Release 2019.3.0

.gitignore

@@ -8,3 +8,4 @@ guide/public
 .vscode
 \#*\#
 cscope.*
+cloudflared

RELEASE_NOTES

@@ -1,3 +1,14 @@
+2019.3.0
+- 2018-12-28 make http transport aware of proxy from envvar
+- 2019-02-28 TUN-1559: fix nil dereference in TunnelConfig.CloseConnOnce
+- 2019-03-04 TUN-1451: Make non-interactive, non-service execution possible on Windows
+- 2019-03-04 TUN-1562: Refactor connectedSignal to be safe to close multiple times
+- 2019-02-27 TUN-1550: Add validation timeout for non-responsive origins
+- 2019-03-06 AUTH-1531: Named flags for ssh service tokens
+- 2019-02-14 Support unix sockets.
+- 2019-03-08 TUN-1389: Non-scalar flags in a cloudflared config.yml don't get logged
+- 2019-03-07 TUN-1522: If we can't get SRV from default resolver, get them from 1.1.1.1 DoT
+
 2019.2.1
 - 2019-02-14 TUN-1381:  should tell you if you're on the latest version rather than just exiting silently
 - 2019-02-15 TUN-1467: build with Go 1.11

cmd/cloudflared/access/carrier.go

@@ -22,6 +22,12 @@ func ssh(c *cli.Context) error {
 		return cli.ShowCommandHelp(c, "ssh")
 	}
 	headers := buildRequestHeaders(c.StringSlice("header"))
+	if c.IsSet("service-token-id") {
+		headers.Add("CF-Access-Client-Id", c.String("service-token-id"))
+	}
+	if c.IsSet("service-token-secret") {
+		headers.Add("CF-Access-Client-Secret", c.String("service-token-secret"))
+	}
 
 	if c.NArg() > 0 || c.IsSet("url") {
 		localForwarder, err := config.ValidateUrl(c)

cmd/cloudflared/access/cmd.go

@@ -93,14 +93,27 @@ func Commands() []*cli.Command {
 					Description: `The ssh subcommand sends data over a proxy to the Cloudflare edge.`,
 					Flags: []cli.Flag{
 						&cli.StringFlag{
-							Name: "hostname",
+							Name:  "hostname",
+							Usage: "specifics the hostname of your application.",
 						},
 						&cli.StringFlag{
-							Name: "url",
+							Name:  "url",
+							Usage: "specifics the host:port to forward data to Cloudflare edge.",
 						},
 						&cli.StringSliceFlag{
 							Name:    "header",
 							Aliases: []string{"H"},
+							Usage:   "specific additional headers you wish to send.",
+						},
+						&cli.StringSliceFlag{
+							Name:    "service-token-id",
+							Aliases: []string{"id"},
+							Usage:   "specific an Access service token ID you wish to use.",
+						},
+						&cli.StringSliceFlag{
+							Name:    "service-token-secret",
+							Aliases: []string{"secret"},
+							Usage:   "specific an Access service token secret you wish to use.",
 						},
 					},
 				},

cmd/cloudflared/config/configuration.go

@@ -63,7 +63,17 @@ func FindDefaultConfigPath() string {
 	return ""
 }
 
+// ValidateUnixSocket ensures --unix-socket param is used exclusively
+// i.e. it fails if a user specifies both --url and --unix-socket
+func ValidateUnixSocket(c *cli.Context) (string, error) {
+	if c.IsSet("unix-socket") && (c.IsSet("url") || c.NArg() > 0) {
+		return "", errors.New("--unix-socket must be used exclusivly.")
+	}
+	return c.String("unix-socket"), nil
+}
+
 // ValidateUrl will validate url flag correctness. It can be either from --url or argument
+// Notice ValidateUnixSocket, it will enforce --unix-socket is not used with --url or argument
 func ValidateUrl(c *cli.Context) (string, error) {
 	var url = c.String("url")
 	if c.NArg() > 0 {

