {panic, fatal, error, warn, info, debug}",
-			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
+			Usage:   "Protocol logging level {panic, fatal, error, warn, info, debug}",
+			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewUintFlag(&cli.UintFlag{
@@ -136,7 +136,7 @@ If you don't have a certificate signed by Cloudflare, run the command:
 	return originCert, nil
 }

-func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version string, logger, transportLogger *logrus.Logger) (*origin.TunnelConfig, error) {
+func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version string, logger, protoLogger *logrus.Logger) (*origin.TunnelConfig, error) {
 	hostname, err := validation.ValidateHostname(c.String("hostname"))
 	if err != nil {
 		logger.WithError(err).Error("Invalid hostname")
@@ -192,24 +192,18 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		httpTransport.TLSClientConfig.ServerName = c.String("origin-server-name")
 	}

-	err = validation.ValidateHTTPService(originURL, hostname, httpTransport)
+	err = validation.ValidateHTTPService(originURL, httpTransport)
 	if err != nil {
 		logger.WithError(err).Error("unable to connect to the origin")
 		return nil, errors.Wrap(err, "unable to connect to the origin")
 	}

-	toEdgeTLSConfig, err := createTunnelConfig(c)
-	if err != nil {
-		logger.WithError(err).Error("unable to create TLS config to connect with edge")
-		return nil, errors.Wrap(err, "unable to create TLS config to connect with edge")
-	}
-
 	return &origin.TunnelConfig{
 		EdgeAddrs:          c.StringSlice("edge"),
 		OriginUrl:          originURL,
 		Hostname:           hostname,
 		OriginCert:         originCert,
-		TlsConfig:          toEdgeTLSConfig,
+		TlsConfig:          tlsconfig.CreateTunnelConfig(c, c.StringSlice("edge")),
 		ClientTlsConfig:    httpTransport.TLSClientConfig,
 		Retries:            c.Uint("retries"),
 		HeartbeatInterval:  c.Duration("heartbeat-interval"),
@@ -223,14 +217,13 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		HTTPTransport:      httpTransport,
 		Metrics:            tunnelMetrics,
 		MetricsUpdateFreq:  c.Duration("metrics-update-freq"),
-		TransportLogger:    transportLogger,
+		ProtocolLogger:     protoLogger,
 		Logger:             logger,
 		IsAutoupdated:      c.Bool("is-autoupdated"),
 		GracePeriod:        c.Duration("grace-period"),
 		RunFromTerminal:    isRunningFromTerminal(),
 		NoChunkedEncoding:  c.Bool("no-chunked-encoding"),
 		CompressionQuality: c.Uint64("compression-quality"),
-		IncidentLookup:     origin.NewIncidentLookup(),
 	}, nil
 }

@@ -247,7 +240,7 @@ func loadCertPool(c *cli.Context, logger *logrus.Logger) (*x509.CertPool, error)
 		}
 	}

-	originCertPool, err := loadOriginCertPool(originCustomCAPool)
+	originCertPool, err := tlsconfig.LoadOriginCertPool(originCustomCAPool)
 	if err != nil {
 		return nil, errors.Wrap(err, "error loading the certificate pool")
 	}
@@ -260,86 +253,6 @@ func loadCertPool(c *cli.Context, logger *logrus.Logger) (*x509.CertPool, error)
 	return originCertPool, nil
 }

-func loadOriginCertPool(originCAPoolPEM []byte) (*x509.CertPool, error) {
-	// Get the global pool
-	certPool, err := loadGlobalCertPool()
-	if err != nil {
-		return nil, err
-	}
-
-	// Then, add any custom origin CA pool the user may have passed
-	if originCAPoolPEM != nil {
-		if !certPool.AppendCertsFromPEM(originCAPoolPEM) {
-			logger.Warn("could not append the provided origin CA to the cloudflared certificate pool")
-		}
-	}
-
-	return certPool, nil
-}
-
-func loadGlobalCertPool() (*x509.CertPool, error) {
-	// First, obtain the system certificate pool
-	certPool, err := x509.SystemCertPool()
-	if err != nil {
-		if runtime.GOOS != "windows" {
-			logger.WithError(err).Warn("error obtaining the system certificates")
-		}
-		certPool = x509.NewCertPool()
-	}
-
-	// Next, append the Cloudflare CAs into the system pool
-	cfRootCA, err := tlsconfig.GetCloudflareRootCA()
-	if err != nil {
-		return nil, errors.Wrap(err, "could not append Cloudflare Root CAs to cloudflared certificate pool")
-	}
-	for _, cert := range cfRootCA {
-		certPool.AddCert(cert)
-	}
-
-	// Finally, add the Hello certificate into the pool (since it's self-signed)
-	helloCert, err := tlsconfig.GetHelloCertificateX509()
-	if err != nil {
-		return nil, errors.Wrap(err, "could not append Hello server certificate to cloudflared certificate pool")
-	}
-	certPool.AddCert(helloCert)
-
-	return certPool, nil
-}
-
-func createTunnelConfig(c *cli.Context) (*tls.Config, error) {
-	var rootCAs []string
-	if c.String("cacert") != "" {
-		rootCAs = append(rootCAs, c.String("cacert"))
-	}
-	edgeAddrs := c.StringSlice("edge")
-
-	userConfig := &tlsconfig.TLSParameters{RootCAs: rootCAs}
-	tlsConfig, err := tlsconfig.GetConfig(userConfig)
-	if err != nil {
-		return nil, err
-	}
-	if tlsConfig.RootCAs == nil {
-		rootCAPool := x509.NewCertPool()
-		cfRootCA, err := tlsconfig.GetCloudflareRootCA()
-		if err != nil {
-			return nil, errors.Wrap(err, "could not append Cloudflare Root CAs to cloudflared certificate pool")
-		}
-		for _, cert := range cfRootCA {
-			rootCAPool.AddCert(cert)
-		}
-		tlsConfig.RootCAs = rootCAPool
-		tlsConfig.ServerName = "cftunnel.com"
-	} else if len(edgeAddrs) > 0 {
-		// Set for development environments and for testing specific origintunneld instances
-		tlsConfig.ServerName, _, _ = net.SplitHostPort(edgeAddrs[0])
-	}
-
-	if tlsConfig.ServerName == "" && !tlsConfig.InsecureSkipVerify {
-		return nil, fmt.Errorf("either ServerName or InsecureSkipVerify must be specified in the tls.Config")
-	}
-	return tlsConfig, nil
-}
-
 func isRunningFromTerminal() bool {
 	return terminal.IsTerminal(int(os.Stdout.Fd()))
 }
@@ -1,214 +0,0 @@
-// +build ignore
-// TODO: Remove the above build tag and include this test when we start compiling with Golang 1.10.0+
-
-package tunnel
-
-import (
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// Generated using `openssl req -newkey rsa:512 -nodes -x509 -days 3650`
-var samplePEM = []byte(`
-----BEGIN CERTIFICATE-----
-MIIB4DCCAYoCCQCb/H0EUrdXEjANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
-UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
-dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
-AwwIVGVzdCBPbmUwHhcNMTgwNDI2MTYxMDUxWhcNMjgwNDIzMTYxMDUxWjB3MQsw
-CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
-A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
-eTERMA8GA1UEAwwIVGVzdCBPbmUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAwVQD
-K0SJ25UFLznm2pU3zhzMEvpDEofHVNnCjk4mlDrtVop7PkKZ8pDEmuQANltUrxC8
-yHBE2wXMv+GlH+bDtwIDAQABMA0GCSqGSIb3DQEBCwUAA0EAjVYQzozIFPkt/HRY
-uUoZ8zEHIDICb0syFf5VAjm9AgTwIPzUmD+c5vl6LWDnxq7L45nLCzhhQ6YmiwDz
-X7Wcyg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-MIIB4DCCAYoCCQDZfCdAJ+mwzDANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
-UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
-dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
-AwwIVGVzdCBUd28wHhcNMTgwNDI2MTYxMTIwWhcNMjgwNDIzMTYxMTIwWjB3MQsw
-CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
-A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
-eTERMA8GA1UEAwwIVGVzdCBUd28wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAoHKp
-ROVK3zCSsH7ocYeyRAML4V7SFAbZcb4WIwDnE08oMBVRkQVcW5tqEkvG3RiClfzV
-wZIJ3CfqKIeSNSDU9wIDAQABMA0GCSqGSIb3DQEBCwUAA0EAJw2gUbnPiq4C2p5b
-iWzlA9Q7aKo+VQ4H7IZS7tTccr59nVjvH/TG3eWujpnocr4TOqW9M3CK1DF9mUGP
-3pQ3Jg==
-----END CERTIFICATE-----
-`)
-
-var systemCertPoolSubjects []*pkix.Name
-
-type certificateFixture struct {
-	ou string
-	cn string
-}
-
-func TestMain(m *testing.M) {
-	systemCertPool, err := x509.SystemCertPool()
-	if isUnrecoverableError(err) {
-		os.Exit(1)
-	}
-
-	if systemCertPool == nil {
-		// On Windows, let's just assume the system cert pool was empty
-		systemCertPool = x509.NewCertPool()
-	}
-
-	systemCertPoolSubjects, err = getCertPoolSubjects(systemCertPool)
-	if err != nil {
-		os.Exit(1)
-	}
-
-	os.Exit(m.Run())
-}
-
-func TestLoadOriginCertPoolJustSystemPool(t *testing.T) {
-	certPoolSubjects := loadCertPoolSubjects(t, nil)
-	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
-
-	// Remove extra subjects from the cert pool
-	var filteredSystemCertPoolSubjects []*pkix.Name
-
-	t.Log(extraSubjects)
-
-OUTER:
-	for _, subject := range certPoolSubjects {
-		for _, extraSubject := range extraSubjects {
-			if subject == extraSubject {
-				t.Log(extraSubject)
-				continue OUTER
-			}
-		}
-
-		filteredSystemCertPoolSubjects = append(filteredSystemCertPoolSubjects, subject)
-	}
-
-	assert.Equal(t, len(filteredSystemCertPoolSubjects), len(systemCertPoolSubjects))
-
-	difference := subjectSubtract(systemCertPoolSubjects, filteredSystemCertPoolSubjects)
-	assert.Equal(t, 0, len(difference))
-}
-
-func TestLoadOriginCertPoolCFCertificates(t *testing.T) {
-	certPoolSubjects := loadCertPoolSubjects(t, nil)
-
-	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
-
-	expected := []*certificateFixture{
-		{ou: "CloudFlare Origin SSL ECC Certificate Authority"},
-		{ou: "CloudFlare Origin SSL Certificate Authority"},
-		{cn: "origin-pull.cloudflare.net"},
-		{cn: "Argo Tunnel Sample Hello Server Certificate"},
-	}
-
-	assertFixturesMatchSubjects(t, expected, extraSubjects)
-}
-
-func TestLoadOriginCertPoolWithExtraPEMs(t *testing.T) {
-	certPoolWithoutPEMSubjects := loadCertPoolSubjects(t, nil)
-	certPoolWithPEMSubjects := loadCertPoolSubjects(t, samplePEM)
-
-	difference := subjectSubtract(certPoolWithoutPEMSubjects, certPoolWithPEMSubjects)
-
-	assert.Equal(t, 2, len(difference))
-
-	expected := []*certificateFixture{
-		{cn: "Test One"},
-		{cn: "Test Two"},
-	}
-
-	assertFixturesMatchSubjects(t, expected, difference)
-}
-
-func loadCertPoolSubjects(t *testing.T, originCAPoolPEM []byte) []*pkix.Name {
-	certPool, err := loadOriginCertPool(originCAPoolPEM)
-	if isUnrecoverableError(err) {
-		t.Fatal(err)
-	}
-	assert.NotEmpty(t, certPool.Subjects())
-	certPoolSubjects, err := getCertPoolSubjects(certPool)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return certPoolSubjects
-}
-
-func assertFixturesMatchSubjects(t *testing.T, fixtures []*certificateFixture, subjects []*pkix.Name) {
-	assert.Equal(t, len(fixtures), len(subjects))
-
-	for _, fixture := range fixtures {
-		found := false
-		for _, subject := range subjects {
-			found = found || fixtureMatchesSubjectPredicate(fixture, subject)
-		}
-
-		if !found {
-			t.Fail()
-		}
-	}
-}
-
-func fixtureMatchesSubjectPredicate(fixture *certificateFixture, subject *pkix.Name) bool {
-	cnMatch := true
-	if fixture.cn != "" {
-		cnMatch = fixture.cn == subject.CommonName
-	}
-
-	ouMatch := true
-	if fixture.ou != "" {
-		ouMatch = len(subject.OrganizationalUnit) > 0 && fixture.ou == subject.OrganizationalUnit[0]
-	}
-
-	return cnMatch && ouMatch
-}
-
-func subjectSubtract(left []*pkix.Name, right []*pkix.Name) []*pkix.Name {
-	var difference []*pkix.Name
-
-	var found bool
-	for _, r := range right {
-		found = false
-		for _, l := range left {
-			if (*l).String() == (*r).String() {
-				found = true
-			}
-		}
-
-		if !found {
-			difference = append(difference, r)
-		}
-	}
-
-	return difference
-}
-
-func getCertPoolSubjects(certPool *x509.CertPool) ([]*pkix.Name, error) {
-	var subjects []*pkix.Name
-
-	for _, subject := range certPool.Subjects() {
-		var sequence pkix.RDNSequence
-		_, err := asn1.Unmarshal(subject, &sequence)
-		if err != nil {
-			return nil, err
-		}
-
-		name := pkix.Name{}
-		name.FillFromRDNSequence(&sequence)
-
-		subjects = append(subjects, &name)
-	}
-
-	return subjects, nil
-}
-
-func isUnrecoverableError(err error) bool {
-	return err != nil && err.Error() != "crypto/x509: system root pool is not available on Windows"
-}
@@ -0,0 +1,20 @@
+package tunnel
+
+import (
+	"fmt"
+
+	"gopkg.in/urfave/cli.v2"
+
+	"github.com/cloudflare/cloudflared/hello"
+)
+
+func helloWorld(c *cli.Context) error {
+	address := fmt.Sprintf(":%d", c.Int("port"))
+	listener, err := hello.CreateTLSListener(address)
+	if err != nil {
+		return err
+	}
+	defer listener.Close()
+	err = hello.StartHelloWorldServer(logger, listener, nil)
+	return err
+}
@@ -13,9 +13,6 @@ import (
 	"github.com/pkg/errors"
 )

-const debugLevelWarning = "At debug level, request URL, method, protocol, content legnth and header will be logged. " +
-	"Response status, content length and header will also be logged in debug level."
-
 var logger = log.CreateLogger()

 func configMainLogger(c *cli.Context) error {
@@ -25,21 +22,18 @@ func configMainLogger(c *cli.Context) error {
 		return errors.Wrap(err, "Unknown logging level specified")
 	}
 	logger.SetLevel(logLevel)
-	if logLevel == logrus.DebugLevel {
-		logger.Warn(debugLevelWarning)
-	}
 	return nil
 }

-func configTransportLogger(c *cli.Context) (*logrus.Logger, error) {
-	transportLogLevel, err := logrus.ParseLevel(c.String("transport-loglevel"))
+func configProtoLogger(c *cli.Context) (*logrus.Logger, error) {
+	protoLogLevel, err := logrus.ParseLevel(c.String("proto-loglevel"))
 	if err != nil {
-		logger.WithError(err).Fatal("Unknown transport logging level specified")
-		return nil, errors.Wrap(err, "Unknown transport logging level specified")
+		logger.WithError(err).Fatal("Unknown protocol logging level specified")
+		return nil, errors.Wrap(err, "Unknown protocol logging level specified")
 	}
-	transportLogger := logrus.New()
-	transportLogger.Level = transportLogLevel
-	return transportLogger, nil
+	protoLogger := logrus.New()
+	protoLogger.Level = protoLogLevel
+	return protoLogger, nil
 }

 func initLogFile(c *cli.Context, loggers ...*logrus.Logger) error {
@@ -87,20 +87,7 @@ type windowsService struct {
 }

 // called by the package code at the start of the service
-func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
-	// the arguments passed here are only meaningful if they were manually
-	// specified by the user, e.g. using the Services console or `sc start`.
-	// https://docs.microsoft.com/en-us/windows/desktop/services/service-entry-point
-	// https://stackoverflow.com/a/6235139
-	var args []string
-	if len(serviceArgs) > 1 {
-		args = serviceArgs
-	} else {
-		// fall back to the arguments from ImagePath (or, as sc calls it, binPath)
-		args = os.Args
-	}
-	s.elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
-
+func (s *windowsService) Execute(args []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
 	const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
 	statusChan <- svc.Status{State: svc.StartPending}
 	errC := make(chan error)
@@ -15,12 +15,11 @@ import (
 )

 const (
-	defaultFrameSize         uint32        = 1 << 14       // Minimum frame size in http2 spec
-	defaultWindowSize        uint32        = (1 << 16) - 1 // Minimum window size in http2 spec
-	maxWindowSize            uint32        = (1 << 31) - 1 // 2^31-1 = 2147483647, max window size in http2 spec
-	defaultTimeout           time.Duration = 5 * time.Second
-	defaultRetries           uint64        = 5
-	defaultWriteBufferMaxLen int           = 1024 * 1024 * 512 // 500mb
+	defaultFrameSize  uint32        = 1 << 14 // Minimum frame size in http2 spec
+	defaultWindowSize uint32        = 65535
+	maxWindowSize     uint32        = (1 << 31) - 1 // 2^31-1 = 2147483647, max window size specified in http2 spec
+	defaultTimeout    time.Duration = 5 * time.Second
+	defaultRetries    uint64        = 5

 	SettingMuxerMagic http2.SettingID = 0x42db
 	MuxerMagicOrigin  uint32          = 0xa2e43c8b
@@ -50,12 +49,6 @@ type MuxerConfig struct {
 	// Logger to use
 	Logger             *log.Entry
 	CompressionQuality CompressionSetting
-	// Initial size for HTTP2 flow control windows
-	DefaultWindowSize uint32
-	// Largest allowable size for HTTP2 flow control windows
-	MaxWindowSize uint32
-	// Largest allowable capacity for the buffer of data to be sent
-	StreamWriteBufferMaxLen int
 }

 type Muxer struct {
@@ -71,7 +64,7 @@ type Muxer struct {
 	// muxWriter is the write process.
 	muxWriter *MuxWriter
 	// muxMetricsUpdater is the process to update metrics
-	muxMetricsUpdater muxMetricsUpdater
+	muxMetricsUpdater *muxMetricsUpdater
 	// newStreamChan is used to create new streams on the writer thread.
 	// The writer will assign the next available stream ID.
 	newStreamChan chan MuxedStreamRequest
@@ -105,15 +98,6 @@ func Handshake(
 	if config.Timeout == 0 {
 		config.Timeout = defaultTimeout
 	}
-	if config.DefaultWindowSize == 0 {
-		config.DefaultWindowSize = defaultWindowSize
-	}
-	if config.MaxWindowSize == 0 {
-		config.MaxWindowSize = maxWindowSize
-	}
-	if config.StreamWriteBufferMaxLen == 0 {
-		config.StreamWriteBufferMaxLen = defaultWriteBufferMaxLen
-	}
 	// Initialise connection state fields
 	m := &Muxer{
 		f:             http2.NewFramer(w, r), // A framer that writes to w and reads from r
@@ -163,6 +147,11 @@ func Handshake(
 	// set up reader/writer pair ready for serve
 	streamErrors := NewStreamErrorMap()
 	goAwayChan := make(chan http2.ErrCode, 1)
+	updateRTTChan := make(chan *roundTripMeasurement, 1)
+	updateReceiveWindowChan := make(chan uint32, 1)
+	updateSendWindowChan := make(chan uint32, 1)
+	updateInBoundBytesChan := make(chan uint64)
+	updateOutBoundBytesChan := make(chan uint64)
 	inBoundCounter := NewAtomicCounter(0)
 	outBoundCounter := NewAtomicCounter(0)
 	pingTimestamp := NewPingTimestamp()
@@ -179,14 +168,6 @@ func Handshake(
 		config.Logger.Warn("Minimum number of unacked heartbeats to send before closing the connection has been adjusted to ", maxRetries)
 	}

-	compBytesBefore, compBytesAfter := NewAtomicCounter(0), NewAtomicCounter(0)
-
-	m.muxMetricsUpdater = newMuxMetricsUpdater(
-		m.abortChan,
-		compBytesBefore,
-		compBytesAfter,
-	)
-
 	m.explicitShutdown = NewBooleanFuse()
 	m.muxReader = &MuxReader{
 		f:                       m.f,
@@ -198,30 +179,47 @@ func Handshake(
 		abortChan:               m.abortChan,
 		pingTimestamp:           pingTimestamp,
 		connActive:              connActive,
-		initialStreamWindow:     m.config.DefaultWindowSize,
-		streamWindowMax:         m.config.MaxWindowSize,
-		streamWriteBufferMaxLen: m.config.StreamWriteBufferMaxLen,
-		r:              m.r,
-		metricsUpdater: m.muxMetricsUpdater,
-		bytesRead:      inBoundCounter,
+		initialStreamWindow:     defaultWindowSize,
+		streamWindowMax:         maxWindowSize,
+		r:                       m.r,
+		updateRTTChan:           updateRTTChan,
+		updateReceiveWindowChan: updateReceiveWindowChan,
+		updateSendWindowChan:    updateSendWindowChan,
+		bytesRead:               inBoundCounter,
+		updateInBoundBytesChan:  updateInBoundBytesChan,
 	}
 	m.muxWriter = &MuxWriter{
-		f:               m.f,
-		streams:         m.streams,
-		streamErrors:    streamErrors,
-		readyStreamChan: m.readyList.ReadyChannel(),
-		newStreamChan:   m.newStreamChan,
-		goAwayChan:      goAwayChan,
-		abortChan:       m.abortChan,
-		pingTimestamp:   pingTimestamp,
-		idleTimer:       NewIdleTimer(idleDuration, maxRetries),
-		connActiveChan:  connActive.WaitChannel(),
-		maxFrameSize:    defaultFrameSize,
-		metricsUpdater:  m.muxMetricsUpdater,
-		bytesWrote:      outBoundCounter,
+		f:                       m.f,
+		streams:                 m.streams,
+		streamErrors:            streamErrors,
+		readyStreamChan:         m.readyList.ReadyChannel(),
+		newStreamChan:           m.newStreamChan,
+		goAwayChan:              goAwayChan,
+		abortChan:               m.abortChan,
+		pingTimestamp:           pingTimestamp,
+		idleTimer:               NewIdleTimer(idleDuration, maxRetries),
+		connActiveChan:          connActive.WaitChannel(),
+		maxFrameSize:            defaultFrameSize,
+		updateReceiveWindowChan: updateReceiveWindowChan,
+		updateSendWindowChan:    updateSendWindowChan,
+		bytesWrote:              outBoundCounter,
+		updateOutBoundBytesChan: updateOutBoundBytesChan,
 	}
 	m.muxWriter.headerEncoder = hpack.NewEncoder(&m.muxWriter.headerBuffer)

+	compBytesBefore, compBytesAfter := NewAtomicCounter(0), NewAtomicCounter(0)
+
+	m.muxMetricsUpdater = newMuxMetricsUpdater(
+		updateRTTChan,
+		updateReceiveWindowChan,
+		updateSendWindowChan,
+		updateInBoundBytesChan,
+		updateOutBoundBytesChan,
+		m.abortChan,
+		compBytesBefore,
+		compBytesAfter,
+	)
+
 	if m.compressionQuality.dictSize > 0 && m.compressionQuality.nDicts > 0 {
 		nd, sz := m.compressionQuality.nDicts, m.compressionQuality.dictSize
 		writeDicts, dictChan := newH2WriteDictionaries(
@@ -307,12 +305,6 @@ func joinErrorsWithTimeout(errChan <-chan error, receiveCount int, timeout time.
 	return nil
 }

-// Serve runs the event loops that comprise h2mux:
-// - MuxReader.run()
-// - MuxWriter.run()
-// - muxMetricsUpdater.run()
-// In the normal case, Shutdown() is called concurrently with Serve() to stop
-// these loops.
 func (m *Muxer) Serve(ctx context.Context) error {
 	errGroup, _ := errgroup.WithContext(ctx)
 	errGroup.Go(func() error {
@@ -343,7 +335,6 @@ func (m *Muxer) Serve(ctx context.Context) error {
 	return nil
 }

-// Shutdown is called to initiate the "happy path" of muxer termination.
 func (m *Muxer) Shutdown() {
 	m.explicitShutdown.Fuse(true)
 	m.muxReader.Shutdown()
@@ -384,12 +375,10 @@ func (m *Muxer) OpenStream(headers []Header, body io.Reader) (*MuxedStream, erro
 		responseHeadersReceived: make(chan struct{}),
 		readBuffer:              NewSharedBuffer(),
 		writeBuffer:             &bytes.Buffer{},
-		writeBufferMaxLen:       m.config.StreamWriteBufferMaxLen,
-		writeBufferHasSpace:     make(chan struct{}, 1),
-		receiveWindow:           m.config.DefaultWindowSize,
-		receiveWindowCurrentMax: m.config.DefaultWindowSize,
-		receiveWindowMax:        m.config.MaxWindowSize,
-		sendWindow:              m.config.DefaultWindowSize,
+		receiveWindow:           defaultWindowSize,
+		receiveWindowCurrentMax: defaultWindowSize, // Initial window size limit. exponentially increase it when receiveWindow is exhausted
+		receiveWindowMax:        maxWindowSize,
+		sendWindow:              defaultWindowSize,
 		readyList:               m.readyList,
 		writeHeaders:            headers,
 		dictionaries:            m.muxReader.dictionaries,
@@ -410,13 +399,12 @@ func (m *Muxer) OpenStream(headers []Header, body io.Reader) (*MuxedStream, erro
 }

 func (m *Muxer) Metrics() *MuxerMetrics {
-	return m.muxMetricsUpdater.metrics()
+	return m.muxMetricsUpdater.Metrics()
 }

 func (m *Muxer) abort() {
 	m.abortOnce.Do(func() {
 		close(m.abortChan)
-		m.readyList.Close()
 		m.streams.Abort()
 	})
 }
@@ -39,26 +39,20 @@ func NewDefaultMuxerPair() *DefaultMuxerPair {
 	origin, edge := net.Pipe()
 	return &DefaultMuxerPair{
 		OriginMuxConfig: MuxerConfig{
-			Timeout:                 time.Second,
-			IsClient:                true,
-			Name:                    "origin",
-			Logger:                  log.NewEntry(log.New()),
-			DefaultWindowSize:       (1 << 8) - 1,
-			MaxWindowSize:           (1 << 15) - 1,
-			StreamWriteBufferMaxLen: 1024,
+			Timeout: time.Second,
+			IsClient: true,
+			Name: "origin",
+			Logger: log.NewEntry(log.New()),
 		},
-		OriginConn: origin,
-		EdgeMuxConfig: MuxerConfig{
-			Timeout:                 time.Second,
-			IsClient:                false,
-			Name:                    "edge",
-			Logger:                  log.NewEntry(log.New()),
-			DefaultWindowSize:       (1 << 8) - 1,
-			MaxWindowSize:           (1 << 15) - 1,
-			StreamWriteBufferMaxLen: 1024,
+		OriginConn:      origin,
+		EdgeMuxConfig:   MuxerConfig{
+			Timeout: time.Second,
+			IsClient: false,
+			Name: "edge",
+			Logger: log.NewEntry(log.New()),
 		},
-		EdgeConn: edge,
-		doneC:    make(chan struct{}),
+		EdgeConn:        edge,
+		doneC:           make(chan struct{}),
 	}
 }

@@ -66,22 +60,22 @@ func NewCompressedMuxerPair(quality CompressionSetting) *DefaultMuxerPair {
 	origin, edge := net.Pipe()
 	return &DefaultMuxerPair{
 		OriginMuxConfig: MuxerConfig{
-			Timeout:            time.Second,
-			IsClient:           true,
-			Name:               "origin",
+			Timeout: time.Second,
+			IsClient: true,
+			Name: "origin",
 			CompressionQuality: quality,
-			Logger:             log.NewEntry(log.New()),
+			Logger: log.NewEntry(log.New()),
 		},
-		OriginConn: origin,
-		EdgeMuxConfig: MuxerConfig{
-			Timeout:            time.Second,
-			IsClient:           false,
-			Name:               "edge",
+		OriginConn:      origin,
+		EdgeMuxConfig:   MuxerConfig{
+			Timeout: time.Second,
+			IsClient: false,
+			Name: "edge",
 			CompressionQuality: quality,
-			Logger:             log.NewEntry(log.New()),
+			Logger: log.NewEntry(log.New()),
 		},
-		EdgeConn: edge,
-		doneC:    make(chan struct{}),
+		EdgeConn:        edge,
+		doneC:           make(chan struct{}),
 	}
 }

@@ -236,6 +230,7 @@ func TestSingleStream(t *testing.T) {
 func TestSingleStreamLargeResponseBody(t *testing.T) {
 	muxPair := NewDefaultMuxerPair()
 	bodySize := 1 << 24
+	streamReady := make(chan struct{})
 	muxPair.OriginMuxConfig.Handler = MuxedStreamFunc(func(stream *MuxedStream) error {
 		if len(stream.Headers) != 1 {
 			t.Fatalf("expected %d headers, got %d", 1, len(stream.Headers))
@@ -262,6 +257,8 @@ func TestSingleStreamLargeResponseBody(t *testing.T) {
 		if n != len(payload) {
 			t.Fatalf("origin short write: %d/%d bytes", n, len(payload))
 		}
+		t.Log("Payload written; signaling that the stream is ready")
+		streamReady <- struct{}{}

 		return nil
 	})
@@ -285,6 +282,9 @@ func TestSingleStreamLargeResponseBody(t *testing.T) {
 	}
 	responseBody := make([]byte, bodySize)

+	<-streamReady
+	t.Log("Received stream ready signal; resuming the test")
+
 	n, err := io.ReadFull(stream, responseBody)
 	if err != nil {
 		t.Fatalf("error from (*MuxedStream).Read: %s", err)
@@ -367,13 +367,14 @@ func TestMultipleStreams(t *testing.T) {
 		log.Error(err)
 	}
 	if testFail {
-		t.Fatalf("TestMultipleStreams failed")
+		t.Fatalf("TestMultipleStreamsFlowControl failed")
 	}
 }

 func TestMultipleStreamsFlowControl(t *testing.T) {
 	maxStreams := 32
 	errorsC := make(chan error, maxStreams)
+	streamReady := make(chan struct{})
 	responseSizes := make([]int32, maxStreams)
 	for i := 0; i < maxStreams; i++ {
 		responseSizes[i] = rand.Int31n(int32(defaultWindowSize << 4))
@@ -397,6 +398,7 @@ func TestMultipleStreamsFlowControl(t *testing.T) {
 			payload[i] = byte(i % 256)
 		}
 		n, err := stream.Write(payload)
+		streamReady <- struct{}{}
 		if err != nil {
 			t.Fatalf("origin write error: %s", err)
 		}
@@ -433,6 +435,7 @@ func TestMultipleStreamsFlowControl(t *testing.T) {
 				return
 			}

+			<-streamReady
 			responseBody := make([]byte, responseSizes[(stream.streamID-2)/2])
 			n, err := io.ReadFull(stream, responseBody)
 			if err != nil {
@@ -779,11 +782,9 @@ func TestMultipleStreamsWithDictionaries(t *testing.T) {
 		}

 		wg.Add(len(paths))
-		errorsC := make(chan error, len(paths))

 		for i, s := range paths {
 			go func(i int, path string) {
-				defer wg.Done()
 				stream, err := muxPair.EdgeMux.OpenStream(
 					[]Header{
 						{Name: ":method", Value: "GET"},
@@ -804,33 +805,24 @@ func TestMultipleStreamsWithDictionaries(t *testing.T) {
 				responseBody := make([]byte, len(expectBody)*2)
 				n, err := stream.Read(responseBody)
 				if err != nil {
-					errorsC <- fmt.Errorf("stream %d error from (*MuxedStream).Read: %s", stream.streamID, err)
-					return
+					log.Printf("error from (*MuxedStream).Read: %s", err)
+					t.Fatalf("error from (*MuxedStream).Read: %s", err)
 				}
 				if n != len(expectBody) {
-					errorsC <- fmt.Errorf("stream %d expected response body to have %d bytes, got %d", stream.streamID, len(expectBody), n)
-					return
+					log.Printf("expected response body to have %d bytes, got %d", len(expectBody), n)
+					t.Fatalf("expected response body to have %d bytes, got %d", len(expectBody), n)
 				}
 				if string(responseBody[:n]) != expectBody {
-					errorsC <- fmt.Errorf("stream %d expected response body %s, got %s", stream.streamID, expectBody, responseBody[:n])
-					return
+					log.Printf("expected response body %s, got %s", expectBody, responseBody[:n])
+					t.Fatalf("expected response body %s, got %s", expectBody, responseBody[:n])
 				}
+				wg.Done()
 			}(i, s)
+			time.Sleep(1 * time.Millisecond)
 		}
-
 		wg.Wait()
-		close(errorsC)
-		testFail := false
-		for err := range errorsC {
-			testFail = true
-			log.Error(err)
-		}
-		if testFail {
-			t.Fatalf("TestMultipleStreams failed")
-		}

-		originMuxMetrics := muxPair.OriginMux.Metrics()
-		if q > CompressionNone && originMuxMetrics.CompBytesBefore.Value() <= 10*originMuxMetrics.CompBytesAfter.Value() {
+		if q > CompressionNone && muxPair.OriginMux.muxMetricsUpdater.compBytesBefore.Value() <= 10*muxPair.OriginMux.muxMetricsUpdater.compBytesAfter.Value() {
 			t.Fatalf("Cross-stream compression is expected to give a better compression ratio")
 		}
 	}
@@ -928,8 +920,7 @@ func TestSampleSiteWithDictionaries(t *testing.T) {
 		}
 		wg.Wait()

-		originMuxMetrics := muxPair.OriginMux.Metrics()
-		if q > CompressionNone && originMuxMetrics.CompBytesBefore.Value() <= 10*originMuxMetrics.CompBytesAfter.Value() {
+		if q > CompressionNone && muxPair.OriginMux.muxMetricsUpdater.compBytesBefore.Value() <= 10*muxPair.OriginMux.muxMetricsUpdater.compBytesAfter.Value() {
 			t.Fatalf("Cross-stream compression is expected to give a better compression ratio")
 		}
 	}
@@ -962,8 +953,7 @@ func TestLongSiteWithDictionaries(t *testing.T) {
 		}
 		wg.Wait()

-		originMuxMetrics := muxPair.OriginMux.Metrics()
-		if q > CompressionNone && originMuxMetrics.CompBytesBefore.Value() <= 100*originMuxMetrics.CompBytesAfter.Value() {
+		if q > CompressionNone && muxPair.OriginMux.muxMetricsUpdater.compBytesBefore.Value() <= 100*muxPair.OriginMux.muxMetricsUpdater.compBytesAfter.Value() {
 			t.Fatalf("Cross-stream compression is expected to give a better compression ratio")
 		}
 	}
@@ -17,51 +17,32 @@ type ReadWriteClosedCloser interface {
 	Closed() bool
 }

-// MuxedStream is logically an HTTP/2 stream, with an additional buffer for outgoing data.
 type MuxedStream struct {
+	Headers []Header
+
 	streamID uint32

-	// The "Receive" end of the stream
-	readBufferLock sync.RWMutex
-	readBuffer     ReadWriteClosedCloser
-	// This is the amount of bytes that are in our receive window
-	// (how much data we can receive into this stream).
-	receiveWindow uint32
-	// current receive window size limit. Exponentially increase it when it's exhausted
-	receiveWindowCurrentMax uint32
-	// hard limit set in http2 spec. 2^31-1
-	receiveWindowMax uint32
-	// The desired size increment for receiveWindow.
-	// If this is nonzero, a WINDOW_UPDATE frame needs to be sent.
-	windowUpdate uint32
-	// The headers that were most recently received.
-	// Particularly:
-	//     * for an eyeball-initiated stream (as passed to TunnelHandler::ServeStream),
-	//       these are the request headers
-	//     * for a cloudflared-initiated stream (as created by Register/UnregisterTunnel),
-	//       these are the response headers.
-	// They are useful in both of these contexts; hence `Headers` is public.
-	Headers []Header
-	// For use in the context of a cloudflared-initiated stream.
 	responseHeadersReceived chan struct{}

-	// The "Send" end of the stream
-	writeLock   sync.Mutex
+	readBuffer    ReadWriteClosedCloser
+	receiveWindow uint32
+	// current window size limit. Exponentially increase it when it's exhausted
+	receiveWindowCurrentMax uint32
+	// limit set in http2 spec. 2^31-1
+	receiveWindowMax uint32
+
+	// nonzero if a WINDOW_UPDATE frame for a stream needs to be sent
+	windowUpdate uint32
+
+	writeLock sync.Mutex
+	// The zero value for Buffer is an empty buffer ready to use.
 	writeBuffer ReadWriteLengther
-	// The maximum capacity that the send buffer should grow to.
-	writeBufferMaxLen int
-	// A channel to be notified when the send buffer is not full.
-	writeBufferHasSpace chan struct{}
-	// This is the amount of bytes that are in the peer's receive window
-	// (how much data we can send from this stream).
+
 	sendWindow uint32
-	// Reference to the muxer's readyList; signal this for stream data to be sent.
-	readyList *ReadyList
-	// The headers that should be sent, and a flag so we only send them once.
+
+	readyList    *ReadyList
 	headersSent  bool
 	writeHeaders []Header
-
-	// EOF-related fields
 	// true if the write end of this stream has been closed
 	writeEOF bool
 	// true if we have sent EOF to the peer
@@ -69,63 +50,40 @@ type MuxedStream struct {
 	// true if the peer sent us an EOF
 	receivedEOF bool

-	// Compression-related fields
+	// dictionary that was used to compress the stream
 	receivedUseDict bool
 	method          string
 	contentType     string
 	path            string
 	dictionaries    h2Dictionaries
+	readBufferLock  sync.RWMutex
 }

 func (s *MuxedStream) Read(p []byte) (n int, err error) {
-	var readBuffer ReadWriteClosedCloser
 	if s.dictionaries.read != nil {
 		s.readBufferLock.RLock()
-		readBuffer = s.readBuffer
+		b := s.readBuffer
 		s.readBufferLock.RUnlock()
-	} else {
-		readBuffer = s.readBuffer
+		return b.Read(p)
 	}
-	n, err = readBuffer.Read(p)
-	s.replenishReceiveWindow(uint32(n))
-	return
+	return s.readBuffer.Read(p)
 }

-// Blocks until len(p) bytes have been written to the buffer
-func (s *MuxedStream) Write(p []byte) (int, error) {
-	// If assignDictToStream returns success, then it will have acquired the
-	// writeLock. Otherwise we must acquire it ourselves.
+func (s *MuxedStream) Write(p []byte) (n int, err error) {
 	ok := assignDictToStream(s, p)
 	if !ok {
 		s.writeLock.Lock()
 	}
 	defer s.writeLock.Unlock()
-
 	if s.writeEOF {
 		return 0, io.EOF
 	}
-	totalWritten := 0
-	for totalWritten < len(p) {
-		// If the buffer is full, block till there is more room.
-		// Use a loop to recheck the buffer size after the lock is reacquired.
-		for s.writeBufferMaxLen <= s.writeBuffer.Len() {
-			s.writeLock.Unlock()
-			<-s.writeBufferHasSpace
-			s.writeLock.Lock()
-		}
-		amountToWrite := len(p) - totalWritten
-		spaceAvailable := s.writeBufferMaxLen - s.writeBuffer.Len()
-		if spaceAvailable < amountToWrite {
-			amountToWrite = spaceAvailable
-		}
-		amountWritten, err := s.writeBuffer.Write(p[totalWritten : totalWritten+amountToWrite])
-		totalWritten += amountWritten
-		if err != nil {
-			return totalWritten, err
-		}
-		s.writeNotify()
+	n, err = s.writeBuffer.Write(p)
+	if n != len(p) || err != nil {
+		return n, err
 	}
-	return totalWritten, nil
+	s.writeNotify()
+	return n, nil
 }

 func (s *MuxedStream) Close() error {
@@ -206,9 +164,9 @@ func (s *MuxedStream) writeNotify() {
 // receive window (how much data we can send).
 func (s *MuxedStream) replenishSendWindow(bytes uint32) {
 	s.writeLock.Lock()
-	defer s.writeLock.Unlock()
 	s.sendWindow += bytes
 	s.writeNotify()
+	s.writeLock.Unlock()
 }

 // Call by muxreader when it receives a data frame
@@ -220,30 +178,17 @@ func (s *MuxedStream) consumeReceiveWindow(bytes uint32) bool {
 		return false
 	}
 	s.receiveWindow -= bytes
-	if s.receiveWindow < s.receiveWindowCurrentMax/2 && s.receiveWindowCurrentMax < s.receiveWindowMax {
+	if s.receiveWindow < s.receiveWindowCurrentMax/2 {
 		// exhausting client send window (how much data client can send)
-		// and there is room to grow the receive window
-		newMax := s.receiveWindowCurrentMax << 1
-		if newMax > s.receiveWindowMax {
-			newMax = s.receiveWindowMax
+		if s.receiveWindowCurrentMax < s.receiveWindowMax {
+			s.receiveWindowCurrentMax <<= 1
 		}
-		s.windowUpdate += newMax - s.receiveWindowCurrentMax
-		s.receiveWindowCurrentMax = newMax
-		// notify MuxWriter to write WINDOW_UPDATE frame
+		s.windowUpdate += s.receiveWindowCurrentMax - s.receiveWindow
 		s.writeNotify()
 	}
 	return true
 }