cmd/cloudflared/tunnel/cmd.go

@@ -20,6 +20,7 @@ import (
 	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/origin"
+	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunneldns"
 	"github.com/cloudflare/cloudflared/websocket"
 	"github.com/coreos/go-systemd/daemon"
@@ -180,8 +181,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	var wg sync.WaitGroup
 	listeners := gracenet.Net{}
 	errC := make(chan error)
-	connectedSignal := make(chan struct{})
-	closeConnOnce := sync.Once{}
+	connectedSignal := signal.New(make(chan struct{}))
 	dnsReadySignal := make(chan struct{})
 
 	if c.String("config") == "" {
@@ -281,7 +281,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 
 	// Serve DNS proxy stand-alone if no hostname or tag or app is going to run
 	if dnsProxyStandAlone(c) {
-		closeConnOnce.Do(func() { close(connectedSignal) })
+		connectedSignal.Notify()
 		// no grace period, handle SIGINT/SIGTERM immediately
 		return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, 0)
 	}
@@ -316,7 +316,6 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	}
 
 	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, version, logger, transportLogger)
-	tunnelConfig.CloseConnOnce = &closeConnOnce
 	if err != nil {
 		return err
 	}
@@ -376,13 +375,13 @@ func waitToShutdown(wg *sync.WaitGroup,
 	return err
 }
 
-func notifySystemd(waitForSignal chan struct{}) {
-	<-waitForSignal
+func notifySystemd(waitForSignal *signal.Signal) {
+	<-waitForSignal.Wait()
 	daemon.SdNotify(false, "READY=1")
 }
 
-func writePidFile(waitForSignal chan struct{}, pidFile string) {
-	<-waitForSignal
+func writePidFile(waitForSignal *signal.Signal, pidFile string) {
+	<-waitForSignal.Wait()
 	file, err := os.Create(pidFile)
 	if err != nil {
 		logger.WithError(err).Errorf("Unable to write pid to %s", pidFile)
@@ -476,6 +475,12 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_URL"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "unix-socket",
+			Usage:   "Path to unix socket to use instead of --url",
+			EnvVars: []string{"TUNNEL_UNIX_SOCKET"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "hostname",
 			Usage:   "Set a hostname on a Cloudflare zone to route traffic through this tunnel.",

cmd/cloudflared/tunnel/configuration.go

@@ -1,6 +1,7 @@
 package tunnel
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/hex"
@@ -69,8 +70,16 @@ func logClientOptions(c *cli.Context) {
 	for _, flag := range c.LocalFlagNames() {
 		flags[flag] = c.Generic(flag)
 	}
+
+	sliceFlags := []string{"header", "tag", "proxy-dns-upstream", "upstream", "edge"}
+	for _, sliceFlag := range sliceFlags {
+		if len(c.StringSlice(sliceFlag)) > 0 {
+			flags[sliceFlag] = strings.Join(c.StringSlice(sliceFlag), ", ")
+		}
+	}
+
 	if len(flags) > 0 {
-		logger.Infof("Flags %v", flags)
+		logger.WithFields(flags).Info("Flags")
 	}
 
 	envs := make(map[string]string)
@@ -136,7 +145,12 @@ If you don't have a certificate signed by Cloudflare, run the command:
 	return originCert, nil
 }
 
-func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version string, logger, transportLogger *logrus.Logger) (*origin.TunnelConfig, error) {
+func prepareTunnelConfig(
+	c *cli.Context,
+	buildInfo *origin.BuildInfo,
+	version string, logger,
+	transportLogger *logrus.Logger,
+) (*origin.TunnelConfig, error) {
 	hostname, err := validation.ValidateHostname(c.String("hostname"))
 	if err != nil {
 		logger.WithError(err).Error("Invalid hostname")
@@ -160,7 +174,6 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		logger.WithError(err).Error("Error validating origin URL")
 		return nil, errors.Wrap(err, "Error validating origin URL")
 	}
-	logger.Infof("Proxying tunnel requests to %s", originURL)
 