-// Arranges for the MuxWriter to send a WINDOW_UPDATE
-// Called by MuxedStream::Read when data has left the read buffer.
-func (s *MuxedStream) replenishReceiveWindow(bytes uint32) {
-	s.writeLock.Lock()
-	defer s.writeLock.Unlock()
-	s.windowUpdate += bytes
-	s.writeNotify()
-}
-
 // receiveEOF should be called when the peer indicates no more data will be sent.
 // Returns true if the socket is now closed (i.e. the write side is already closed).
 func (s *MuxedStream) receiveEOF() (closed bool) {
@@ -281,8 +226,7 @@ type streamChunk struct {
 	// true if a HEADERS frame should be sent
 	sendHeaders bool
 	headers     []Header
-	// nonzero if a WINDOW_UPDATE frame should be sent;
-	// in that case, it is the increment value to use
+	// nonzero if a WINDOW_UPDATE frame should be sent
 	windowUpdate uint32
 	// true if data frames should be sent
 	sendData bool
@@ -305,23 +249,11 @@ func (s *MuxedStream) getChunk() *streamChunk {
 		eof:          s.writeEOF && uint32(s.writeBuffer.Len()) <= s.sendWindow,
 	}

-	// Copy at most s.sendWindow bytes, adjust the sendWindow accordingly
+	// Copies at most s.sendWindow bytes
 	writeLen, _ := io.CopyN(&chunk.buffer, s.writeBuffer, int64(s.sendWindow))
 	s.sendWindow -= uint32(writeLen)
-
-	// Non-blocking channel send. This will allow MuxedStream::Write() to continue, if needed
-	if s.writeBuffer.Len() < s.writeBufferMaxLen {
-		select {
-		case s.writeBufferHasSpace <- struct{}{}:
-		default:
-		}
-	}
-
-	// When we write the chunk, we'll write the WINDOW_UPDATE frame if needed
 	s.receiveWindow += s.windowUpdate
 	s.windowUpdate = 0
-
-	// When we write the chunk, we'll write the headers if needed
 	s.headersSent = true

 	// if this chunk contains the end of the stream, close the stream now
@@ -23,55 +23,47 @@ func TestFlowControlSingleStream(t *testing.T) {
 		sendWindow:              testWindowSize,
 		readyList:               NewReadyList(),
 	}
-	var tempWindowUpdate uint32
-	var tempStreamChunk *streamChunk
-
 	assert.True(t, stream.consumeReceiveWindow(testWindowSize/2))
 	dataSent := testWindowSize / 2
 	assert.Equal(t, testWindowSize-dataSent, stream.receiveWindow)
 	assert.Equal(t, testWindowSize, stream.receiveWindowCurrentMax)
-	assert.Equal(t, testWindowSize, stream.sendWindow)
 	assert.Equal(t, uint32(0), stream.windowUpdate)
+	tempWindowUpdate := stream.windowUpdate

-	tempStreamChunk = stream.getChunk()
-	assert.Equal(t, uint32(0), tempStreamChunk.windowUpdate)
+	streamChunk := stream.getChunk()
+	assert.Equal(t, tempWindowUpdate, streamChunk.windowUpdate)
 	assert.Equal(t, testWindowSize-dataSent, stream.receiveWindow)
-	assert.Equal(t, testWindowSize, stream.receiveWindowCurrentMax)
-	assert.Equal(t, testWindowSize, stream.sendWindow)
 	assert.Equal(t, uint32(0), stream.windowUpdate)
+	assert.Equal(t, testWindowSize, stream.sendWindow)

 	assert.True(t, stream.consumeReceiveWindow(2))
 	dataSent += 2
 	assert.Equal(t, testWindowSize-dataSent, stream.receiveWindow)
 	assert.Equal(t, testWindowSize<<1, stream.receiveWindowCurrentMax)
-	assert.Equal(t, testWindowSize, stream.sendWindow)
-	assert.Equal(t, testWindowSize, stream.windowUpdate)
+	assert.Equal(t, (testWindowSize<<1)-stream.receiveWindow, stream.windowUpdate)
 	tempWindowUpdate = stream.windowUpdate

-	tempStreamChunk = stream.getChunk()
-	assert.Equal(t, tempWindowUpdate, tempStreamChunk.windowUpdate)
-	assert.Equal(t, (testWindowSize<<1)-dataSent, stream.receiveWindow)
-	assert.Equal(t, testWindowSize<<1, stream.receiveWindowCurrentMax)
-	assert.Equal(t, testWindowSize, stream.sendWindow)
+	streamChunk = stream.getChunk()
+	assert.Equal(t, tempWindowUpdate, streamChunk.windowUpdate)
+	assert.Equal(t, testWindowSize<<1, stream.receiveWindow)
 	assert.Equal(t, uint32(0), stream.windowUpdate)
+	assert.Equal(t, testWindowSize, stream.sendWindow)

 	assert.True(t, stream.consumeReceiveWindow(testWindowSize+10))
-	dataSent += testWindowSize + 10
+	dataSent = testWindowSize + 10
 	assert.Equal(t, (testWindowSize<<1)-dataSent, stream.receiveWindow)
 	assert.Equal(t, testWindowSize<<2, stream.receiveWindowCurrentMax)
-	assert.Equal(t, testWindowSize, stream.sendWindow)
-	assert.Equal(t, testWindowSize<<1, stream.windowUpdate)
+	assert.Equal(t, (testWindowSize<<2)-stream.receiveWindow, stream.windowUpdate)
 	tempWindowUpdate = stream.windowUpdate

-	tempStreamChunk = stream.getChunk()
-	assert.Equal(t, tempWindowUpdate, tempStreamChunk.windowUpdate)
-	assert.Equal(t, (testWindowSize<<2)-dataSent, stream.receiveWindow)
-	assert.Equal(t, testWindowSize<<2, stream.receiveWindowCurrentMax)
-	assert.Equal(t, testWindowSize, stream.sendWindow)
+	streamChunk = stream.getChunk()
+	assert.Equal(t, tempWindowUpdate, streamChunk.windowUpdate)
+	assert.Equal(t, testWindowSize<<2, stream.receiveWindow)
 	assert.Equal(t, uint32(0), stream.windowUpdate)
+	assert.Equal(t, testWindowSize, stream.sendWindow)

 	assert.False(t, stream.consumeReceiveWindow(testMaxWindowSize+1))
-	assert.Equal(t, (testWindowSize<<2)-dataSent, stream.receiveWindow)
+	assert.Equal(t, testWindowSize<<2, stream.receiveWindow)
 	assert.Equal(t, testMaxWindowSize, stream.receiveWindowCurrentMax)
 }

@@ -17,24 +17,7 @@ const (
 	updateFreq = time.Second
 )

-type muxMetricsUpdater interface {
-	// metrics returns the latest metrics
-	metrics() *MuxerMetrics
-	// run is a blocking call to start the event loop
-	run(logger *log.Entry) error
-	// updateRTTChan is called by muxReader to report new RTT measurements
-	updateRTT(rtt *roundTripMeasurement)
-	//updateReceiveWindowChan is called by muxReader and muxWriter when receiveWindow size is updated
-	updateReceiveWindow(receiveWindow uint32)
-	//updateSendWindowChan is called by muxReader and muxWriter when sendWindow size is updated
-	updateSendWindow(sendWindow uint32)
-	// updateInBoundBytesChan is called  periodicallyby muxReader to report bytesRead
-	updateInBoundBytes(inBoundBytes uint64)
-	// updateOutBoundBytesChan is called periodically by muxWriter to report bytesWrote
-	updateOutBoundBytes(outBoundBytes uint64)
-}
-
-type muxMetricsUpdaterImpl struct {
+type muxMetricsUpdater struct {
 	// rttData keeps record of rtt, rttMin, rttMax and last measured time
 	rttData *rttData
 	// receiveWindowData keeps record of receive window measurement
@@ -45,16 +28,16 @@ type muxMetricsUpdaterImpl struct {
 	inBoundRate *rate
 	// outBoundRate is outgoing bytes/sec
 	outBoundRate *rate
-	// updateRTTChan is the channel to receive new RTT measurement
-	updateRTTChan chan *roundTripMeasurement
-	//updateReceiveWindowChan is the channel to receive updated receiveWindow size
-	updateReceiveWindowChan chan uint32
-	//updateSendWindowChan is the channel to receive updated sendWindow size
-	updateSendWindowChan chan uint32
-	// updateInBoundBytesChan us the channel to receive bytesRead
-	updateInBoundBytesChan chan uint64
-	// updateOutBoundBytesChan us the channel to receive bytesWrote
-	updateOutBoundBytesChan chan uint64
+	// updateRTTChan is the channel to receive new RTT measurement from muxReader
+	updateRTTChan <-chan *roundTripMeasurement
+	//updateReceiveWindowChan is the channel to receive updated receiveWindow size from muxReader and muxWriter
+	updateReceiveWindowChan <-chan uint32
+	//updateSendWindowChan is the channel to receive updated sendWindow size from muxReader and muxWriter
+	updateSendWindowChan <-chan uint32
+	// updateInBoundBytesChan us the channel to receive bytesRead from muxReader
+	updateInBoundBytesChan <-chan uint64
+	// updateOutBoundBytesChan us the channel to receive bytesWrote from muxWriter
+	updateOutBoundBytesChan <-chan uint64
 	// shutdownC is to signal the muxerMetricsUpdater to shutdown
 	abortChan <-chan struct{}

@@ -101,16 +84,15 @@ type rate struct {
 }

 func newMuxMetricsUpdater(
+	updateRTTChan <-chan *roundTripMeasurement,
+	updateReceiveWindowChan <-chan uint32,
+	updateSendWindowChan <-chan uint32,
+	updateInBoundBytesChan <-chan uint64,
+	updateOutBoundBytesChan <-chan uint64,
 	abortChan <-chan struct{},
 	compBytesBefore, compBytesAfter *AtomicCounter,
-) muxMetricsUpdater {
-	updateRTTChan := make(chan *roundTripMeasurement, 1)
-	updateReceiveWindowChan := make(chan uint32, 1)
-	updateSendWindowChan := make(chan uint32, 1)
-	updateInBoundBytesChan := make(chan uint64)
-	updateOutBoundBytesChan := make(chan uint64)
-
-	return &muxMetricsUpdaterImpl{
+) *muxMetricsUpdater {
+	return &muxMetricsUpdater{
 		rttData:                 newRTTData(),
 		receiveWindowData:       newFlowControlData(),
 		sendWindowData:          newFlowControlData(),
@@ -127,7 +109,7 @@ func newMuxMetricsUpdater(
 	}
 }

-func (updater *muxMetricsUpdaterImpl) metrics() *MuxerMetrics {
+func (updater *muxMetricsUpdater) Metrics() *MuxerMetrics {
 	m := &MuxerMetrics{}
 	m.RTT, m.RTTMin, m.RTTMax = updater.rttData.metrics()
 	m.ReceiveWindowAve, m.ReceiveWindowMin, m.ReceiveWindowMax = updater.receiveWindowData.metrics()
@@ -138,7 +120,7 @@ func (updater *muxMetricsUpdaterImpl) metrics() *MuxerMetrics {
 	return m
 }

-func (updater *muxMetricsUpdaterImpl) run(parentLogger *log.Entry) error {
+func (updater *muxMetricsUpdater) run(parentLogger *log.Entry) error {
 	logger := parentLogger.WithFields(log.Fields{
 		"subsystem": "mux",
 		"dir":       "metrics",
@@ -170,43 +152,6 @@ func (updater *muxMetricsUpdaterImpl) run(parentLogger *log.Entry) error {
 	}
 }

-func (updater *muxMetricsUpdaterImpl) updateRTT(rtt *roundTripMeasurement) {
-	select {
-	case updater.updateRTTChan <- rtt:
-	case <-updater.abortChan:
-	}
-
-}
-
-func (updater *muxMetricsUpdaterImpl) updateReceiveWindow(receiveWindow uint32) {
-	select {
-	case updater.updateReceiveWindowChan <- receiveWindow:
-	case <-updater.abortChan:
-	}
-}
-
-func (updater *muxMetricsUpdaterImpl) updateSendWindow(sendWindow uint32) {
-	select {
-	case updater.updateSendWindowChan <- sendWindow:
-	case <-updater.abortChan:
-	}
-}
-
-func (updater *muxMetricsUpdaterImpl) updateInBoundBytes(inBoundBytes uint64) {
-	select {
-	case updater.updateInBoundBytesChan <- inBoundBytes:
-	case <-updater.abortChan:
-	}
-
-}
-
-func (updater *muxMetricsUpdaterImpl) updateOutBoundBytes(outBoundBytes uint64) {
-	select {
-	case updater.updateOutBoundBytesChan <- outBoundBytes:
-	case <-updater.abortChan:
-	}
-}
-
 func newRTTData() *rttData {
 	return &rttData{}
 }
@@ -86,11 +86,24 @@ func TestFlowControlDataUpdate(t *testing.T) {
 }

 func TestMuxMetricsUpdater(t *testing.T) {
-	t.Skip("Inherently racy test due to muxMetricsUpdaterImpl.run()")
-	errChan := make(chan error)
+	t.Skip("Race condition")
+	updateRTTChan := make(chan *roundTripMeasurement)
+	updateReceiveWindowChan := make(chan uint32)
+	updateSendWindowChan := make(chan uint32)
+	updateInBoundBytesChan := make(chan uint64)
+	updateOutBoundBytesChan := make(chan uint64)
 	abortChan := make(chan struct{})
+	errChan := make(chan error)
 	compBefore, compAfter := NewAtomicCounter(0), NewAtomicCounter(0)
-	m := newMuxMetricsUpdater(abortChan, compBefore, compAfter)
+	m := newMuxMetricsUpdater(updateRTTChan,
+		updateReceiveWindowChan,
+		updateSendWindowChan,
+		updateInBoundBytesChan,
+		updateOutBoundBytesChan,
+		abortChan,
+		compBefore,
+		compAfter,
+	)
 	logger := log.NewEntry(log.New())

 	go func() {
@@ -103,44 +116,42 @@ func TestMuxMetricsUpdater(t *testing.T) {
 	// mock muxReader
 	readerStart := time.Now()
 	rm := &roundTripMeasurement{receiveTime: readerStart, sendTime: readerStart}
-	m.updateRTT(rm)
+	updateRTTChan <- rm
 	go func() {
 		defer wg.Done()
-		assert.Equal(t, 0, dataPoints%4,
-			"dataPoints is not divisible by 4; this test should be adjusted accordingly")
+		// Becareful if dataPoints is not divisibile by 4
 		readerSend := readerStart.Add(time.Millisecond)
 		for i := 1; i <= dataPoints/4; i++ {
 			readerReceive := readerSend.Add(time.Duration(i) * time.Millisecond)
 			rm := &roundTripMeasurement{receiveTime: readerReceive, sendTime: readerSend}
-			m.updateRTT(rm)
+			updateRTTChan <- rm
 			readerSend = readerReceive.Add(time.Millisecond)
-			m.updateReceiveWindow(uint32(i))
-			m.updateSendWindow(uint32(i))

-			m.updateInBoundBytes(uint64(i))
+			updateReceiveWindowChan <- uint32(i)
+			updateSendWindowChan <- uint32(i)
+
+			updateInBoundBytesChan <- uint64(i)
 		}
 	}()

 	// mock muxWriter
 	go func() {
 		defer wg.Done()
-		assert.Equal(t, 0, dataPoints%4,
-			"dataPoints is not divisible by 4; this test should be adjusted accordingly")
 		for j := dataPoints/4 + 1; j <= dataPoints/2; j++ {
-			m.updateReceiveWindow(uint32(j))
-			m.updateSendWindow(uint32(j))
+			updateReceiveWindowChan <- uint32(j)
+			updateSendWindowChan <- uint32(j)

-			// should always be disgarded since the send time is before readerSend
+			// should always be disgard since the send time is before readerSend
 			rm := &roundTripMeasurement{receiveTime: readerStart, sendTime: readerStart.Add(-time.Duration(j*dataPoints) * time.Millisecond)}
-			m.updateRTT(rm)
+			updateRTTChan <- rm

-			m.updateOutBoundBytes(uint64(j))
+			updateOutBoundBytesChan <- uint64(j)
 		}

 	}()
 	wg.Wait()

-	metrics := m.metrics()
+	metrics := m.Metrics()
 	points := dataPoints / 2
 	assert.Equal(t, time.Millisecond, metrics.RTTMin)
 	assert.Equal(t, time.Duration(dataPoints/4)*time.Millisecond, metrics.RTTMax)
@@ -35,14 +35,18 @@ type MuxReader struct {
 	initialStreamWindow uint32
 	// The max value for the send window of a stream.
 	streamWindowMax uint32
-	// The max size for the write buffer of a stream
-	streamWriteBufferMaxLen int
 	// r is a reference to the underlying connection used when shutting down.
 	r io.Closer
-	// metricsUpdater is used to report metrics
-	metricsUpdater muxMetricsUpdater
-	// bytesRead is the amount of bytes read from data frames since the last time we called metricsUpdater.updateInBoundBytes()
+	// updateRTTChan is the channel to send new RTT measurement to muxerMetricsUpdater
+	updateRTTChan chan<- *roundTripMeasurement
+	// updateReceiveWindowChan is the channel to update receiveWindow size to muxerMetricsUpdater
+	updateReceiveWindowChan chan<- uint32
+	// updateSendWindowChan is the channel to update sendWindow size to muxerMetricsUpdater
+	updateSendWindowChan chan<- uint32
+	// bytesRead is the amount of bytes read from data frame since the last time we send bytes read to metrics
 	bytesRead *AtomicCounter
+	// updateOutBoundBytesChan is the channel to send bytesWrote to muxerMetricsUpdater
+	updateInBoundBytesChan chan<- uint64
 	// dictionaries holds the h2 cross-stream compression dictionaries
 	dictionaries h2Dictionaries
 }
@@ -75,7 +79,7 @@ func (r *MuxReader) run(parentLogger *log.Entry) error {
 			case <-r.abortChan:
 				return
 			case <-tickC:
-				r.metricsUpdater.updateInBoundBytes(r.bytesRead.Count())
+				r.updateInBoundBytesChan <- r.bytesRead.Count()
 			}
 		}
 	}()
@@ -149,8 +153,6 @@ func (r *MuxReader) newMuxedStream(streamID uint32) *MuxedStream {
 		streamID:                streamID,
 		readBuffer:              NewSharedBuffer(),
 		writeBuffer:             &bytes.Buffer{},
-		writeBufferMaxLen:       r.streamWriteBufferMaxLen,
-		writeBufferHasSpace:     make(chan struct{}, 1),
 		receiveWindow:           r.initialStreamWindow,
 		receiveWindowCurrentMax: r.initialStreamWindow,
 		receiveWindowMax:        r.streamWindowMax,
@@ -283,7 +285,7 @@ func (r *MuxReader) receiveFrameData(frame *http2.DataFrame, parentLogger *log.E
 	if !stream.consumeReceiveWindow(uint32(len(data))) {
 		return r.streamError(stream.streamID, http2.ErrCodeFlowControl)
 	}
-	r.metricsUpdater.updateReceiveWindow(stream.getReceiveWindow())
+	r.updateReceiveWindowChan <- stream.getReceiveWindow()
 	return nil
 }

@@ -295,13 +297,13 @@ func (r *MuxReader) receivePingData(frame *http2.PingFrame) {
 		return
 	}

-	// Update the computed RTT aggregations with a new measurement.
-	// `ts` is the time that the probe was sent.
-	// We assume that `time.Now()` is the time we received that probe.
-	r.metricsUpdater.updateRTT(&roundTripMeasurement{
+	// Update updates the computed values with a new measurement.
+	// outgoingTime is the time that the probe was sent.
+	// We assume that time.Now() is the time we received that probe.
+	r.updateRTTChan <- &roundTripMeasurement{
 		receiveTime: time.Now(),
 		sendTime:    time.Unix(0, ts),
-	})
+	}
 }

 // Receive a GOAWAY from the peer. Gracefully shut down our connection.
@@ -462,7 +464,7 @@ func (r *MuxReader) updateStreamWindow(frame *http2.WindowUpdateFrame) error {
 		return nil
 	}
 	stream.replenishSendWindow(frame.Increment)
-	r.metricsUpdater.updateSendWindow(stream.getSendWindow())
+	r.updateSendWindowChan <- stream.getSendWindow()
 	return nil
 }

@@ -40,11 +40,14 @@ type MuxWriter struct {
 	headerEncoder *hpack.Encoder
 	// headerBuffer is the temporary buffer used by headerEncoder.
 	headerBuffer bytes.Buffer
-
-	// metricsUpdater is used to report metrics
-	metricsUpdater muxMetricsUpdater
-	// bytesWrote is the amount of bytes written to data frames since the last time we called metricsUpdater.updateOutBoundBytes()
+	// updateReceiveWindowChan is the channel to update receiveWindow size to muxerMetricsUpdater
+	updateReceiveWindowChan chan<- uint32
+	// updateSendWindowChan is the channel to update sendWindow size to muxerMetricsUpdater
+	updateSendWindowChan chan<- uint32
+	// bytesWrote is the amount of bytes wrote to data frame since the last time we send bytes wrote to metrics
 	bytesWrote *AtomicCounter
+	// updateOutBoundBytesChan is the channel to send bytesWrote to muxerMetricsUpdater
+	updateOutBoundBytesChan chan<- uint64

 	useDictChan <-chan useDictRequest
 }
@@ -80,7 +83,7 @@ func (w *MuxWriter) run(parentLogger *log.Entry) error {
 			case <-w.abortChan:
 				return
 			case <-tickC:
-				w.metricsUpdater.updateOutBoundBytes(w.bytesWrote.Count())
+				w.updateOutBoundBytesChan <- w.bytesWrote.Count()
 			}
 		}
 	}()
@@ -169,8 +172,8 @@ func (w *MuxWriter) run(parentLogger *log.Entry) error {
 func (w *MuxWriter) writeStreamData(stream *MuxedStream, logger *log.Entry) error {
 	logger.Debug("writable")
 	chunk := stream.getChunk()
-	w.metricsUpdater.updateReceiveWindow(stream.getReceiveWindow())
-	w.metricsUpdater.updateSendWindow(stream.getSendWindow())
+	w.updateReceiveWindowChan <- stream.getReceiveWindow()
+	w.updateSendWindowChan <- stream.getSendWindow()
 	if chunk.sendHeadersFrame() {
 		err := w.writeHeaders(chunk.streamID, chunk.headers)
 		if err != nil {
@@ -1,23 +1,15 @@
 package h2mux

-import "sync"
-
 // ReadyList multiplexes several event signals onto a single channel.
 type ReadyList struct {
-	// signalC is used to signal that a stream can be enqueued
 	signalC chan uint32
-	// waitC is used to signal the ID of the first ready descriptor
-	waitC chan uint32
-	// doneC is used to signal that run should terminate
-	doneC     chan struct{}
-	closeOnce sync.Once
+	waitC   chan uint32
 }

 func NewReadyList() *ReadyList {
 	rl := &ReadyList{
 		signalC: make(chan uint32),
 		waitC:   make(chan uint32),
-		doneC:   make(chan struct{}),
 	}
 	go rl.run()
 	return rl
@@ -25,11 +17,7 @@ func NewReadyList() *ReadyList {

 // ID is the stream ID
 func (r *ReadyList) Signal(ID uint32) {
-	select {
-	case r.signalC <- ID:
-	// ReadyList already closed
-	case <-r.doneC:
-	}
+	r.signalC <- ID
 }

 func (r *ReadyList) ReadyChannel() <-chan uint32 {
@@ -37,9 +25,7 @@ func (r *ReadyList) ReadyChannel() <-chan uint32 {
 }

 func (r *ReadyList) Close() {
-	r.closeOnce.Do(func() {
-		close(r.doneC)
-	})
+	close(r.signalC)
 }

 func (r *ReadyList) run() {
@@ -49,25 +35,28 @@ func (r *ReadyList) run() {
 	activeDescriptors := newReadyDescriptorMap()
 	for {
 		if firstReady == nil {
-			select {
-			case i := <-r.signalC:
-				firstReady = activeDescriptors.SetIfMissing(i)
-			case <-r.doneC:
+			// Wait for first ready descriptor
+			i, ok := <-r.signalC
+			if !ok {
+				// closed
 				return
 			}
+			firstReady = activeDescriptors.SetIfMissing(i)
 		}
 		select {
 		case r.waitC <- firstReady.ID:
 			activeDescriptors.Delete(firstReady.ID)
 			firstReady = queue.Dequeue()
-		case i := <-r.signalC:
+		case i, ok := <-r.signalC:
+			if !ok {
+				// closed
+				return
+			}
 			newReady := activeDescriptors.SetIfMissing(i)
 			if newReady != nil {
 				// key doesn't exist
 				queue.Enqueue(newReady)
 			}
-		case <-r.doneC:
-			return
 		}
 	}
 }
@@ -3,59 +3,36 @@ package h2mux
 import (
 	"testing"
 	"time"
-
-	"github.com/stretchr/testify/assert"
 )

-func assertEmpty(t *testing.T, rl *ReadyList) {
-	select {
-	case <-rl.ReadyChannel():
-		t.Fatal("Spurious wakeup")
-	default:
-	}
-}
-
-func assertClosed(t *testing.T, rl *ReadyList) {
-	select {
-	case _, ok := <-rl.ReadyChannel():
-		assert.False(t, ok, "ReadyChannel was not closed")
-	case <-time.After(100 * time.Millisecond):
-		t.Fatalf("Timeout")
-	}
-}
-
-func receiveWithTimeout(t *testing.T, rl *ReadyList) uint32 {
-	select {
-	case i := <-rl.ReadyChannel():
-		return i
-	case <-time.After(100 * time.Millisecond):
-		t.Fatalf("Timeout")
-		return 0
-	}
-}
-
-func TestReadyListEmpty(t *testing.T) {
+func TestReadyList(t *testing.T) {
 	rl := NewReadyList()
-
+	c := rl.ReadyChannel()
+	// helper functions
+	assertEmpty := func() {
+		select {
+		case <-c:
+			t.Fatalf("Spurious wakeup")
+		default:
+		}
+	}
+	receiveWithTimeout := func() uint32 {
+		select {
+		case i := <-c:
+			return i
+		case <-time.After(100 * time.Millisecond):
+			t.Fatalf("Timeout")
+			return 0
+		}
+	}
 	// no signals, receive should fail
-	assertEmpty(t, rl)
-}
-func TestReadyListSignal(t *testing.T) {
-	rl := NewReadyList()
-	assertEmpty(t, rl)
-
+	assertEmpty()
 	rl.Signal(0)
-	if receiveWithTimeout(t, rl) != 0 {
+	if receiveWithTimeout() != 0 {
 		t.Fatalf("Received wrong ID of signalled event")
 	}
-
-	assertEmpty(t, rl)
-}
-
-func TestReadyListMultipleSignals(t *testing.T) {
-	rl := NewReadyList()
-	assertEmpty(t, rl)
-
+	// no new signals, receive should fail
+	assertEmpty()
 	// Signals should not block;
 	// Duplicate unhandled signals should not cause multiple wakeups
 	signalled := [5]bool{}
@@ -65,45 +42,12 @@ func TestReadyListMultipleSignals(t *testing.T) {
 	}
 	// All signals should be received once (in any order)
 	for range signalled {
-		i := receiveWithTimeout(t, rl)
+		i := receiveWithTimeout()
 		if signalled[i] {
 			t.Fatalf("Received signal %d more than once", i)
 		}
 		signalled[i] = true
 	}
-	for i := range signalled {
-		if !signalled[i] {
-			t.Fatalf("Never received signal %d", i)
-		}
-	}
-	assertEmpty(t, rl)
-}
-
-func TestReadyListClose(t *testing.T) {
-	rl := NewReadyList()
-	rl.Close()
-
-	// readyList.run() occurs in a separate goroutine,
-	// so there's no way to directly check that run() has terminated.
-	// Perform an indirect check: is the ready channel closed?
-	assertClosed(t, rl)
-
-	// a second rl.Close() shouldn't cause a panic
-	rl.Close()
-
-	// Signal shouldn't block after Close()
-	done := make(chan struct{})
-	go func() {
-		for i := 0; i < 5; i++ {
-			rl.Signal(uint32(i))
-		}
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("Test timed out")
-	}
 }

 func TestReadyDescriptorQueue(t *testing.T) {
@@ -43,7 +43,7 @@ const indexTemplate = `
    <meta name="description" content="Argo Tunnel Connection">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <style>
-      html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}section{display:block}h1{font-size:2em;margin:.67em 0}a{background-color:transparent;-webkit-text-decoration-skip:objects}/* 1 */::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}/* 1 */a,body,dd,div,dl,dt,h1,h4,html,p,section{box-sizing:border-box}.bt{border-top-style:solid;border-top-width:1px}.bl{border-left-style:solid;border-left-width:1px}.b--orange{border-color:#f38020}.br1{border-radius:.125rem}.bw2{border-width:.25rem}.dib{display:inline-block}.sans-serif{font-family:open sans,-apple-system,BlinkMacSystemFont,avenir next,avenir,helvetica neue,helvetica,ubuntu,roboto,noto,segoe ui,arial,sans-serif}.overflow-x-auto{overflow-x:auto}.code{font-family:Consolas,monaco,monospace}.b{font-weight:700}.fw3{font-weight:300}.fw4{font-weight:400}.fw5{font-weight:500}.fw6{font-weight:600}.lh-copy{line-height:1.5}.link{text-decoration:none}.link,.link:active,.link:focus,.link:hover,.link:link,.link:visited{transition:color .15s ease-in}.link:focus{outline:1px dotted currentColor}.mw-100{max-width:100%}.mw4{max-width:8rem}.mw7{max-width:48rem}.bg-light-gray{background-color:#f7f7f7}.link-hover:hover{background-color:#1f679e}.white{color:#fff}.bg-white{background-color:#fff}.bg-blue{background-color:#408bc9}.pb2{padding-bottom:.5rem}.pb6{padding-bottom:8rem}.pt3{padding-top:1rem}.pt5{padding-top:4rem}.pv2{padding-top:.5rem;padding-bottom:.5rem}.ph3{padding-left:1rem;padding-right:1rem}.ph4{padding-left:2rem;padding-right:2rem}.ml0{margin-left:0}.mb1{margin-bottom:.25rem}.mb2{margin-bottom:.5rem}.mb3{margin-bottom:1rem}.mt5{margin-top:4rem}.ttu{text-transform:uppercase}.f4{font-size:1.25rem}.f5{font-size:1rem}.f6{font-size:.875rem}.f7{font-size:.75rem}.measure{max-width:30em}.center{margin-left:auto}.center{margin-right:auto}@media screen and (min-width:30em){.f2-ns{font-size:2.25rem}}@media screen and (min-width:30em) and (max-width:60em){.f5-m{font-size:1rem}}@media screen and (min-width:60em){.f4-l{font-size:1.25rem}}
+      html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}section{display:block}h1{font-size:2em;margin:.67em 0}a{background-color:transparent;-webkit-text-decoration-skip:objects}/* 1 */::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}/* 1 */a,body,dd,div,dl,dt,h1,h4,html,p,section{box-sizing:border-box}.bt{border-top-style:solid;border-top-width:1px}.bl{border-left-style:solid;border-left-width:1px}.b--orange{border-color:#f38020}.br1{border-radius:.125rem}.bw2{border-width:.25rem}.dib{display:inline-block}.sans-serif{font-family:open sans,-apple-system,BlinkMacSystemFont,avenir next,avenir,helvetica neue,helvetica,ubuntu,roboto,noto,segoe ui,arial,sans-serif}.code{font-family:Consolas,monaco,monospace}.b{font-weight:700}.fw3{font-weight:300}.fw4{font-weight:400}.fw5{font-weight:500}.fw6{font-weight:600}.lh-copy{line-height:1.5}.link{text-decoration:none}.link,.link:active,.link:focus,.link:hover,.link:link,.link:visited{transition:color .15s ease-in}.link:focus{outline:1px dotted currentColor}.mw-100{max-width:100%}.mw4{max-width:8rem}.mw7{max-width:48rem}.bg-light-gray{background-color:#f7f7f7}.link-hover:hover{background-color:#1f679e}.white{color:#fff}.bg-white{background-color:#fff}.bg-blue{background-color:#408bc9}.pb2{padding-bottom:.5rem}.pb6{padding-bottom:8rem}.pt3{padding-top:1rem}.pt5{padding-top:4rem}.pv2{padding-top:.5rem;padding-bottom:.5rem}.ph3{padding-left:1rem;padding-right:1rem}.ph4{padding-left:2rem;padding-right:2rem}.ml0{margin-left:0}.mb1{margin-bottom:.25rem}.mb2{margin-bottom:.5rem}.mb3{margin-bottom:1rem}.mt5{margin-top:4rem}.ttu{text-transform:uppercase}.f4{font-size:1.25rem}.f5{font-size:1rem}.f6{font-size:.875rem}.f7{font-size:.75rem}.measure{max-width:30em}.center{margin-left:auto}.center{margin-right:auto}@media screen and (min-width:30em){.f2-ns{font-size:2.25rem}}@media screen and (min-width:30em) and (max-width:60em){.f5-m{font-size:1rem}}@media screen and (min-width:60em){.f4-l{font-size:1.25rem}}
    .st0{fill:#FFF}.st1{fill:#f48120}.st2{fill:#faad3f}.st3{fill:#404041}
    </style>
  </head>
@@ -91,6 +91,7 @@ const indexTemplate = `
 </html>
 `

+
 func StartHelloWorldServer(logger *logrus.Logger, listener net.Listener, shutdownC <-chan struct{}) error {
 	logger.Infof("Starting Hello World server at %s", listener.Addr())
 	serverName := defaultServerName
@@ -131,6 +132,7 @@ func CreateTLSListener(address string) (net.Listener, error) {
 	return listener, err
 }

+
 func uptimeHandler(startTime time.Time) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		// Note that if autoupdate is enabled, the uptime is reset when a new client
@@ -1,7 +1,6 @@
 package metrics

 import (
-	"context"
 	"net"
 	"net/http"
 	_ "net/http/pprof"
@@ -9,6 +8,7 @@ import (
 	"sync"
 	"time"

+	"golang.org/x/net/context"
 	"golang.org/x/net/trace"

 	"github.com/prometheus/client_golang/prometheus"
@@ -1,8 +1,9 @@
 package origin

 import (
-	"context"
 	"time"
+
+	"golang.org/x/net/context"
 )

 // Redeclare time functions so they can be overridden in tests.
@@ -1,9 +1,10 @@
 package origin

 import (
-	"context"
 	"testing"
 	"time"
+
+	"golang.org/x/net/context"
 )