 	originCert, err := getOriginCert(c)
 	if err != nil {
@@ -175,12 +188,7 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 
 	tunnelMetrics := origin.NewTunnelMetrics()
 	httpTransport := &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
-		DialContext: (&net.Dialer{
-			Timeout:   c.Duration("proxy-connect-timeout"),
-			KeepAlive: c.Duration("proxy-tcp-keepalive"),
-			DualStack: !c.Bool("proxy-no-happy-eyeballs"),
-		}).DialContext,
+		Proxy:                 http.ProxyFromEnvironment,
 		MaxIdleConns:          c.Int("proxy-keepalive-connections"),
 		IdleConnTimeout:       c.Duration("proxy-keepalive-timeout"),
 		TLSHandshakeTimeout:   c.Duration("proxy-tls-timeout"),
@@ -188,6 +196,29 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		TLSClientConfig:       &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: c.IsSet("no-tls-verify")},
 	}
 
+	dialContext := (&net.Dialer{
+		Timeout:   c.Duration("proxy-connect-timeout"),
+		KeepAlive: c.Duration("proxy-tcp-keepalive"),
+		DualStack: !c.Bool("proxy-no-happy-eyeballs"),
+	}).DialContext
+
+	if c.IsSet("unix-socket") {
+		unixSocket, err := config.ValidateUnixSocket(c)
+		if err != nil {
+			logger.WithError(err).Error("Error validating --unix-socket")
+			return nil, errors.Wrap(err, "Error validating --unix-socket")
+		}
+
+		logger.Infof("Proxying tunnel requests to unix:%s", unixSocket)
+		httpTransport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
+			// if --unix-socket specified, enforce network type "unix"
+			return dialContext(ctx, "unix", unixSocket)
+		}
+	} else {
+		logger.Infof("Proxying tunnel requests to %s", originURL)
+		httpTransport.DialContext = dialContext
+	}
+
 	if !c.IsSet("hello-world") && c.IsSet("origin-server-name") {
 		httpTransport.TLSClientConfig.ServerName = c.String("origin-server-name")
 	}

cmd/cloudflared/windows_service.go

@@ -8,6 +8,7 @@ package main
 import (
 	"fmt"
 	"os"
+	"syscall"
 	"time"
 	"unsafe"
 
@@ -30,6 +31,10 @@ const (
 	// not defined in golang.org/x/sys/windows package
 	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms681988(v=vs.85).aspx
 	serviceConfigFailureActionsFlag = 4
+
+	// ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
+	// https://docs.microsoft.com/en-us/windows/desktop/debug/system-error-codes--1000-1299-
+	serviceControllerConnectionFailure = 1063
 )
 
 func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
@@ -50,16 +55,48 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 		},
 	})
 
+	// `IsAnInteractiveSession()` isn't exactly equivalent to "should the
+	// process run as a normal EXE?" There are legitimate non-service cases,
+	// like running cloudflared in a GCP startup script, for which
+	// `IsAnInteractiveSession()` returns false. For more context, see:
+	//     https://github.com/judwhite/go-svc/issues/6
+	// It seems that the "correct way" to check "is this a normal EXE?" is:
+	//     1. attempt to connect to the Service Control Manager
+	//     2. get ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
+	// This involves actually trying to start the service.
+
 	isIntSess, err := svc.IsAnInteractiveSession()
 	if err != nil {
 		logger.Fatalf("failed to determine if we are running in an interactive session: %v", err)
 	}
-
 	if isIntSess {
 		app.Run(os.Args)
 		return
 	}
 
+	// Run executes service name by calling windowsService which is a Handler
+	// interface that implements Execute method.
+	// It will set service status to stop after Execute returns
+	err = svc.Run(windowsServiceName, &windowsService{app: app, shutdownC: shutdownC, graceShutdownC: graceShutdownC})
+	if err != nil {
+		if errno, ok := err.(syscall.Errno); ok && int(errno) == serviceControllerConnectionFailure {
+			// Hack: assume this is a false negative from the IsAnInteractiveSession() check above.
+			// Run the app in "interactive" mode anyway.
+			app.Run(os.Args)
+			return
+		}
+		logger.Fatalf("%s service failed: %v", windowsServiceName, err)
+	}
+}
+
+type windowsService struct {
+	app            *cli.App
+	shutdownC      chan struct{}
+	graceShutdownC chan struct{}
+}
+
+// called by the package code at the start of the service
+func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
 	elog, err := eventlog.Open(windowsServiceName)
 	if err != nil {
 		logger.WithError(err).Errorf("Cannot open event log for %s", windowsServiceName)
@@ -68,26 +105,10 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 	defer elog.Close()
 