 func immediateTimeAfter(time.Duration) <-chan time.Time {
@@ -1,117 +0,0 @@
-package origin
-
-import (
-	"encoding/json"
-	"io/ioutil"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/cloudflare/golibs/lrucache"
-)
-
-// StatusPage.io API docs:
-// https://www.cloudflarestatus.com/api/v2/#incidents-unresolved
-const (
-	activeIncidentsURL    = "https://yh6f0r4529hb.statuspage.io/api/v2/incidents/unresolved.json"
-	argoTunnelKeyword     = "argo tunnel"
-	incidentDetailsPrefix = "https://www.cloudflarestatus.com/incidents/"
-)
-
-// IncidentLookup is an object that checks for active incidents in
-// the Cloudflare infrastructure.
-type IncidentLookup interface {
-	ActiveIncidents() []Incident
-}
-
-// NewIncidentLookup returns a new IncidentLookup instance that caches its
-// results with a 1-minute TTL.
-func NewIncidentLookup() IncidentLookup {
-	return newCachedIncidentLookup(fetchActiveIncidents)
-}
-
-type IncidentUpdate struct {
-	Body string
-}
-
-type Incident struct {
-	Name    string
-	ID      string           `json:"id"`
-	Updates []IncidentUpdate `json:"incident_updates"`
-}
-
-type StatusPage struct {
-	Incidents []Incident
-}
-
-func (i Incident) URL() string {
-	return incidentDetailsPrefix + i.ID
-}
-
-func parseStatusPage(data []byte) (*StatusPage, error) {
-	var result StatusPage
-	err := json.Unmarshal(data, &result)
-	return &result, err
-}
-
-func isArgoTunnelIncident(i Incident) bool {
-	if strings.Contains(strings.ToLower(i.Name), argoTunnelKeyword) {
-		return true
-	}
-	for _, u := range i.Updates {
-		if strings.Contains(strings.ToLower(u.Body), argoTunnelKeyword) {
-			return true
-		}
-	}
-	return false
-}
-
-func fetchActiveIncidents() (incidents []Incident) {
-	resp, err := http.Get(activeIncidentsURL)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return
-	}
-	statusPage, err := parseStatusPage(body)
-	if err != nil {
-		return
-	}
-	for _, i := range statusPage.Incidents {
-		if isArgoTunnelIncident(i) {
-			incidents = append(incidents, i)
-		}
-	}
-	return incidents
-}
-
-type cachedIncidentLookup struct {
-	cache          *lrucache.LRUCache
-	ttl            time.Duration
-	uncachedLookup func() []Incident
-}
-
-func newCachedIncidentLookup(uncachedLookup func() []Incident) *cachedIncidentLookup {
-	return &cachedIncidentLookup{
-		cache:          lrucache.NewLRUCache(1),
-		ttl:            time.Minute,
-		uncachedLookup: uncachedLookup,
-	}
-}
-
-// We only need one cache entry. Always use the empty string as its key.
-const cacheKey = ""
-
-func (c *cachedIncidentLookup) ActiveIncidents() []Incident {
-	if cached, ok := c.cache.GetNotStale(cacheKey); ok {
-		if incidents, ok := cached.([]Incident); ok {
-			return incidents
-		}
-	}
-	incidents := c.uncachedLookup()
-	c.cache.Set(cacheKey, incidents, time.Now().Add(c.ttl))
-	return incidents
-}
@@ -1,386 +0,0 @@
-package origin
-
-import (
-	"testing"
-	"time"
-
-	"github.com/cloudflare/golibs/lrucache"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestParseStatusPage(t *testing.T) {
-	testCases := []struct {
-		input  []byte
-		output *StatusPage
-		fail   bool
-	}{
-		{
-			input: []byte(`<html>
-				<head><title>504 Gateway Time-out</title></head>
-				<body><center><h1>504 Gateway Time-out</h1></center></body>
-			</html>`),
-			output: nil,
-			fail:   true,
-		},
-		{
-			input: []byte(`{
-				"page": {
-					"id": "yh6f0r4529hb",
-					"name": "Cloudflare",
-					"url": "https://www.cloudflarestatus.com",
-					"time_zone": "Etc/UTC",
-					"updated_at": "2019-01-10T20:11:38.750Z"
-				},
-				"incidents": [
-					{
-						"name": "Cloudflare API service issues",
-						"status": "resolved",
-						"created_at": "2018-09-17T19:29:21.132Z",
-						"updated_at": "2018-09-18T07:45:41.313Z",
-						"monitoring_at": "2018-09-17T21:35:06.492Z",
-						"resolved_at": "2018-09-18T07:45:41.290Z",
-						"shortlink": "http://stspg.io/7f079791e",
-						"id": "q746ybtyb6q0",
-						"page_id": "yh6f0r4529hb",
-						"incident_updates": [
-							{
-								"status": "resolved",
-								"body": "Cloudflare has resolved the issue and the service have resumed normal operation.",
-								"created_at": "2018-09-18T07:45:41.290Z",
-								"updated_at": "2018-09-18T07:45:41.290Z",
-								"display_at": "2018-09-18T07:45:41.290Z",
-								"affected_components": [
-									{
-										"code": "g4tb35rs9yw7",
-										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
-										"old_status": "operational",
-										"new_status": "operational"
-									}
-								],
-								"deliver_notifications": true,
-								"tweet_id": null,
-								"id": "zl5g2pl5zhfs",
-								"incident_id": "q746ybtyb6q0",
-								"custom_tweet": null
-							},
-							{
-								"status": "monitoring",
-								"body": "Cloudflare has implemented a fix for this issue and is currently monitoring the results.\r\n\r\nWe will update the status once the issue is resolved.",
-								"created_at": "2018-09-17T21:35:06.492Z",
-								"updated_at": "2018-09-17T21:35:06.492Z",
-								"display_at": "2018-09-17T21:35:06.492Z",
-								"affected_components": [
-									{
-										"code": "g4tb35rs9yw7",
-										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
-										"old_status": "degraded_performance",
-										"new_status": "operational"
-									}
-								],
-								"deliver_notifications": false,
-								"tweet_id": null,
-								"id": "0001sv3chdnx",
-								"incident_id": "q746ybtyb6q0",
-								"custom_tweet": null
-							},
-							{
-								"status": "investigating",
-								"body": "We are continuing to investigate this issue.",
-								"created_at": "2018-09-17T19:30:08.049Z",
-								"updated_at": "2018-09-17T19:30:08.049Z",
-								"display_at": "2018-09-17T19:30:08.049Z",
-								"affected_components": [
-									{
-										"code": "g4tb35rs9yw7",
-										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
-										"old_status": "operational",
-										"new_status": "degraded_performance"
-									}
-								],
-								"deliver_notifications": false,
-								"tweet_id": null,
-								"id": "qdr164tfpq7m",
-								"incident_id": "q746ybtyb6q0",
-								"custom_tweet": null
-							},
-							{
-								"status": "investigating",
-								"body": "Cloudflare is investigating issues with APIs and Page Rule delays for Page Rule updates.  Cloudflare Page Rule service delivery is unaffected and is operating normally.  Also, these issues do not affect the Cloudflare CDN and therefore, do not impact customer websites.",
-								"created_at": "2018-09-17T19:29:21.201Z",
-								"updated_at": "2018-09-17T19:29:21.201Z",
-								"display_at": "2018-09-17T19:29:21.201Z",
-								"affected_components": [
-									{
-										"code": "g4tb35rs9yw7",
-										"name": "Cloudflare customer dashboard and APIs - Cloudflare APIs",
-										"old_status": "operational",
-										"new_status": "operational"
-									}
-								],
-								"deliver_notifications": false,
-								"tweet_id": null,
-								"id": "qzl2n0q8tskg",
-								"incident_id": "q746ybtyb6q0",
-								"custom_tweet": null
-							}
-						],
-						"components": [
-							{
-								"status": "operational",
-								"name": "Cloudflare APIs",
-								"created_at": "2014-10-09T03:32:07.158Z",
-								"updated_at": "2019-01-01T22:58:30.846Z",
-								"position": 2,
-								"description": null,
-								"showcase": false,
-								"id": "g4tb35rs9yw7",
-								"page_id": "yh6f0r4529hb",
-								"group_id": "1km35smx8p41",
-								"group": false,
-								"only_show_if_degraded": false,
-								"automation_email": "component+g4tb35rs9yw7@notifications.statuspage.io"
-							}
-						],
-						"impact": "minor"
-					},
-					{
-						"name": "Web Analytics Delays",
-						"status": "resolved",
-						"created_at": "2018-09-17T18:05:39.907Z",
-						"updated_at": "2018-09-17T22:53:05.078Z",
-						"monitoring_at": null,
-						"resolved_at": "2018-09-17T22:53:05.057Z",
-						"shortlink": "http://stspg.io/cb208928c",
-						"id": "wqfk9mzs5qt1",
-						"page_id": "yh6f0r4529hb",
-						"incident_updates": [
-							{
-								"status": "resolved",
-								"body": "Cloudflare has resolved the issue and Web Analytics have resumed normal operation.",
-								"created_at": "2018-09-17T22:53:05.057Z",
-								"updated_at": "2018-09-17T22:53:05.057Z",
-								"display_at": "2018-09-17T22:53:05.057Z",
-								"affected_components": [
-									{
-										"code": "4c231tkdlpcl",
-										"name": "Cloudflare customer dashboard and APIs - Analytics",
-										"old_status": "degraded_performance",
-										"new_status": "operational"
-									}
-								],
-								"deliver_notifications": false,
-								"tweet_id": null,
-								"id": "93y1w00yqzk4",
-								"incident_id": "wqfk9mzs5qt1",
-								"custom_tweet": null
-							},
-							{
-								"status": "investigating",
-								"body": "There is a delay in processing Cloudflare Web Analytics. This affects timely delivery of customer data.\n\nThese delays do not impact analytics for DNS and Rate Limiting.",
-								"created_at": "2018-09-17T18:05:40.033Z",
-								"updated_at": "2018-09-17T18:05:40.033Z",
-								"display_at": "2018-09-17T18:05:40.033Z",
-								"affected_components": [
-									{
-										"code": "4c231tkdlpcl",
-										"name": "Cloudflare customer dashboard and APIs - Analytics",
-										"old_status": "operational",
-										"new_status": "degraded_performance"
-									}
-								],
-								"deliver_notifications": false,
-								"tweet_id": null,
-								"id": "362t6lv0vrpk",
-								"incident_id": "wqfk9mzs5qt1",
-								"custom_tweet": null
-							}
-						],
-						"components": [
-							{
-								"status": "operational",
-								"name": "Analytics",
-								"created_at": "2014-11-13T11:54:10.191Z",
-								"updated_at": "2018-12-31T08:20:52.349Z",
-								"position": 3,
-								"description": "Customer data",
-								"showcase": false,
-								"id": "4c231tkdlpcl",
-								"page_id": "yh6f0r4529hb",
-								"group_id": "1km35smx8p41",
-								"group": false,
-								"only_show_if_degraded": false,
-								"automation_email": "component+4c231tkdlpcl@notifications.statuspage.io"
-							}
-						],
-						"impact": "minor"
-					}
-				]
-			}`),
-			output: &StatusPage{
-				Incidents: []Incident{
-					Incident{
-						Name: "Cloudflare API service issues",
-						ID:   "q746ybtyb6q0",
-						Updates: []IncidentUpdate{
-							IncidentUpdate{
-								Body: "Cloudflare has resolved the issue and the service have resumed normal operation.",
-							},
-							IncidentUpdate{
-								Body: "Cloudflare has implemented a fix for this issue and is currently monitoring the results.\r\n\r\nWe will update the status once the issue is resolved.",
-							},
-							IncidentUpdate{
-								Body: "We are continuing to investigate this issue.",
-							},
-							IncidentUpdate{
-								Body: "Cloudflare is investigating issues with APIs and Page Rule delays for Page Rule updates.  Cloudflare Page Rule service delivery is unaffected and is operating normally.  Also, these issues do not affect the Cloudflare CDN and therefore, do not impact customer websites.",
-							},
-						},
-					},
-					Incident{
-						Name: "Web Analytics Delays",
-						ID:   "wqfk9mzs5qt1",
-						Updates: []IncidentUpdate{
-							IncidentUpdate{
-								Body: "Cloudflare has resolved the issue and Web Analytics have resumed normal operation.",
-							},
-							IncidentUpdate{
-								Body: "There is a delay in processing Cloudflare Web Analytics. This affects timely delivery of customer data.\n\nThese delays do not impact analytics for DNS and Rate Limiting.",
-							},
-						},
-					},
-				},
-			},
-			fail: false,
-		},
-	}
-
-	for _, testCase := range testCases {
-		output, err := parseStatusPage(testCase.input)
-		if testCase.fail {
-			assert.Error(t, err)
-		} else {
-			assert.Nil(t, err)
-			assert.Equal(t, testCase.output, output)
-		}
-	}
-}
-
-func TestIsArgoTunnelIncident(t *testing.T) {
-	testCases := []struct {
-		input  Incident
-		output bool
-	}{
-		{
-			input:  Incident{},
-			output: false,
-		},
-		{
-			input:  Incident{Name: "An Argo Tunnel incident"},
-			output: true,
-		},
-		{
-			input:  Incident{Name: "an argo tunnel incident"},
-			output: true,
-		},
-		{
-			input:  Incident{Name: "an aRgO TuNnEl incident"},
-			output: true,
-		},
-		{
-			input:  Incident{Name: "an argotunnel incident"},
-			output: false,
-		},
-		{
-			input:  Incident{Name: "irrelevant"},
-			output: false,
-		},
-		{
-			input: Incident{
-				Name: "irrelevant",
-				Updates: []IncidentUpdate{
-					IncidentUpdate{Body: "irrelevant"},
-					IncidentUpdate{Body: "an Argo Tunnel incident"},
-					IncidentUpdate{Body: "irrelevant"},
-				},
-			},
-			output: true,
-		},
-		{
-			input: Incident{
-				Name: "an Argo Tunnel incident",
-				Updates: []IncidentUpdate{
-					IncidentUpdate{Body: "irrelevant"},
-					IncidentUpdate{Body: "irrelevant"},
-					IncidentUpdate{Body: "irrelevant"},
-				},
-			},
-			output: true,
-		},
-	}
-	for _, testCase := range testCases {
-		actual := isArgoTunnelIncident(testCase.input)
-		assert.Equal(t, testCase.output, actual, "Test case failed: %v", testCase.input)
-	}
-}
-
-func TestIncidentURL(t *testing.T) {
-	incident := Incident{
-		ID: "s6k0dnn5347b",
-	}
-	assert.Equal(t, "https://www.cloudflarestatus.com/incidents/s6k0dnn5347b", incident.URL())
-}
-
-func TestNewCachedIncidentLookup(t *testing.T) {
-	c := newCachedIncidentLookup(func() []Incident { return nil })
-	assert.Equal(t, time.Minute, c.ttl)
-	assert.Equal(t, 1, c.cache.Capacity())
-}
-
-func TestCachedIncidentLookup(t *testing.T) {
-	expected := []Incident{
-		Incident{
-			Name: "An incident",
-			ID:   "incidentID",
-		},
-	}
-
-	var shouldCallUncachedLookup bool
-	c := &cachedIncidentLookup{
-		cache: lrucache.NewLRUCache(1),
-		ttl:   50 * time.Millisecond,
-		uncachedLookup: func() []Incident {
-			if !shouldCallUncachedLookup {
-				t.Fatal("uncachedLookup shouldn't have been called")
-			}
-			return expected
-		},
-	}
-
-	shouldCallUncachedLookup = true
-	assert.Equal(t, expected, c.ActiveIncidents())
-
-	shouldCallUncachedLookup = false
-	assert.Equal(t, expected, c.ActiveIncidents())
-	assert.Equal(t, expected, c.ActiveIncidents())
-
-	time.Sleep(50 * time.Millisecond)
-	shouldCallUncachedLookup = true
-	assert.Equal(t, expected, c.ActiveIncidents())
-}
-
-func TestCachedIncidentLookupDoesntPanic(t *testing.T) {
-	expected := []Incident{
-		Incident{
-			Name: "An incident",
-			ID:   "incidentID",
-		},
-	}
-	c := &cachedIncidentLookup{
-		cache:          lrucache.NewLRUCache(1),
-		ttl:            50 * time.Millisecond,
-		uncachedLookup: func() []Incident { return expected },
-	}
-	c.cache.Set(cacheKey, 42, time.Now().Add(30*time.Minute))
-	actual := c.ActiveIncidents()
-	assert.Equal(t, expected, actual)
-}
@@ -52,7 +52,6 @@ type TunnelMetrics struct {
 	oldServerLocations map[string]string

 	muxerMetrics *muxerMetrics
-	tunnelsHA    tunnelsForHA
 }

 func newMuxerMetrics() *muxerMetrics {
@@ -356,7 +355,6 @@ func NewTunnelMetrics() *TunnelMetrics {
 		serverLocations:                serverLocations,
 		oldServerLocations:             make(map[string]string),
 		muxerMetrics:                   newMuxerMetrics(),
-		tunnelsHA:                      NewTunnelsForHA(),
 	}
 }

@@ -377,7 +375,7 @@ func (t *TunnelMetrics) incrementRequests(connectionID string) {
 	var concurrentRequests uint64
 	var ok bool
 	if concurrentRequests, ok = t.concurrentRequests[connectionID]; ok {
-		t.concurrentRequests[connectionID]++
+		t.concurrentRequests[connectionID] += 1
 		concurrentRequests++
 	} else {
 		t.concurrentRequests[connectionID] = 1
@@ -397,7 +395,7 @@ func (t *TunnelMetrics) incrementRequests(connectionID string) {
 func (t *TunnelMetrics) decrementConcurrentRequests(connectionID string) {
 	t.concurrentRequestsLock.Lock()
 	if _, ok := t.concurrentRequests[connectionID]; ok {
-		t.concurrentRequests[connectionID]--
+		t.concurrentRequests[connectionID] -= 1
 	}
 	t.concurrentRequestsLock.Unlock()

@@ -1,10 +1,11 @@
 package origin

 import (
-	"context"
 	"fmt"
 	"net"
 	"time"
+
+	"golang.org/x/net/context"
 )

 const (
@@ -2,9 +2,9 @@ package origin

 import (
 	"bufio"
-	"context"
 	"crypto/tls"
 	"fmt"
+	"github.com/google/uuid"
 	"io"
 	"net"
 	"net/http"
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"time"

+	"golang.org/x/net/context"
 	"golang.org/x/sync/errgroup"

 	"github.com/cloudflare/cloudflared/h2mux"
@@ -22,7 +23,6 @@ import (
 	"github.com/cloudflare/cloudflared/websocket"

 	raven "github.com/getsentry/raven-go"
-	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	_ "github.com/prometheus/client_golang/prometheus"
 	log "github.com/sirupsen/logrus"
@@ -55,7 +55,7 @@ type TunnelConfig struct {
 	HTTPTransport      http.RoundTripper
 	Metrics            *TunnelMetrics
 	MetricsUpdateFreq  time.Duration
-	TransportLogger    *log.Logger
+	ProtocolLogger     *log.Logger
 	Logger             *log.Logger
 	IsAutoupdated      bool
 	GracePeriod        time.Duration
@@ -63,7 +63,6 @@ type TunnelConfig struct {
 	NoChunkedEncoding  bool
 	WSGI               bool
 	CompressionQuality uint64
-	IncidentLookup     IncidentLookup
 }

 type dialError struct {
@@ -236,7 +235,7 @@ func ServeTunnel(
 			select {
 			case <-serveCtx.Done():
 				// UnregisterTunnel blocks until the RPC call returns
-				err := UnregisterTunnel(handler.muxer, config.GracePeriod, config.TransportLogger)
+				err := UnregisterTunnel(handler.muxer, config.GracePeriod, config.Logger)
 				handler.muxer.Shutdown()
 				return err
 			case <-updateMetricsTickC:
@@ -266,9 +265,6 @@ func ServeTunnel(
 			logger.WithError(castedErr.cause).Error("Register tunnel error from server side")
 			// Don't send registration error return from server to Sentry. They are
 			// logged on server side
-			if incidents := config.IncidentLookup.ActiveIncidents(); len(incidents) > 0 {
-				logger.Error(activeIncidentsMsg(incidents))
-			}
 			return castedErr.cause, !castedErr.permanent
 		case clientRegisterTunnelError:
 			logger.WithError(castedErr.cause).Error("Register tunnel error on client side")
@@ -296,14 +292,8 @@ func IsRPCStreamResponse(headers []h2mux.Header) bool {
 	return true
 }

-func RegisterTunnel(
-	ctx context.Context,
-	muxer *h2mux.Muxer,
-	config *TunnelConfig,
-	connectionID uint8,
-	originLocalIP string,
-) error {
-	config.TransportLogger.Debug("initiating RPC stream to register")
+func RegisterTunnel(ctx context.Context, muxer *h2mux.Muxer, config *TunnelConfig, connectionID uint8, originLocalIP string) error {
+	config.Logger.Debug("initiating RPC stream to register")
 	stream, err := muxer.OpenStream([]h2mux.Header{
 		{Name: ":method", Value: "RPC"},
 		{Name: ":scheme", Value: "capnp"},
@@ -318,8 +308,8 @@ func RegisterTunnel(
 		return clientRegisterTunnelError{cause: err}
 	}
 	conn := rpc.NewConn(
-		tunnelrpc.NewTransportLogger(config.TransportLogger.WithField("subsystem", "rpc-register"), rpc.StreamTransport(stream)),
-		tunnelrpc.ConnLog(config.TransportLogger.WithField("subsystem", "rpc-transport")),
+		tunnelrpc.NewTransportLogger(config.Logger.WithField("subsystem", "rpc-register"), rpc.StreamTransport(stream)),
+		tunnelrpc.ConnLog(config.Logger.WithField("subsystem", "rpc-transport")),
 	)
 	defer conn.Close()
 	ts := tunnelpogs.TunnelServer_PogsClient{Client: conn.Bootstrap(ctx)}
@@ -356,8 +346,7 @@ func RegisterTunnel(
 	}

 	if registration.TunnelID != "" {
-		config.Metrics.tunnelsHA.AddTunnelID(connectionID, registration.TunnelID)
-		config.Logger.Infof("Each HA connection's tunnel IDs: %v", config.Metrics.tunnelsHA.String())
+		config.Logger.Info("Tunnel ID: " + registration.TunnelID)
 	}

 	// Print out the user's trial zone URL in a nice box (if they requested and got one)
@@ -442,12 +431,6 @@ func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
 				return fmt.Errorf("invalid path")
 			}
 			h1.URL = resolved
-		case "content-length":
-			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
-			if err != nil {
-				return fmt.Errorf("unparseable content length")
-			}
-			h1.ContentLength = contentLength
 		default:
 			h1.Header.Add(http.CanonicalHeaderKey(header.Name), header.Value)
 		}
@@ -531,7 +514,7 @@ func NewTunnelHandler(ctx context.Context,
 		IsClient:           true,
 		HeartbeatInterval:  config.HeartbeatInterval,
 		MaxHeartbeats:      config.MaxHeartbeats,
-		Logger:             config.TransportLogger.WithFields(log.Fields{}),
+		Logger:             config.ProtocolLogger.WithFields(log.Fields{}),
 		CompressionQuality: h2mux.CompressionSetting(config.CompressionQuality),
 	})
 	if err != nil {
@@ -636,41 +619,25 @@ func (h *TunnelHandler) logError(stream *h2mux.MuxedStream, err error) {
 }

 func (h *TunnelHandler) logRequest(req *http.Request, cfRay string, lbProbe bool) {
-	logger := log.NewEntry(h.logger)
 	if cfRay != "" {
-		logger = logger.WithField("CF-RAY", cfRay)
-		logger.Debugf("%s %s %s", req.Method, req.URL, req.Proto)
+		h.logger.WithField("CF-RAY", cfRay).Debugf("%s %s %s", req.Method, req.URL, req.Proto)
 	} else if lbProbe {
-		logger.Debugf("Load Balancer health check %s %s %s", req.Method, req.URL, req.Proto)
+		h.logger.Debugf("Load Balancer health check %s %s %s", req.Method, req.URL, req.Proto)
 	} else {
-		logger.Warnf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", req.Method, req.URL, req.Proto)
-	}
-	logger.Debugf("Request Headers %+v", req.Header)
-
-	if contentLen := req.ContentLength; contentLen == -1 {
-		logger.Debugf("Request Content length unknown")
-	} else {
-		logger.Debugf("Request content length %d", contentLen)
+		h.logger.Warnf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", req.Method, req.URL, req.Proto)
 	}
+	h.logger.Debugf("Request Headers %+v", req.Header)
 }

 func (h *TunnelHandler) logResponse(r *http.Response, cfRay string, lbProbe bool) {
-	logger := log.NewEntry(h.logger)
 	if cfRay != "" {
-		logger = logger.WithField("CF-RAY", cfRay)
-		logger.Debugf("%s", r.Status)
+		h.logger.WithField("CF-RAY", cfRay).Debugf("%s", r.Status)
 	} else if lbProbe {
-		logger.Debugf("Response to Load Balancer health check %s", r.Status)
+		h.logger.Debugf("Response to Load Balancer health check %s", r.Status)
 	} else {
-		logger.Infof("%s", r.Status)
-	}
-	logger.Debugf("Response Headers %+v", r.Header)
-
-	if contentLen := r.ContentLength; contentLen == -1 {
-		logger.Debugf("Response content length unknown")
-	} else {
-		logger.Debugf("Response content length %d", contentLen)
+		h.logger.Infof("%s", r.Status)
 	}
+	h.logger.Debugf("Response Headers %+v", r.Header)
 }

 func (h *TunnelHandler) UpdateMetrics(connectionID string) {
@@ -716,17 +683,3 @@ func trialZoneMsg(url string) []string {
 		"  " + url,
 	}
 }
-
-func activeIncidentsMsg(incidents []Incident) string {
-	preamble := "There is an active Cloudflare incident that may be related:"
-	if len(incidents) > 1 {
-		preamble = "There are active Cloudflare incidents that may be related:"
-	}
-	incidentStrings := []string{}
-	for _, incident := range incidents {
-		incidentString := fmt.Sprintf("%s (%s)", incident.Name, incident.URL())
-		incidentStrings = append(incidentStrings, incidentString)
-	}
-	return preamble + " " + strings.Join(incidentStrings, "; ")
-
-}
@@ -1,50 +0,0 @@
-package origin
-
-import (
-	"fmt"
-	"sync"
-
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-// tunnelsForHA maps this cloudflared instance's HA connections to the tunnel IDs they serve.
-type tunnelsForHA struct {
-	sync.Mutex
-	metrics *prometheus.GaugeVec
-	entries map[uint8]string
-}
-
-// NewTunnelsForHA initializes the Prometheus metrics etc for a tunnelsForHA.
-func NewTunnelsForHA() tunnelsForHA {
-	metrics := prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: "tunnel_ids",
-			Help: "The ID of all tunnels (and their corresponding HA connection ID) running in this instance of cloudflared.",
-		},
-		[]string{"tunnel_id", "ha_conn_id"},
-	)
-	prometheus.MustRegister(metrics)
-
-	return tunnelsForHA{
-		metrics: metrics,
-		entries: make(map[uint8]string),
-	}
-}
-
-// Track a new tunnel ID, removing the disconnected tunnel (if any) and update metrics.
-func (t *tunnelsForHA) AddTunnelID(haConn uint8, tunnelID string) {
-	t.Lock()
-	defer t.Unlock()
-	haStr := fmt.Sprintf("%v", haConn)
-	if oldTunnelID, ok := t.entries[haConn]; ok {
-		t.metrics.WithLabelValues(oldTunnelID, haStr).Dec()
-	}
-	t.entries[haConn] = tunnelID
-	t.metrics.WithLabelValues(tunnelID, haStr).Inc()
-}
-
-func (t *tunnelsForHA) String() string {
-	t.Lock()
-	defer t.Unlock()
-	return fmt.Sprintf("%v", t.entries)
-}
@@ -2,10 +2,14 @@ package tlsconfig

 import (
 	"crypto/tls"
+	"errors"
 	"fmt"
 	"sync"

+	tunnellog "github.com/cloudflare/cloudflared/log"
 	"github.com/getsentry/raven-go"
+	log "github.com/sirupsen/logrus"
+	"gopkg.in/urfave/cli.v2"
 )

 // CertReloader can load and reload a TLS certificate from a particular filepath.
@@ -17,14 +21,18 @@ type CertReloader struct {
 	keyPath     string
 }

-// NewCertReloader makes a CertReloader. It loads the cert during initialization to make sure certPath and keyPath are valid
-func NewCertReloader(certPath, keyPath string) (*CertReloader, error) {
-	cr := new(CertReloader)
-	cr.certPath = certPath
-	cr.keyPath = keyPath
-	if err := cr.LoadCert(); err != nil {
-		return nil, err
+// NewCertReloader makes a CertReloader, memorizing the filepaths in the context/flags.
+func NewCertReloader(c *cli.Context, f CLIFlags) (*CertReloader, error) {
+	if !c.IsSet(f.Cert) {
+		return nil, errors.New("CertReloader: cert not provided")
 	}
+	if !c.IsSet(f.Key) {
+		return nil, errors.New("CertReloader: key not provided")
+	}
+	cr := new(CertReloader)
+	cr.certPath = c.String(f.Cert)
+	cr.keyPath = c.String(f.Key)
+	cr.LoadCert()
 	return cr, nil
 }

@@ -37,17 +45,18 @@ func (cr *CertReloader) Cert(clientHello *tls.ClientHelloInfo) (*tls.Certificate

 // LoadCert loads a TLS certificate from the CertReloader's specified filepath.
 // Call this after writing a new certificate to the disk (e.g. after renewing a certificate)
-func (cr *CertReloader) LoadCert() error {
+func (cr *CertReloader) LoadCert() {
 	cr.Lock()
 	defer cr.Unlock()

+	log.SetFormatter(&tunnellog.JSONFormatter{})
+	log.Info("Reloading certificate")
 	cert, err := tls.LoadX509KeyPair(cr.certPath, cr.keyPath)

 	// Keep the old certificate if there's a problem reading the new one.
 	if err != nil {
 		raven.CaptureError(fmt.Errorf("Error parsing X509 key pair: %v", err), nil)
-		return err
+		return
 	}
 	cr.certificate = &cert
-	return nil
 }
@@ -2,7 +2,6 @@ package tlsconfig

 import (
 	"crypto/x509"
-	"encoding/pem"
 )

 // TODO: remove the Origin CA root certs when migrated to Authenticated Origin Pull certs
@@ -86,26 +85,11 @@ QzMmZpRpIBB321ZBlcnlxiTJvWxvbCPHKHj20VwwAz7LONF59s84ZsOqfoBv8gKM
 s0s5dsq5zpLeaw==
 -----END CERTIFICATE-----`)

-func GetCloudflareRootCA() ([]*x509.Certificate, error) {
-	var certs []*x509.Certificate
-	pemBlocks := cloudflareRootCA
-	for len(pemBlocks) > 0 {
-		var block *pem.Block
-		block, pemBlocks = pem.Decode(pemBlocks)
-		if block == nil {
-			break
-		}
-		if block.Type != "CERTIFICATE" {
-			continue
-		}
-
-		cert, err := x509.ParseCertificate(block.Bytes)
-		if err != nil {
-			return nil, err
-		}
-
-		certs = append(certs, cert)
+func GetCloudflareRootCA() *x509.CertPool {
+	ca := x509.NewCertPool()
+	if !ca.AppendCertsFromPEM([]byte(cloudflareRootCA)) {
+		// should never happen
+		panic("failure loading Cloudflare origin CA pem")
 	}
-
-	return certs, nil
+	return ca
 }
@@ -1,13 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIICBjCCAbCgAwIBAgIJAPKk4bYMrSFMMA0GCSqGSIb3DQEBCwUAMF0xCzAJBgNV
-BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEPMA0GA1UEBwwGQXVzdGluMRkwFwYDVQQK
-DBBDbG91ZGZsYXJlLCBJbmMuMRIwEAYDVQQDDAlsb2NhbGhvc3QwHhcNMTgxMTE1
-MjA1NzU3WhcNMjgxMTEyMjA1NzU3WjBdMQswCQYDVQQGEwJVUzEOMAwGA1UECAwF
-VGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xvdWRmbGFyZSwgSW5j
-LjESMBAGA1UEAwwJbG9jYWxob3N0MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOQN
-pTRn5wLf8SSI5x2kpDvbdDy7lfhamJ2En4Q+wy1cSKp8bn8/oyhVF7QTsimDGTI4
-45pV9nDfNJPYB3IW0x0CAwEAAaNTMFEwHQYDVR0OBBYEFE4jIa97mIEiYFa02X++
-uu5mCEn+MB8GA1UdIwQYMBaAFE4jIa97mIEiYFa02X++uu5mCEn+MA8GA1UdEwEB
-/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADQQAkE+pDee0o5cNcZRUszy8sTQzB1Wlp
-J6ucfmo16crqRaK7uGvhkMyibIc4D8z2Cxw3aI3IMMFoIIlYoYKiUcbd
-----END CERTIFICATE-----
@@ -1,13 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIICBjCCAbCgAwIBAgIJAN6cXRTbJtFnMA0GCSqGSIb3DQEBCwUAMF0xCzAJBgNV
-BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEPMA0GA1UEBwwGQXVzdGluMRgwFgYDVQQK
-DA9DbG91ZGZsYXJlLCBJbmMxEzARBgNVBAMMCmxvY2FsaG9zdDIwHhcNMTgxMTE1
-MjExMTU4WhcNMjgxMTEyMjExMTU4WjBdMQswCQYDVQQGEwJVUzEOMAwGA1UECAwF
-VGV4YXMxDzANBgNVBAcMBkF1c3RpbjEYMBYGA1UECgwPQ2xvdWRmbGFyZSwgSW5j
-MRMwEQYDVQQDDApsb2NhbGhvc3QyMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKQx
-IMZ6QgXoul2ITF/7sly4fW2Ol+a/AYw42zCWhVqOXv8AhY21I0Q8lkRR6wOroQwZ
-O7jKKOcE5TnR/NRcZr8CAwEAAaNTMFEwHQYDVR0OBBYEFONKxLZc2RUD0KTHkAz4
-8nrb5688MB8GA1UdIwQYMBaAFONKxLZc2RUD0KTHkAz48nrb5688MA8GA1UdEwEB
-/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADQQA56pwhvGpNPjyLcWfJHu/vI3ZjdoLB
-LnrkRaMjJmv0H0Beh4upJhoz8u6lhMACerKQrrdQhEPB2u+maFrEBtmN
-----END CERTIFICATE-----
@@ -1,10 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEA5A2lNGfnAt/xJIjn
-HaSkO9t0PLuV+FqYnYSfhD7DLVxIqnxufz+jKFUXtBOyKYMZMjjjmlX2cN80k9gH
-chbTHQIDAQABAkAoeDtu91lJa1AxuZG58vOqI6GW/Xr5naojmdts7m5YaAhDa7DE
-zJUp4d8SP5cGBf1/PB3x6Cu9UviFNQ16wmzJAiEA8gUm4UYpWZD4Ze2l/xb+BK8D
-IglSUIy1VxW+X1G55wMCIQDxOfXiFzPqnv/e5avKGv6CU11Dhmbi1OpiyybZTjGz
-XwIhAM3bE/cJdqJ4bNBGE6umIupY8pFA3IMnLBempwbsvPOBAiEAgzJ+5OSxu92W
-VGidsmJUIhWtF9i1hJFAmVLcYjwBFAkCICtjP/vv0qOZWk4mAAn2zz9UVWp45DSR
-p/FA8V77ohXD
-----END PRIVATE KEY-----
@@ -6,86 +6,150 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"io/ioutil"
+	"net"

+	"github.com/cloudflare/cloudflared/log"
 	"github.com/pkg/errors"
+	"gopkg.in/urfave/cli.v2"
+	"runtime"
 )

-// Config is the user provided parameters to create a tls.Config
-type TLSParameters struct {
-	Cert             string
-	Key              string
-	GetCertificate   *CertReloader
-	ClientCAs        []string
-	RootCAs          []string
-	ServerName       string
-	CurvePreferences []tls.CurveID
+var logger = log.CreateLogger()
+
+// CLIFlags names the flags used to configure TLS for a command or subsystem.
+// The nil value for a field means the flag is ignored.
+type CLIFlags struct {
+	Cert       string
+	Key        string
+	ClientCert string
+	RootCA     string
 }

-// GetConfig returns a TLS configuration according to the Config set by the user.
-func GetConfig(p *TLSParameters) (*tls.Config, error) {
-	tlsconfig := &tls.Config{}
-	if p.Cert != "" && p.Key != "" {
-		cert, err := tls.LoadX509KeyPair(p.Cert, p.Key)
+// GetConfig returns a TLS configuration according to the flags defined in f and
+// set by the user.
+func (f CLIFlags) GetConfig(c *cli.Context) *tls.Config {
+	config := &tls.Config{}
+
+	if c.IsSet(f.Cert) && c.IsSet(f.Key) {
+		cert, err := tls.LoadX509KeyPair(c.String(f.Cert), c.String(f.Key))
 		if err != nil {
-			return nil, errors.Wrap(err, "Error parsing X509 key pair")
+			logger.WithError(err).Fatal("Error parsing X509 key pair")
 		}
-		tlsconfig.Certificates = []tls.Certificate{cert}
-		// BuildNameToCertificate parses Certificates and builds NameToCertificate from common name
-		// and SAN fields of leaf certificates
-		tlsconfig.BuildNameToCertificate()
+		config.Certificates = []tls.Certificate{cert}
+		config.BuildNameToCertificate()
 	}
+	return f.finishGettingConfig(c, config)
+}

-	if p.GetCertificate != nil {
-		// GetCertificate is called when client supplies SNI info or Certificates is empty.
-		// Order of retrieving certificate is GetCertificate, NameToCertificate and lastly first element of Certificates
-		tlsconfig.GetCertificate = p.GetCertificate.Cert
+func (f CLIFlags) GetConfigReloadableCert(c *cli.Context, cr *CertReloader) *tls.Config {
+	config := &tls.Config{
+		GetCertificate: cr.Cert,
 	}
+	config.BuildNameToCertificate()
+	return f.finishGettingConfig(c, config)
+}

-	if len(p.ClientCAs) > 0 {
+func (f CLIFlags) finishGettingConfig(c *cli.Context, config *tls.Config) *tls.Config {
+	if c.IsSet(f.ClientCert) {
 		// set of root certificate authorities that servers use if required to verify a client certificate
 		// by the policy in ClientAuth
-		clientCAs, err := LoadCert(p.ClientCAs)
-		if err != nil {
-			return nil, errors.Wrap(err, "Error loading client CAs")
-		}
-		tlsconfig.ClientCAs = clientCAs
+		config.ClientCAs = LoadCert(c.String(f.ClientCert))
 		// server's policy for TLS Client Authentication. Default is no client cert
-		tlsconfig.ClientAuth = tls.RequireAndVerifyClientCert
+		config.ClientAuth = tls.RequireAndVerifyClientCert
 	}
-
-	if len(p.RootCAs) > 0 {
-		rootCAs, err := LoadCert(p.RootCAs)
-		if err != nil {
-			return nil, errors.Wrap(err, "Error loading root CAs")
-		}
-		tlsconfig.RootCAs = rootCAs
+	// set of root certificate authorities that clients use when verifying server certificates
+	if c.IsSet(f.RootCA) {
+		config.RootCAs = LoadCert(c.String(f.RootCA))
 	}
-
-	if p.ServerName != "" {
-		tlsconfig.ServerName = p.ServerName
-	}
-
-	if len(p.CurvePreferences) > 0 {
-		tlsconfig.CurvePreferences = p.CurvePreferences
-	} else {
-		// Cloudflare optimize CurveP256
-		tlsconfig.CurvePreferences = []tls.CurveID{tls.CurveP256}
-	}
-
-	return tlsconfig, nil
+	// we optimize CurveP256
+	config.CurvePreferences = []tls.CurveID{tls.CurveP256}
+	return config
 }

 // LoadCert creates a CertPool containing all certificates in a PEM-format file.
-func LoadCert(certPaths []string) (*x509.CertPool, error) {
+func LoadCert(certPath string) *x509.CertPool {
+	caCert, err := ioutil.ReadFile(certPath)
+	if err != nil {
+		logger.WithError(err).Fatalf("Error reading certificate %s", certPath)
+	}
 	ca := x509.NewCertPool()
-	for _, certPath := range certPaths {
-		caCert, err := ioutil.ReadFile(certPath)
-		if err != nil {
-			return nil, errors.Wrapf(err, "Error reading certificate %s", certPath)
+	if !ca.AppendCertsFromPEM(caCert) {
+		logger.WithError(err).Fatalf("Error parsing certificate %s", certPath)
+	}
+	return ca
+}
+
+func LoadGlobalCertPool() (*x509.CertPool, error) {
+	success := false
+
+	// First, obtain the system certificate pool
+	certPool, systemCertPoolErr := x509.SystemCertPool()
+	if systemCertPoolErr != nil {
+		if runtime.GOOS != "windows" {
+			logger.Warnf("error obtaining the system certificates: %s", systemCertPoolErr)
 		}
-		if !ca.AppendCertsFromPEM(caCert) {
-			return nil, errors.Wrapf(err, "Error parsing certificate %s", certPath)
+		certPool = x509.NewCertPool()
+	} else {
+		success = true
+	}
+
+	// Next, append the Cloudflare CA pool into the system pool
+	if !certPool.AppendCertsFromPEM(cloudflareRootCA) {
+		logger.Warn("could not append the CF certificate to the cloudflared certificate pool")
+	} else {
+		success = true
+	}
+
+	if success != true { // Obtaining any of the CAs has failed; this is a fatal error
+		return nil, errors.New("error loading any of the CAs into the global certificate pool")
+	}
+
+	// Finally, add the Hello certificate into the pool (since it's self-signed)
+	helloCertificate, err := GetHelloCertificateX509()
+	if err != nil {
+		logger.Warn("error obtaining the Hello server certificate")
+	}
+
+	certPool.AddCert(helloCertificate)
+
+	return certPool, nil
+}
+
+func LoadOriginCertPool(originCAPoolPEM []byte) (*x509.CertPool, error) {
+	success := false
+
+	// Get the global pool
+	certPool, globalPoolErr := LoadGlobalCertPool()
+	if globalPoolErr != nil {
+		certPool = x509.NewCertPool()
+	} else {
+		success = true
+	}
+
+	// Then, add any custom origin CA pool the user may have passed
+	if originCAPoolPEM != nil {
+		if !certPool.AppendCertsFromPEM(originCAPoolPEM) {
+			logger.Warn("could not append the provided origin CA to the cloudflared certificate pool")
+		} else {
+			success = true
 		}
 	}
-	return ca, nil
+
+	if success != true {
+		return nil, errors.New("error loading any of the CAs into the origin certificate pool")
+	}
+
+	return certPool, nil
+}
+
+func CreateTunnelConfig(c *cli.Context, addrs []string) *tls.Config {
+	tlsConfig := CLIFlags{RootCA: "cacert"}.GetConfig(c)
+	if tlsConfig.RootCAs == nil {
+		tlsConfig.RootCAs = GetCloudflareRootCA()
+		tlsConfig.ServerName = "cftunnel.com"
+	} else if len(addrs) > 0 {
+		// Set for development environments and for testing specific origintunneld instances
+		tlsConfig.ServerName, _, _ = net.SplitHostPort(addrs[0])
+	}
+	return tlsConfig
 }
@@ -1,84 +1,214 @@
+// +build ignore
 // TODO: Remove the above build tag and include this test when we start compiling with Golang 1.10.0+

 package tlsconfig

 import (
-	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"os"
 	"testing"

 	"github.com/stretchr/testify/assert"
 )

-// testcert.pem and testcert2.pem are Generated using `openssl req -newkey rsa:512 -nodes -x509 -days 3650`
-const (
-	testcertCommonName = "localhost"
-)
+// Generated using `openssl req -newkey rsa:512 -nodes -x509 -days 3650`
+var samplePEM = []byte(`
+-----BEGIN CERTIFICATE-----
+MIIB4DCCAYoCCQCb/H0EUrdXEjANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
+UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
+dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
+AwwIVGVzdCBPbmUwHhcNMTgwNDI2MTYxMDUxWhcNMjgwNDIzMTYxMDUxWjB3MQsw
+CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
+A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
+eTERMA8GA1UEAwwIVGVzdCBPbmUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAwVQD
+K0SJ25UFLznm2pU3zhzMEvpDEofHVNnCjk4mlDrtVop7PkKZ8pDEmuQANltUrxC8
+yHBE2wXMv+GlH+bDtwIDAQABMA0GCSqGSIb3DQEBCwUAA0EAjVYQzozIFPkt/HRY
+uUoZ8zEHIDICb0syFf5VAjm9AgTwIPzUmD+c5vl6LWDnxq7L45nLCzhhQ6YmiwDz
+X7Wcyg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB4DCCAYoCCQDZfCdAJ+mwzDANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV
+UzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcGA1UECgwQQ2xv
+dWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVneTERMA8GA1UE
+AwwIVGVzdCBUd28wHhcNMTgwNDI2MTYxMTIwWhcNMjgwNDIzMTYxMTIwWjB3MQsw
+CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxDzANBgNVBAcMBkF1c3RpbjEZMBcG
+A1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEZMBcGA1UECwwQUHJvZHVjdCBTdHJhdGVn
+eTERMA8GA1UEAwwIVGVzdCBUd28wXDANBgkqhkiG9w0BAQEFAANLADBIAkEAoHKp
+ROVK3zCSsH7ocYeyRAML4V7SFAbZcb4WIwDnE08oMBVRkQVcW5tqEkvG3RiClfzV
+wZIJ3CfqKIeSNSDU9wIDAQABMA0GCSqGSIb3DQEBCwUAA0EAJw2gUbnPiq4C2p5b
+iWzlA9Q7aKo+VQ4H7IZS7tTccr59nVjvH/TG3eWujpnocr4TOqW9M3CK1DF9mUGP
+3pQ3Jg==
+-----END CERTIFICATE-----
+`)

-func TestGetFromEmptyConfig(t *testing.T) {
-	c := &TLSParameters{}
+var systemCertPoolSubjects []*pkix.Name

-	tlsConfig, err := GetConfig(c)
-	assert.NoError(t, err)
-	assert.Empty(t, tlsConfig.Certificates)
-
-	assert.Empty(t, tlsConfig.NameToCertificate)
-
-	assert.Nil(t, tlsConfig.ClientCAs)
-	assert.Equal(t, tls.NoClientCert, tlsConfig.ClientAuth)
-
-	assert.Nil(t, tlsConfig.RootCAs)
-
-	assert.Len(t, tlsConfig.CurvePreferences, 1)
-	assert.Equal(t, tls.CurveP256, tlsConfig.CurvePreferences[0])
+type certificateFixture struct {
+	ou string
+	cn string
 }

-func TestGetConfig(t *testing.T) {
-	cert, err := tls.LoadX509KeyPair("testcert.pem", "testkey.pem")
-	assert.NoError(t, err)
-
-	c := &TLSParameters{
-		Cert:             "testcert.pem",
-		Key:              "testkey.pem",
-		ClientCAs:        []string{"testcert.pem", "testcert2.pem"},
-		RootCAs:          []string{"testcert.pem", "testcert2.pem"},
-		ServerName:       "test",
-		CurvePreferences: []tls.CurveID{tls.CurveP384},
+func TestMain(m *testing.M) {
+	systemCertPool, err := x509.SystemCertPool()
+	if isUnrecoverableError(err) {
+		os.Exit(1)
 	}
-	tlsConfig, err := GetConfig(c)
-	assert.NoError(t, err)
-	assert.Len(t, tlsConfig.Certificates, 1)
-	assert.Equal(t, cert, tlsConfig.Certificates[0])

-	assert.Equal(t, cert, *tlsConfig.NameToCertificate[testcertCommonName])
-
-	assert.NotNil(t, tlsConfig.ClientCAs)
-	assert.Equal(t, tls.RequireAndVerifyClientCert, tlsConfig.ClientAuth)
-
-	assert.NotNil(t, tlsConfig.RootCAs)
-
-	assert.Len(t, tlsConfig.CurvePreferences, 1)
-	assert.Equal(t, tls.CurveP384, tlsConfig.CurvePreferences[0])
-}
-
-func TestCertReloader(t *testing.T) {
-	expectedCert, err := tls.LoadX509KeyPair("testcert.pem", "testkey.pem")
-	assert.NoError(t, err)
-
-	certReloader, err := NewCertReloader("testcert.pem", "testkey.pem")
-	assert.NoError(t, err)
-
-	chi := &tls.ClientHelloInfo{ServerName: testcertCommonName}
-	cert, err := certReloader.Cert(chi)
-	assert.NoError(t, err)
-	assert.Equal(t, expectedCert, *cert)
-
-	c := &TLSParameters{
-		GetCertificate: certReloader,
+	if systemCertPool == nil {
+		// On Windows, let's just assume the system cert pool was empty
+		systemCertPool = x509.NewCertPool()
 	}
-	tlsConfig, err := GetConfig(c)
-	assert.NoError(t, err)