 	elog.Info(1, fmt.Sprintf("%s service starting", windowsServiceName))
-	// Run executes service name by calling windowsService which is a Handler
-	// interface that implements Execute method.
-	// It will set service status to stop after Execute returns
-	err = svc.Run(windowsServiceName, &windowsService{app: app, elog: elog, shutdownC: shutdownC, graceShutdownC: graceShutdownC})
-	if err != nil {
-		elog.Error(1, fmt.Sprintf("%s service failed: %v", windowsServiceName, err))
-		return
-	}
-	elog.Info(1, fmt.Sprintf("%s service stopped", windowsServiceName))
-}
+	defer func() {
+		elog.Info(1, fmt.Sprintf("%s service stopped", windowsServiceName))
+	}()
 
-type windowsService struct {
-	app            *cli.App
-	elog           *eventlog.Log
-	shutdownC      chan struct{}
-	graceShutdownC chan struct{}
-}
-
-// called by the package code at the start of the service
-func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
 	// the arguments passed here are only meaningful if they were manually
 	// specified by the user, e.g. using the Services console or `sc start`.
 	// https://docs.microsoft.com/en-us/windows/desktop/services/service-entry-point
@@ -99,7 +120,7 @@ func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeReques
 		// fall back to the arguments from ImagePath (or, as sc calls it, binPath)
 		args = os.Args
 	}
-	s.elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
+	elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
 
 	const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
 	statusChan <- svc.Status{State: svc.StartPending}
@@ -114,26 +135,26 @@ func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeReques
 		case c := <-r:
 			switch c.Cmd {
 			case svc.Interrogate:
-				s.elog.Info(1, fmt.Sprintf("control request 1 #%d", c))
+				elog.Info(1, fmt.Sprintf("control request 1 #%d", c))
 				statusChan <- c.CurrentStatus
 			case svc.Stop:
-				s.elog.Info(1, "received stop control request")
+				elog.Info(1, "received stop control request")
 				close(s.graceShutdownC)
 				statusChan <- svc.Status{State: svc.StopPending}
 			case svc.Shutdown:
-				s.elog.Info(1, "received shutdown control request")
+				elog.Info(1, "received shutdown control request")
 				close(s.shutdownC)
 				statusChan <- svc.Status{State: svc.StopPending}
 			default:
-				s.elog.Error(1, fmt.Sprintf("unexpected control request #%d", c))
+				elog.Error(1, fmt.Sprintf("unexpected control request #%d", c))
 			}
 		case err := <-errC:
 			ssec = true
 			if err != nil {
-				s.elog.Error(1, fmt.Sprintf("cloudflared terminated with error %v", err))
+				elog.Error(1, fmt.Sprintf("cloudflared terminated with error %v", err))
 				errno = 1
 			} else {
-				s.elog.Info(1, "cloudflared terminated without error")
+				elog.Info(1, "cloudflared terminated without error")
 				errno = 0
 			}
 			return

origin/discovery.go

@@ -1,8 +1,14 @@
 package origin
 
 import (
+	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
+	"time"
+
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
 )
 
 const (
@@ -10,9 +16,25 @@ const (
 	srvService = "warp"
 	srvProto   = "tcp"
 	srvName    = "cloudflarewarp.com"
+
+	// Used to fallback to DoT when we can't use the default resolver to
+	// discover HA Warp servers (GitHub issue #75).
+	dotServerName = "cloudflare-dns.com"
+	dotServerAddr = "1.1.1.1:853"
+	dotTimeout    = time.Duration(15 * time.Second)
 )
 