-	cert, err = tlsConfig.GetCertificate(chi)
-	assert.NoError(t, err)
-	assert.Equal(t, expectedCert, *cert)
+	systemCertPoolSubjects, err = getCertPoolSubjects(systemCertPool)
+	if err != nil {
+		os.Exit(1)
+	}
+
+	os.Exit(m.Run())
+}
+
+func TestLoadOriginCertPoolJustSystemPool(t *testing.T) {
+	certPoolSubjects := loadCertPoolSubjects(t, nil)
+	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
+
+	// Remove extra subjects from the cert pool
+	var filteredSystemCertPoolSubjects []*pkix.Name
+
+	t.Log(extraSubjects)
+
+OUTER:
+	for _, subject := range certPoolSubjects {
+		for _, extraSubject := range extraSubjects {
+			if subject == extraSubject {
+				t.Log(extraSubject)
+				continue OUTER
+			}
+		}
+
+		filteredSystemCertPoolSubjects = append(filteredSystemCertPoolSubjects, subject)
+	}
+
+	assert.Equal(t, len(filteredSystemCertPoolSubjects), len(systemCertPoolSubjects))
+
+	difference := subjectSubtract(systemCertPoolSubjects, filteredSystemCertPoolSubjects)
+	assert.Equal(t, 0, len(difference))
+}
+
+func TestLoadOriginCertPoolCFCertificates(t *testing.T) {
+	certPoolSubjects := loadCertPoolSubjects(t, nil)
+
+	extraSubjects := subjectSubtract(systemCertPoolSubjects, certPoolSubjects)
+
+	expected := []*certificateFixture{
+		{ou: "CloudFlare Origin SSL ECC Certificate Authority"},
+		{ou: "CloudFlare Origin SSL Certificate Authority"},
+		{cn: "origin-pull.cloudflare.net"},
+		{cn: "Argo Tunnel Sample Hello Server Certificate"},
+	}
+
+	assertFixturesMatchSubjects(t, expected, extraSubjects)
+}
+
+func TestLoadOriginCertPoolWithExtraPEMs(t *testing.T) {
+	certPoolWithoutPEMSubjects := loadCertPoolSubjects(t, nil)
+	certPoolWithPEMSubjects := loadCertPoolSubjects(t, samplePEM)
+
+	difference := subjectSubtract(certPoolWithoutPEMSubjects, certPoolWithPEMSubjects)
+
+	assert.Equal(t, 2, len(difference))
+
+	expected := []*certificateFixture{
+		{cn: "Test One"},
+		{cn: "Test Two"},
+	}
+
+	assertFixturesMatchSubjects(t, expected, difference)
+}
+
+func loadCertPoolSubjects(t *testing.T, originCAPoolPEM []byte) []*pkix.Name {
+	certPool, err := LoadOriginCertPool(originCAPoolPEM)
+	if isUnrecoverableError(err) {
+		t.Fatal(err)
+	}
+	assert.NotEmpty(t, certPool.Subjects())
+	certPoolSubjects, err := getCertPoolSubjects(certPool)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return certPoolSubjects
+}
+
+func assertFixturesMatchSubjects(t *testing.T, fixtures []*certificateFixture, subjects []*pkix.Name) {
+	assert.Equal(t, len(fixtures), len(subjects))
+
+	for _, fixture := range fixtures {
+		found := false
+		for _, subject := range subjects {
+			found = found || fixtureMatchesSubjectPredicate(fixture, subject)
+		}
+
+		if !found {
+			t.Fail()
+		}
+	}
+}
+
+func fixtureMatchesSubjectPredicate(fixture *certificateFixture, subject *pkix.Name) bool {
+	cnMatch := true
+	if fixture.cn != "" {
+		cnMatch = fixture.cn == subject.CommonName
+	}
+
+	ouMatch := true
+	if fixture.ou != "" {
+		ouMatch = len(subject.OrganizationalUnit) > 0 && fixture.ou == subject.OrganizationalUnit[0]
+	}
+
+	return cnMatch && ouMatch
+}
+
+func subjectSubtract(left []*pkix.Name, right []*pkix.Name) []*pkix.Name {
+	var difference []*pkix.Name
+
+	var found bool
+	for _, r := range right {
+		found = false
+		for _, l := range left {
+			if (*l).String() == (*r).String() {
+				found = true
+			}
+		}
+
+		if !found {
+			difference = append(difference, r)
+		}
+	}
+
+	return difference
+}
+
+func getCertPoolSubjects(certPool *x509.CertPool) ([]*pkix.Name, error) {
+	var subjects []*pkix.Name
+
+	for _, subject := range certPool.Subjects() {
+		var sequence pkix.RDNSequence
+		_, err := asn1.Unmarshal(subject, &sequence)
+		if err != nil {
+			return nil, err
+		}
+
+		name := pkix.Name{}
+		name.FillFromRDNSequence(&sequence)
+
+		subjects = append(subjects, &name)
+	}
+
+	return subjects, nil
+}
+
+func isUnrecoverableError(err error) bool {
+	return err != nil && err.Error() != "crypto/x509: system root pool is not available on Windows"
 }
@@ -1,11 +1,10 @@
 package tunneldns

 import (
-	"context"
-
 	"github.com/coredns/coredns/plugin"
 	"github.com/miekg/dns"
 	"github.com/pkg/errors"
+	"golang.org/x/net/context"
 )

 // Upstream is a simplified interface for proxy destination
@@ -2,7 +2,6 @@ package tunneldns

 import (
 	"bytes"
-	"context"
 	"crypto/tls"
 	"fmt"
 	"io/ioutil"
@@ -13,6 +12,7 @@ import (
 	"github.com/miekg/dns"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/net/context"
 	"golang.org/x/net/http2"
 )

@@ -1,8 +1,6 @@
 package tunneldns

 import (
-	"context"
-
 	"github.com/coredns/coredns/plugin"
 	"github.com/coredns/coredns/plugin/metrics/vars"
 	"github.com/coredns/coredns/plugin/pkg/dnstest"
@@ -10,6 +8,7 @@ import (
 	"github.com/coredns/coredns/request"
 	"github.com/miekg/dns"
 	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/net/context"
 )

 // MetricsPlugin is an adapter for CoreDNS and built-in metrics
@@ -1,9 +1,8 @@
 package tunnelrpc

 import (
-	"context"
-
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/net/context"
 	"golang.org/x/net/trace"
 	"zombiezen.com/go/capnproto2/rpc"
 )
@@ -3,9 +3,9 @@ package tunnelrpc

 import (
 	"bytes"
-	"context"

 	log "github.com/sirupsen/logrus"
+	"golang.org/x/net/context"
 	"zombiezen.com/go/capnproto2/encoding/text"
 	"zombiezen.com/go/capnproto2/rpc"
 	rpccapnp "zombiezen.com/go/capnproto2/std/capnp/rpc"
@@ -6,10 +6,9 @@ import (
 	"net/url"
 	"strings"

-	"net/http"
-
 	"github.com/pkg/errors"
 	"golang.org/x/net/idna"
+	"net/http"
 )

 const defaultScheme = "http"
@@ -138,40 +137,26 @@ func validateIP(scheme, host, port string) (string, error) {
 	return fmt.Sprintf("%s://%s", scheme, host), nil
 }

-func ValidateHTTPService(originURL string, hostname string, transport http.RoundTripper) error {
+func ValidateHTTPService(originURL string, transport http.RoundTripper) error {
 	parsedURL, err := url.Parse(originURL)
 	if err != nil {
 		return err
 	}

-	client := &http.Client{
-		Transport: transport,
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			return http.ErrUseLastResponse
-		},
-	}
+	client := &http.Client{Transport: transport}

-	initialRequest, err := http.NewRequest("GET", parsedURL.String(), nil)
-	if err != nil {
-		return err
-	}
-	initialRequest.Host = hostname
-	_, initialErr := client.Do(initialRequest)
-	if initialErr != nil {
+	initialResponse, initialErr := client.Get(parsedURL.String())
+	if initialErr != nil || initialResponse.StatusCode != http.StatusOK {
 		// Attempt the same endpoint via the other protocol (http/https); maybe we have better luck?
 		oldScheme := parsedURL.Scheme
 		parsedURL.Scheme = toggleProtocol(parsedURL.Scheme)

-		secondRequest, err := http.NewRequest("GET", parsedURL.String(), nil)
-		if err != nil {
-			return err
-		}
-		secondRequest.Host = hostname
-		_, secondErr := client.Do(secondRequest)
-		if secondErr == nil { // Worked this time--advise the user to switch protocols
+		secondResponse, _ := client.Get(parsedURL.String())
+
+		if secondResponse != nil && secondResponse.StatusCode == http.StatusOK { // Worked this time--advise the user to switch protocols
 			return errors.Errorf(
 				"%s doesn't seem to work over %s, but does seem to work over %s. Consider changing the origin URL to %s",
-				parsedURL.Host,
+				parsedURL.Hostname(),
 				oldScheme,
 				parsedURL.Scheme,
 				parsedURL,
@@ -1,21 +1,18 @@
 package validation

 import (
-	"bytes"
 	"fmt"
-	"io/ioutil"
 	"testing"

 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"github.com/stretchr/testify/assert"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strings"
-
-	"github.com/stretchr/testify/assert"
 )

 func TestValidateHostname(t *testing.T) {
@@ -153,248 +150,58 @@ func TestToggleProtocol(t *testing.T) {
 	assert.Equal(t, "", toggleProtocol(""))
 }

-// Happy path 1: originURL is HTTP, and HTTP connections work
 func TestValidateHTTPService_HTTP2HTTP(t *testing.T) {
-	originURL := "http://127.0.0.1/"
-	hostname := "example.com"
-
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			return emptyResponse(200), nil
-		}
-		if req.URL.Scheme == "https" {
-			t.Fatal("http works, shouldn't have tried with https")
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			return emptyResponse(503), nil
-		}
-		if req.URL.Scheme == "https" {
-			t.Fatal("http works, shouldn't have tried with https")
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	// Integration-style test with a mock server
 	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, hostname, r.Host)
 		w.WriteHeader(200)
 	}))
 	assert.NoError(t, err)
 	defer server.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, client.Transport))
-
-	// this will fail if the client follows the 302
-	redirectServer, redirectClient, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/followedRedirect" {
-			t.Fatal("shouldn't have followed the 302")
-		}
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:443", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.Header().Set("Location", "/followedRedirect")
-		w.WriteHeader(302)
-	}))
-	assert.NoError(t, err)
-	defer redirectServer.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))

+	assert.Equal(t, nil, ValidateHTTPService("http://example.com/", client.Transport))
 }

-// Happy path 2: originURL is HTTPS, and HTTPS connections work
-func TestValidateHTTPService_HTTPS2HTTPS(t *testing.T) {
-	originURL := "https://127.0.0.1/"
-	hostname := "example.com"
-
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			t.Fatal("https works, shouldn't have tried with http")
-		}
-		if req.URL.Scheme == "https" {
-			return emptyResponse(200), nil
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			t.Fatal("https works, shouldn't have tried with http")
-		}
-		if req.URL.Scheme == "https" {
-			return emptyResponse(503), nil
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	// Integration-style test with a mock server
-	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:443", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.WriteHeader(200)
+func TestValidateHTTPService_ServerNonOKResponse(t *testing.T) {
+	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(400)
 	}))
 	assert.NoError(t, err)
 	defer server.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, client.Transport))

-	// this will fail if the client follows the 302
-	redirectServer, redirectClient, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/followedRedirect" {
-			t.Fatal("shouldn't have followed the 302")
-		}
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:443", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.Header().Set("Location", "/followedRedirect")
-		w.WriteHeader(302)
-	}))
-	assert.NoError(t, err)
-	defer redirectServer.Close()
-	assert.Nil(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
+	assert.Equal(t, nil, ValidateHTTPService("http://example.com/", client.Transport))
 }

-// Error path 1: originURL is HTTPS, but HTTP connections work
 func TestValidateHTTPService_HTTPS2HTTP(t *testing.T) {
-	originURL := "https://127.0.0.1:1234/"
-	hostname := "example.com"
-
-	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			return emptyResponse(200), nil
-		}
-		if req.URL.Scheme == "https" {
-			return nil, assert.AnError
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			return emptyResponse(503), nil
-		}
-		if req.URL.Scheme == "https" {
-			return nil, assert.AnError
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	// Integration-style test with a mock server
 	server, client, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:1234", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
 		w.WriteHeader(200)
 	}))
 	assert.NoError(t, err)
 	defer server.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, client.Transport))
-
-	// this will fail if the client follows the 302
-	redirectServer, redirectClient, err := createMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/followedRedirect" {
-			t.Fatal("shouldn't have followed the 302")
-		}
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:1234", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.Header().Set("Location", "/followedRedirect")
-		w.WriteHeader(302)
-	}))
-	assert.NoError(t, err)
-	defer redirectServer.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))

+	assert.Equal(t,
+		"example.com doesn't seem to work over https, but does seem to work over http. Consider changing the origin URL to http://example.com:1234/",
+		ValidateHTTPService("https://example.com:1234/", client.Transport).Error())
 }

-// Error path 2: originURL is HTTP, but HTTPS connections work
-func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
-	originURL := "http://127.0.0.1:1234/"
-	hostname := "example.com"
-
-	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			return nil, assert.AnError
-		}
-		if req.URL.Scheme == "https" {
-			return emptyResponse(200), nil
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	assert.Error(t, ValidateHTTPService(originURL, hostname, testRoundTripper(func(req *http.Request) (*http.Response, error) {
-		assert.Equal(t, req.Host, hostname)
-		if req.URL.Scheme == "http" {
-			return nil, assert.AnError
-		}
-		if req.URL.Scheme == "https" {
-			return emptyResponse(503), nil
-		}
-		panic("Shouldn't reach here")
-	})))
-
-	// Integration-style test with a mock server
+func TestValidateHTTPService_HTTPS2HTTPS(t *testing.T) {
 	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:1234", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
 		w.WriteHeader(200)
 	}))
 	assert.NoError(t, err)
 	defer server.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, client.Transport))

-	// this will fail if the client follows the 302
-	redirectServer, redirectClient, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/followedRedirect" {
-			t.Fatal("shouldn't have followed the 302")
-		}
-		if r.Method == "CONNECT" {
-			assert.Equal(t, "127.0.0.1:443", r.Host)
-		} else {
-			assert.Equal(t, hostname, r.Host)
-		}
-		w.Header().Set("Location", "/followedRedirect")
-		w.WriteHeader(302)
+	assert.Equal(t, nil, ValidateHTTPService("https://example.com/", client.Transport))
+}
+
+func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
+	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(200)
 	}))
 	assert.NoError(t, err)
-	defer redirectServer.Close()
-	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
-}
+	defer server.Close()

-type testRoundTripper func(req *http.Request) (*http.Response, error)
-
-func (f testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	return f(req)
-}
-
-func emptyResponse(statusCode int) *http.Response {
-	return &http.Response{
-		StatusCode: statusCode,
-		Body:       ioutil.NopCloser(bytes.NewReader(nil)),
-		Header:     make(http.Header),
-	}
+	assert.Equal(t,
+		"example.com doesn't seem to work over http, but does seem to work over https. Consider changing the origin URL to https://example.com:1234/",
+		ValidateHTTPService("http://example.com:1234/", client.Transport).Error())
 }