-func ResolveEdgeIPs(addresses []string) ([]*net.TCPAddr, error) {
+var friendlyDNSErrorLines = []string{
+	`Please try the following things to diagnose this issue:`,
+	`  1. ensure that cloudflarewarp.com is returning "warp" service records.`,
+	`     Run your system's equivalent of: dig srv _warp._tcp.cloudflarewarp.com`,
+	`  2. ensure that your DNS resolver is not returning compressed SRV records.`,
+	`     See GitHub issue https://github.com/golang/go/issues/27546`,
+	`     For example, you could use Cloudflare's 1.1.1.1 as your resolver:`,
+	`     https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/`,
+}
+
+func ResolveEdgeIPs(logger *log.Logger, addresses []string) ([]*net.TCPAddr, error) {
 	if len(addresses) > 0 {
 		var tcpAddrs []*net.TCPAddr
 		for _, address := range addresses {
@@ -28,7 +50,30 @@ func ResolveEdgeIPs(addresses []string) ([]*net.TCPAddr, error) {
 	// HA service discovery lookup
 	_, addrs, err := net.LookupSRV(srvService, srvProto, srvName)
 	if err != nil {
-		return nil, err
+		// Try to fall back to DoT from Cloudflare directly.
+		//
+		// Note: Instead of DoT, we could also have used DoH. Either of these:
+		//     - directly via the JSON API (https://1.1.1.1/dns-query?ct=application/dns-json&name=_warp._tcp.cloudflarewarp.com&type=srv)
+		//     - indirectly via `tunneldns.NewUpstreamHTTPS()`
+		// But both of these cases miss out on a key feature from the stdlib:
+		//     "The returned records are sorted by priority and randomized by weight within a priority."
+		//     (https://golang.org/pkg/net/#Resolver.LookupSRV)
+		// Does this matter? I don't know. It may someday. Let's use DoT so we don't need to worry about it.
+		// See also: Go feature request for stdlib-supported DoH: https://github.com/golang/go/issues/27552
+		r := fallbackResolver(dotServerName, dotServerAddr)
+		ctx, cancel := context.WithTimeout(context.Background(), dotTimeout)
+		defer cancel()
+		_, fallbackAddrs, fallbackErr := r.LookupSRV(ctx, srvService, srvProto, srvName)
+		if fallbackErr != nil || len(fallbackAddrs) == 0 {
+			// use the original DNS error `err` in messages, not `fallbackErr`
+			logger.Errorln("Error looking up Cloudflare edge IPs: the DNS query failed:", err)
+			for _, s := range friendlyDNSErrorLines {
+				logger.Errorln(s)
+			}
+			return nil, errors.Wrap(err, "Could not lookup srv records on _warp._tcp.cloudflarewarp.com")
+		}
+		// Accept the fallback results and keep going
+		addrs = fallbackAddrs
 	}
 	var resolvedIPsPerCNAME [][]*net.TCPAddr
 	var lookupErr error
@@ -80,3 +125,19 @@ func FlattenServiceIPs(ipsByService [][]*net.TCPAddr) []*net.TCPAddr {
 	}
 	return result
 }
+
+// Inspiration: https://github.com/artyom/dot/blob/master/dot.go
+func fallbackResolver(serverName, serverAddress string) *net.Resolver {
+	return &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, _ string, _ string) (net.Conn, error) {
+			var dialer net.Dialer
+			conn, err := dialer.DialContext(ctx, "tcp", serverAddress)
+			if err != nil {
+				return nil, err
+			}
+			tlsConfig := &tls.Config{ServerName: serverName}
+			return tls.Client(conn, tlsConfig), nil
+		},
+	}
+}

origin/supervisor.go

@@ -6,6 +6,8 @@ import (
 	"net"
 	"time"
 
+	"github.com/cloudflare/cloudflared/signal"
+
 	"github.com/google/uuid"
 )
 
@@ -51,7 +53,7 @@ func NewSupervisor(config *TunnelConfig) *Supervisor {
 	}
 }
 
-func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) error {
+func (s *Supervisor) Run(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) error {
 	logger := s.config.Logger
 	if err := s.initialize(ctx, connectedSignal, u); err != nil {
 		return err
@@ -120,9 +122,9 @@ func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}, u u
 	}
 }
 