 func createMockServerAndClient(handler http.Handler) (*httptest.Server, *http.Client, error) {
@@ -1,27 +0,0 @@
-Copyright (c) 2013 CloudFlare, Inc. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of the CloudFlare, Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -1,3 +0,0 @@
-cover.out~
-benchmark/benchmark
-
@@ -1,41 +0,0 @@
-# Copyright (c) 2013 CloudFlare, Inc.
-
-RACE+=--race
-
-PKGNAME=github.com/cloudflare/golibs/lrucache
-SKIPCOVER=list.go|list_extension.go|priorityqueue.go
-
-.PHONY: all test bench cover clean
-
-all:
-	@echo "Targets:"
-	@echo "  test: run tests with race detector"
-	@echo "  cover: print test coverage"
-	@echo "  bench: run basic benchmarks"
-
-test:
-	@go test $(RACE) -bench=. -v $(PKGNAME)
-
-COVEROUT=cover.out
-cover:
-	@go test -coverprofile=$(COVEROUT) -v $(PKGNAME)
-	@cat $(COVEROUT) | egrep -v '$(SKIPCOVER)' > $(COVEROUT)~
-	@go tool cover -func=$(COVEROUT)~|sed 's|^.*/\([^/]*/[^/]*/[^/]*\)$$|\1|g'
-
-bench:
-	@echo "[*] Scalability of cache/lrucache"
-	@echo "[ ] Operations in shared cache using one core"
-	@GOMAXPROCS=1 go test -run=- -bench='.*LRUCache.*' $(PKGNAME) \
-		| egrep -v "^PASS|^ok"
-
-	@echo "[*] Scalability of cache/multilru"
-	@echo "[ ] Operations in four caches using four cores	"
-	@GOMAXPROCS=4 go test -run=- -bench='.*MultiLRU.*' $(PKGNAME) \
-		| egrep -v "^PASS|^ok"
-
-
-	@(cd benchmark; go build $(PKGNAME)/benchmark)
-	@./benchmark/benchmark
-
-clean:
-	rm -rf $(COVEROUT) $(COVEROUT)~ benchmark/benchmark
@@ -1,40 +0,0 @@
-LRU Cache
---------
-
-A `golang` implementation of last recently used cache data structure.
-
-To install:
-
-    go get github.com/cloudflare/golibs/lrucache
-
-To test:
-
-    cd $GOPATH/src/github.com/cloudflare/golibs/lrucache
-    make test
-
-For coverage:
-
-    make cover
-
-Basic benchmarks:
-
-    $ make bench  # As tested on my two core i5
-    [*] Scalability of cache/lrucache
-    [ ] Operations in shared cache using one core
-    BenchmarkConcurrentGetLRUCache       5000000               450 ns/op
-    BenchmarkConcurrentSetLRUCache       2000000               821 ns/op
-    BenchmarkConcurrentSetNXLRUCache     5000000               664 ns/op
-
-    [*] Scalability of cache/multilru
-    [ ] Operations in four caches using four cores
-    BenchmarkConcurrentGetMultiLRU-4     5000000               475 ns/op
-    BenchmarkConcurrentSetMultiLRU-4     2000000               809 ns/op
-    BenchmarkConcurrentSetNXMultiLRU-4   5000000               643 ns/op
-
-    [*] Capacity=4096 Keys=30000 KeySpace=15625
-                vitess          LRUCache        MultiLRUCache-4
-    create      1.709us         1.626374ms      343.54us
-    Get (miss)  144.266083ms    132.470397ms    177.277193ms
-    SetNX #1    338.637977ms    380.733302ms    411.709204ms
-    Get (hit)   195.896066ms    173.252112ms    234.109494ms
-    SetNX #2    349.785951ms    367.255624ms    419.129127ms
@@ -1,69 +0,0 @@
-// Copyright (c) 2013 CloudFlare, Inc.
-
-// Package lrucache implements a last recently used cache data structure.
-//
-// This code tries to avoid dynamic memory allocations - all required
-// memory is allocated on creation.  Access to the data structure is
-// O(1). Modification O(log(n)) if expiry is used, O(1)
-// otherwise.
-//
-// This package exports three things:
-//  LRUCache: is the main implementation. It supports multithreading by
-//      using guarding mutex lock.
-//
-//  MultiLRUCache: is a sharded implementation. It supports the same
-//      API as LRUCache and uses it internally, but is not limited to
-//      a single CPU as every shard is separately locked. Use this
-//      data structure instead of LRUCache if you have have lock
-//      contention issues.
-//
-//  Cache interface: Both implementations fulfill it.
-package lrucache
-
-import (
-	"time"
-)
-
-// Cache interface is fulfilled by the LRUCache and MultiLRUCache
-// implementations.
-type Cache interface {
-	// Methods not needing to know current time.
-	//
-	// Get a key from the cache, possibly stale. Update its LRU
-	// score.
-	Get(key string) (value interface{}, ok bool)
-	// Get a key from the cache, possibly stale. Don't modify its LRU score. O(1)
-	GetQuiet(key string) (value interface{}, ok bool)
-	// Get and remove a key from the cache.
-	Del(key string) (value interface{}, ok bool)
-	// Evict all items from the cache.
-	Clear() int
-	// Number of entries used in the LRU
-	Len() int
-	// Get the total capacity of the LRU
-	Capacity() int
-
-	// Methods use time.Now() when neccessary to determine expiry.
-	//
-	// Add an item to the cache overwriting existing one if it
-	// exists.
-	Set(key string, value interface{}, expire time.Time)
-	// Get a key from the cache, make sure it's not stale. Update
-	// its LRU score.
-	GetNotStale(key string) (value interface{}, ok bool)
-	// Evict all the expired items.
-	Expire() int
-
-	// Methods allowing to explicitly specify time used to
-	// determine if items are expired.
-	//
-	// Add an item to the cache overwriting existing one if it
-	// exists. Allows specifing current time required to expire an
-	// item when no more slots are used.
-	SetNow(key string, value interface{}, expire time.Time, now time.Time)
-	// Get a key from the cache, make sure it's not stale. Update
-	// its LRU score.
-	GetNotStaleNow(key string, now time.Time) (value interface{}, ok bool)
-	// Evict items that expire before Now.
-	ExpireNow(now time.Time) int
-}
@@ -1,238 +0,0 @@
-// Copyright 2009 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-/* This file is a slightly modified file from the go package sources
-and is released on the following license:
-
-Copyright (c) 2012 The Go Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-// Package list implements a doubly linked list.
-//
-// To iterate over a list (where l is a *List):
-//	for e := l.Front(); e != nil; e = e.Next() {
-//		// do something with e.Value
-//	}
-//
-
-package lrucache
-
-// Element is an element of a linked list.
-type element struct {
-	// Next and previous pointers in the doubly-linked list of elements.
-	// To simplify the implementation, internally a list l is implemented
-	// as a ring, such that &l.root is both the next element of the last
-	// list element (l.Back()) and the previous element of the first list
-	// element (l.Front()).
-	next, prev *element
-
-	// The list to which this element belongs.
-	list *list
-
-	// The value stored with this element.
-	Value interface{}
-}
-
-// Next returns the next list element or nil.
-func (e *element) Next() *element {
-	if p := e.next; e.list != nil && p != &e.list.root {
-		return p
-	}
-	return nil
-}
-
-// Prev returns the previous list element or nil.
-func (e *element) Prev() *element {
-	if p := e.prev; e.list != nil && p != &e.list.root {
-		return p
-	}
-	return nil
-}
-
-// List represents a doubly linked list.
-// The zero value for List is an empty list ready to use.
-type list struct {
-	root element // sentinel list element, only &root, root.prev, and root.next are used
-	len  int     // current list length excluding (this) sentinel element
-}
-
-// Init initializes or clears list l.
-func (l *list) Init() *list {
-	l.root.next = &l.root
-	l.root.prev = &l.root
-	l.len = 0
-	return l
-}
-
-// New returns an initialized list.
-// func New() *list { return new(list).Init() }
-
-// Len returns the number of elements of list l.
-// The complexity is O(1).
-func (l *list) Len() int { return l.len }
-
-// Front returns the first element of list l or nil
-func (l *list) Front() *element {
-	if l.len == 0 {
-		return nil
-	}
-	return l.root.next
-}
-
-// Back returns the last element of list l or nil.
-func (l *list) Back() *element {
-	if l.len == 0 {
-		return nil
-	}
-	return l.root.prev
-}
-
-// insert inserts e after at, increments l.len, and returns e.
-func (l *list) insert(e, at *element) *element {
-	n := at.next
-	at.next = e
-	e.prev = at
-	e.next = n
-	n.prev = e
-	e.list = l
-	l.len++
-	return e
-}
-
-// insertValue is a convenience wrapper for insert(&Element{Value: v}, at).
-func (l *list) insertValue(v interface{}, at *element) *element {
-	return l.insert(&element{Value: v}, at)
-}
-
-// remove removes e from its list, decrements l.len, and returns e.
-func (l *list) remove(e *element) *element {
-	e.prev.next = e.next
-	e.next.prev = e.prev
-	e.next = nil // avoid memory leaks
-	e.prev = nil // avoid memory leaks
-	e.list = nil
-	l.len--
-	return e
-}
-
-// Remove removes e from l if e is an element of list l.
-// It returns the element value e.Value.
-func (l *list) Remove(e *element) interface{} {
-	if e.list == l {
-		// if e.list == l, l must have been initialized when e was inserted
-		// in l or l == nil (e is a zero Element) and l.remove will crash
-		l.remove(e)
-	}
-	return e.Value
-}
-
-// PushFront inserts a new element e with value v at the front of list l and returns e.
-func (l *list) PushFront(v interface{}) *element {
-	return l.insertValue(v, &l.root)
-}
-
-// PushBack inserts a new element e with value v at the back of list l and returns e.
-func (l *list) PushBack(v interface{}) *element {
-	return l.insertValue(v, l.root.prev)
-}
-
-// InsertBefore inserts a new element e with value v immediately before mark and returns e.
-// If mark is not an element of l, the list is not modified.
-func (l *list) InsertBefore(v interface{}, mark *element) *element {
-	if mark.list != l {
-		return nil
-	}
-	// see comment in List.Remove about initialization of l
-	return l.insertValue(v, mark.prev)
-}
-
-// InsertAfter inserts a new element e with value v immediately after mark and returns e.
-// If mark is not an element of l, the list is not modified.
-func (l *list) InsertAfter(v interface{}, mark *element) *element {
-	if mark.list != l {
-		return nil
-	}
-	// see comment in List.Remove about initialization of l
-	return l.insertValue(v, mark)
-}
-
-// MoveToFront moves element e to the front of list l.
-// If e is not an element of l, the list is not modified.
-func (l *list) MoveToFront(e *element) {
-	if e.list != l || l.root.next == e {
-		return
-	}
-	// see comment in List.Remove about initialization of l
-	l.insert(l.remove(e), &l.root)
-}
-
-// MoveToBack moves element e to the back of list l.
-// If e is not an element of l, the list is not modified.
-func (l *list) MoveToBack(e *element) {
-	if e.list != l || l.root.prev == e {
-		return
-	}
-	// see comment in List.Remove about initialization of l
-	l.insert(l.remove(e), l.root.prev)
-}
-
-// MoveBefore moves element e to its new position before mark.
-// If e is not an element of l, or e == mark, the list is not modified.
-func (l *list) MoveBefore(e, mark *element) {
-	if e.list != l || e == mark {
-		return
-	}
-	l.insert(l.remove(e), mark.prev)
-}
-
-// MoveAfter moves element e to its new position after mark.
-// If e is not an element of l, or e == mark, the list is not modified.
-func (l *list) MoveAfter(e, mark *element) {
-	if e.list != l || e == mark {
-		return
-	}
-	l.insert(l.remove(e), mark)
-}
-
-// PushBackList inserts a copy of an other list at the back of list l.
-// The lists l and other may be the same.
-func (l *list) PushBackList(other *list) {
-	for i, e := other.Len(), other.Front(); i > 0; i, e = i-1, e.Next() {
-		l.insertValue(e.Value, l.root.prev)
-	}
-}
-
-// PushFrontList inserts a copy of an other list at the front of list l.
-// The lists l and other may be the same.
-func (l *list) PushFrontList(other *list) {
-	for i, e := other.Len(), other.Back(); i > 0; i, e = i-1, e.Prev() {
-		l.insertValue(e.Value, &l.root)
-	}
-}
@@ -1,25 +0,0 @@
-// Copyright (c) 2013 CloudFlare, Inc.
-
-// Extensions to "container/list" that allowing reuse of Elements.
-
-package lrucache
-
-func (l *list) PushElementFront(e *element) *element {
-	return l.insert(e, &l.root)
-}
-
-func (l *list) PushElementBack(e *element) *element {
-	return l.insert(e, l.root.prev)
-}
-
-func (l *list) PopElementFront() *element {
-	el := l.Front()
-	l.Remove(el)
-	return el
-}
-
-func (l *list) PopFront() interface{} {
-	el := l.Front()
-	l.Remove(el)
-	return el.Value
-}
@@ -1,316 +0,0 @@
-// Copyright (c) 2013 CloudFlare, Inc.
-
-package lrucache
-
-import (
-	"container/heap"
-	"sync"
-	"time"
-)
-
-// Every element in the cache is linked to three data structures:
-// Table map, PriorityQueue heap ordered by expiry and a LruList list
-// ordered by decreasing popularity.
-type entry struct {
-	element element     // list element. value is a pointer to this entry
-	key     string      // key is a key!
-	value   interface{} //
-	expire  time.Time   // time when the item is expired. it's okay to be stale.
-	index   int         // index for priority queue needs. -1 if entry is free
-}
-
-// LRUCache data structure. Never dereference it or copy it by
-// value. Always use it through a pointer.
-type LRUCache struct {
-	lock          sync.Mutex
-	table         map[string]*entry // all entries in table must be in lruList
-	priorityQueue priorityQueue     // some elements from table may be in priorityQueue
-	lruList       list              // every entry is either used and resides in lruList
-	freeList      list              // or free and is linked to freeList
-
-	ExpireGracePeriod time.Duration // time after an expired entry is purged from cache (unless pushed out of LRU)
-}
-
-// Initialize the LRU cache instance. O(capacity)
-func (b *LRUCache) Init(capacity uint) {
-	b.table = make(map[string]*entry, capacity)
-	b.priorityQueue = make([]*entry, 0, capacity)
-	b.lruList.Init()
-	b.freeList.Init()
-	heap.Init(&b.priorityQueue)
-
-	// Reserve all the entries in one giant continous block of memory
-	arrayOfEntries := make([]entry, capacity)
-	for i := uint(0); i < capacity; i++ {
-		e := &arrayOfEntries[i]
-		e.element.Value = e
-		e.index = -1
-		b.freeList.PushElementBack(&e.element)
-	}
-}
-
-// Create new LRU cache instance. Allocate all the needed memory. O(capacity)
-func NewLRUCache(capacity uint) *LRUCache {
-	b := &LRUCache{}
-	b.Init(capacity)
-	return b
-}
-
-// Give me the entry with lowest expiry field if it's before now.
-func (b *LRUCache) expiredEntry(now time.Time) *entry {
-	if len(b.priorityQueue) == 0 {
-		return nil
-	}
-
-	if now.IsZero() {
-		// Fill it only when actually used.
-		now = time.Now()
-	}
-
-	if e := b.priorityQueue[0]; e.expire.Before(now) {
-		return e
-	}
-	return nil
-}
-
-// Give me the least used entry.
-func (b *LRUCache) leastUsedEntry() *entry {
-	return b.lruList.Back().Value.(*entry)
-}
-
-func (b *LRUCache) freeSomeEntry(now time.Time) (e *entry, used bool) {
-	if b.freeList.Len() > 0 {
-		return b.freeList.Front().Value.(*entry), false
-	}
-
-	e = b.expiredEntry(now)
-	if e != nil {
-		return e, true
-	}
-
-	if b.lruList.Len() == 0 {
-		return nil, false
-	}
-
-	return b.leastUsedEntry(), true
-}
-
-// Move entry from used/lru list to a free list. Clear the entry as well.
-func (b *LRUCache) removeEntry(e *entry) {
-	if e.element.list != &b.lruList {
-		panic("list lruList")
-	}
-
-	if e.index != -1 {
-		heap.Remove(&b.priorityQueue, e.index)
-	}
-	b.lruList.Remove(&e.element)
-	b.freeList.PushElementFront(&e.element)
-	delete(b.table, e.key)
-	e.key = ""
-	e.value = nil
-}
-
-func (b *LRUCache) insertEntry(e *entry) {
-	if e.element.list != &b.freeList {
-		panic("list freeList")
-	}
-
-	if !e.expire.IsZero() {
-		heap.Push(&b.priorityQueue, e)
-	}
-	b.freeList.Remove(&e.element)
-	b.lruList.PushElementFront(&e.element)
-	b.table[e.key] = e
-}
-
-func (b *LRUCache) touchEntry(e *entry) {
-	b.lruList.MoveToFront(&e.element)
-}
-
-// Add an item to the cache overwriting existing one if it
-// exists. Allows specifing current time required to expire an item
-// when no more slots are used. O(log(n)) if expiry is set, O(1) when
-// clear.
-func (b *LRUCache) SetNow(key string, value interface{}, expire time.Time, now time.Time) {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	var used bool
-
-	e := b.table[key]
-	if e != nil {
-		used = true
-	} else {
-		e, used = b.freeSomeEntry(now)
-		if e == nil {
-			return
-		}
-	}
-	if used {
-		b.removeEntry(e)
-	}
-
-	e.key = key
-	e.value = value
-	e.expire = expire
-	b.insertEntry(e)
-}
-
-// Add an item to the cache overwriting existing one if it
-// exists. O(log(n)) if expiry is set, O(1) when clear.
-func (b *LRUCache) Set(key string, value interface{}, expire time.Time) {
-	b.SetNow(key, value, expire, time.Time{})
-}
-
-// Get a key from the cache, possibly stale. Update its LRU score. O(1)
-func (b *LRUCache) Get(key string) (v interface{}, ok bool) {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	e := b.table[key]
-	if e == nil {
-		return nil, false
-	}
-
-	b.touchEntry(e)
-	return e.value, true
-}
-
-// Get a key from the cache, possibly stale. Don't modify its LRU score. O(1)
-func (b *LRUCache) GetQuiet(key string) (v interface{}, ok bool) {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	e := b.table[key]
-	if e == nil {
-		return nil, false
-	}
-
-	return e.value, true
-}
-
-// Get a key from the cache, make sure it's not stale. Update its
-// LRU score. O(log(n)) if the item is expired.
-func (b *LRUCache) GetNotStale(key string) (value interface{}, ok bool) {
-	return b.GetNotStaleNow(key, time.Now())
-}
-
-// Get a key from the cache, make sure it's not stale. Update its
-// LRU score. O(log(n)) if the item is expired.
-func (b *LRUCache) GetNotStaleNow(key string, now time.Time) (value interface{}, ok bool) {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	e := b.table[key]
-	if e == nil {
-		return nil, false
-	}
-
-	if e.expire.Before(now) {
-		// Remove entries expired for more than a graceful period
-		if b.ExpireGracePeriod == 0 || e.expire.Sub(now) > b.ExpireGracePeriod {
-			b.removeEntry(e)
-		}
-		return nil, false
-	}
-
-	b.touchEntry(e)
-	return e.value, true
-}
-
-// Get a key from the cache, possibly stale. Update its LRU
-// score. O(1) always.
-func (b *LRUCache) GetStale(key string) (value interface{}, ok, expired bool) {
-	return b.GetStaleNow(key, time.Now())
-}
-
-// Get a key from the cache, possibly stale. Update its LRU
-// score. O(1) always.
-func (b *LRUCache) GetStaleNow(key string, now time.Time) (value interface{}, ok, expired bool) {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	e := b.table[key]
-	if e == nil {
-		return nil, false, false
-	}
-
-	b.touchEntry(e)
-	return e.value, true, e.expire.Before(now)
-}
-
-// Get and remove a key from the cache. O(log(n)) if the item is using expiry, O(1) otherwise.
-func (b *LRUCache) Del(key string) (v interface{}, ok bool) {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	e := b.table[key]
-	if e == nil {
-		return nil, false
-	}
-
-	value := e.value
-	b.removeEntry(e)
-	return value, true
-}
-
-// Evict all items from the cache. O(n*log(n))
-func (b *LRUCache) Clear() int {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	// First, remove entries that have expiry set
-	l := len(b.priorityQueue)
-	for i := 0; i < l; i++ {
-		// This could be reduced to O(n).
-		b.removeEntry(b.priorityQueue[0])
-	}
-
-	// Second, remove all remaining entries
-	r := b.lruList.Len()
-	for i := 0; i < r; i++ {
-		b.removeEntry(b.leastUsedEntry())
-	}
-	return l + r
-}
-
-// Evict all the expired items. O(n*log(n))
-func (b *LRUCache) Expire() int {
-	return b.ExpireNow(time.Now())
-}
-
-// Evict items that expire before `now`. O(n*log(n))
-func (b *LRUCache) ExpireNow(now time.Time) int {
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	i := 0
-	for {
-		e := b.expiredEntry(now)
-		if e == nil {
-			break
-		}
-		b.removeEntry(e)
-		i += 1
-	}
-	return i
-}
-
-// Number of entries used in the LRU
-func (b *LRUCache) Len() int {
-	// yes. this stupid thing requires locking
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	return b.lruList.Len()
-}
-
-// Get the total capacity of the LRU
-func (b *LRUCache) Capacity() int {
-	// yes. this stupid thing requires locking
-	b.lock.Lock()
-	defer b.lock.Unlock()
-
-	return b.lruList.Len() + b.freeList.Len()
-}
@@ -1,118 +0,0 @@
-// Copyright (c) 2013 CloudFlare, Inc.
-
-package lrucache
-
-import (
-	"hash/crc32"
-	"time"
-)
-
-// MultiLRUCache data structure. Never dereference it or copy it by
-// value. Always use it through a pointer.
-type MultiLRUCache struct {
-	buckets uint
-	cache   []*LRUCache
-}
-
-// Using this constructor is almost always wrong. Use NewMultiLRUCache instead.
-func (m *MultiLRUCache) Init(buckets, bucket_capacity uint) {
-	m.buckets = buckets
-	m.cache = make([]*LRUCache, buckets)
-	for i := uint(0); i < buckets; i++ {
-		m.cache[i] = NewLRUCache(bucket_capacity)
-	}
-}
-
-// Set the stale expiry grace period for each cache in the multicache instance.
-func (m *MultiLRUCache) SetExpireGracePeriod(p time.Duration) {
-	for _, c := range m.cache {
-		c.ExpireGracePeriod = p
-	}
-}
-
-func NewMultiLRUCache(buckets, bucket_capacity uint) *MultiLRUCache {
-	m := &MultiLRUCache{}
-	m.Init(buckets, bucket_capacity)
-	return m
-}
-
-func (m *MultiLRUCache) bucketNo(key string) uint {
-	// Arbitrary choice. Any fast hash will do.
-	return uint(crc32.ChecksumIEEE([]byte(key))) % m.buckets
-}
-
-func (m *MultiLRUCache) Set(key string, value interface{}, expire time.Time) {
-	m.cache[m.bucketNo(key)].Set(key, value, expire)
-}
-
-func (m *MultiLRUCache) SetNow(key string, value interface{}, expire time.Time, now time.Time) {
-	m.cache[m.bucketNo(key)].SetNow(key, value, expire, now)
-}
-
-func (m *MultiLRUCache) Get(key string) (value interface{}, ok bool) {
-	return m.cache[m.bucketNo(key)].Get(key)
-}
-
-func (m *MultiLRUCache) GetQuiet(key string) (value interface{}, ok bool) {
-	return m.cache[m.bucketNo(key)].Get(key)
-}
-
-func (m *MultiLRUCache) GetNotStale(key string) (value interface{}, ok bool) {
-	return m.cache[m.bucketNo(key)].GetNotStale(key)
-}
-
-func (m *MultiLRUCache) GetNotStaleNow(key string, now time.Time) (value interface{}, ok bool) {
-	return m.cache[m.bucketNo(key)].GetNotStaleNow(key, now)
-}
-
-func (m *MultiLRUCache) GetStale(key string) (value interface{}, ok, expired bool) {
-	return m.cache[m.bucketNo(key)].GetStale(key)
-}
-
-func (m *MultiLRUCache) GetStaleNow(key string, now time.Time) (value interface{}, ok, expired bool) {
-	return m.cache[m.bucketNo(key)].GetStaleNow(key, now)
-}
-
-func (m *MultiLRUCache) Del(key string) (value interface{}, ok bool) {
-	return m.cache[m.bucketNo(key)].Del(key)
-}
-
-func (m *MultiLRUCache) Clear() int {
-	var s int
-	for _, c := range m.cache {
-		s += c.Clear()
-	}
-	return s
-}
-
-func (m *MultiLRUCache) Len() int {
-	var s int
-	for _, c := range m.cache {
-		s += c.Len()
-	}
-	return s
-}
-
-func (m *MultiLRUCache) Capacity() int {
-	var s int
-	for _, c := range m.cache {
-		s += c.Capacity()
-	}
-	return s
-}
-
-func (m *MultiLRUCache) Expire() int {
-	var s int
-	for _, c := range m.cache {
-		s += c.Expire()
-	}
-	return s
-}
-
-func (m *MultiLRUCache) ExpireNow(now time.Time) int {
-	var s int
-	for _, c := range m.cache {
-		s += c.ExpireNow(now)
-	}
-	return s
-}
@@ -1,37 +0,0 @@
-// Copyright (c) 2013 CloudFlare, Inc.
-
-// This code is based on golang example from "container/heap" package.
-
-package lrucache
-
-type priorityQueue []*entry
-
-func (pq priorityQueue) Len() int {
-	return len(pq)
-}
-
-func (pq priorityQueue) Less(i, j int) bool {
-	return pq[i].expire.Before(pq[j].expire)
-}
-
-func (pq priorityQueue) Swap(i, j int) {
-	pq[i], pq[j] = pq[j], pq[i]
-	pq[i].index = i
-	pq[j].index = j
-}
-
-func (pq *priorityQueue) Push(e interface{}) {
-	n := len(*pq)
-	item := e.(*entry)
-	item.index = n
-	*pq = append(*pq, item)
-}
-
-func (pq *priorityQueue) Pop() interface{} {
-	old := *pq
-	n := len(old)
-	item := old[n-1]
-	item.index = -1
-	*pq = old[0 : n-1]
-	return item
-}
@@ -150,7 +150,7 @@ func StartProxyServer(logger *logrus.Logger, listener net.Listener, remote strin
 		done := make(chan struct{})
 		go pinger(logger, conn, done)
 		defer func() {
-			done <- struct{}{}
+			<-done
 			conn.Close()
 		}()
 		Stream(&Conn{conn}, stream)
@@ -2,17 +2,18 @@ package websocket

 import (
 	"crypto/tls"
-	"crypto/x509"
 	"io"
 	"math/rand"
 	"net/http"
 	"testing"

-	"github.com/cloudflare/cloudflared/hello"
-	"github.com/cloudflare/cloudflared/tlsconfig"
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
+
 	"golang.org/x/net/websocket"
+
+	"github.com/cloudflare/cloudflared/hello"
+	"github.com/cloudflare/cloudflared/tlsconfig"
 )

 const (
@@ -39,10 +40,8 @@ func testRequest(t *testing.T, url string, stream io.ReadWriter) *http.Request {
 }

 func websocketClientTLSConfig(t *testing.T) *tls.Config {
-	certPool := x509.NewCertPool()
-	helloCert, err := tlsconfig.GetHelloCertificateX509()
+	certPool, err := tlsconfig.LoadOriginCertPool(nil)
 	assert.NoError(t, err)
-	certPool.AddCert(helloCert)
 	assert.NotNil(t, certPool)
 	return &tls.Config{RootCAs: certPool}
 }