-func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) error {
+func (s *Supervisor) initialize(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) error {
 	logger := s.config.Logger
-	edgeIPs, err := ResolveEdgeIPs(s.config.EdgeAddrs)
+	edgeIPs, err := ResolveEdgeIPs(logger, s.config.EdgeAddrs)
 	if err != nil {
 		logger.Infof("ResolveEdgeIPs err")
 		return err
@@ -143,11 +145,12 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 		return fmt.Errorf("context was canceled")
 	case tunnelError := <-s.tunnelErrors:
 		return tunnelError.err
-	case <-connectedSignal:
+	case <-connectedSignal.Wait():
 	}
 	// At least one successful connection, so start the rest
 	for i := 1; i < s.config.HAConnections; i++ {
-		go s.startTunnel(ctx, i, make(chan struct{}), u)
+		ch := signal.New(make(chan struct{}))
+		go s.startTunnel(ctx, i, ch, u)
 		time.Sleep(registrationInterval)
 	}
 	return nil
@@ -155,7 +158,7 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 
 // startTunnel starts the first tunnel connection. The resulting error will be sent on
 // s.tunnelErrors. It will send a signal via connectedSignal if registration succeed
-func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan struct{}, u uuid.UUID) {
+func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) {
 	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal, u)
 	defer func() {
 		s.tunnelErrors <- tunnelError{index: 0, err: err}
@@ -183,17 +186,17 @@ func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan
 
 // startTunnel starts a new tunnel connection. The resulting error will be sent on
 // s.tunnelErrors.
-func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal chan struct{}, u uuid.UUID) {
+func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal *signal.Signal, u uuid.UUID) {
 	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(index), uint8(index), connectedSignal, u)
 	s.tunnelErrors <- tunnelError{index: index, err: err}
 }
 
-func (s *Supervisor) newConnectedTunnelSignal(index int) chan struct{} {
-	signal := make(chan struct{})
-	s.tunnelsConnecting[index] = signal
-	s.nextConnectedSignal = signal
+func (s *Supervisor) newConnectedTunnelSignal(index int) *signal.Signal {
+	sig := make(chan struct{})
+	s.tunnelsConnecting[index] = sig
+	s.nextConnectedSignal = sig
 	s.nextConnectedIndex = index
-	return signal
+	return signal.New(sig)
 }
 
 func (s *Supervisor) waitForNextTunnel(index int) bool {
@@ -220,7 +223,7 @@ func (s *Supervisor) refreshEdgeIPs() {
 	}
 	s.resolverC = make(chan resolveResult)
 	go func() {
-		edgeIPs, err := ResolveEdgeIPs(s.config.EdgeAddrs)
+		edgeIPs, err := ResolveEdgeIPs(s.config.Logger, s.config.EdgeAddrs)
 		s.resolverC <- resolveResult{edgeIPs: edgeIPs, err: err}
 	}()
 }

origin/tunnel.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/validation"
@@ -37,8 +38,10 @@ const (
 )
 
 type TunnelConfig struct {
+	// OriginUrl may not be used if a user specifies a unix socket.
+	OriginUrl string
+
 	EdgeAddrs          []string
-	OriginUrl          string
 	Hostname           string
 	OriginCert         []byte
 	TlsConfig          *tls.Config
@@ -127,7 +130,7 @@ func (c *TunnelConfig) RegistrationOptions(connectionID uint8, OriginLocalIP str
 	}
 }
 
-func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connectedSignal chan struct{}) error {
+func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connectedSignal *signal.Signal) error {
 	ctx, cancel := context.WithCancel(context.Background())
 	go func() {
 		<-shutdownC
@@ -143,7 +146,7 @@ func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connecte
 	if config.HAConnections > 1 {
 		return NewSupervisor(config).Run(ctx, connectedSignal, u)
 	} else {
-		addrs, err := ResolveEdgeIPs(config.EdgeAddrs)
+		addrs, err := ResolveEdgeIPs(config.Logger, config.EdgeAddrs)
 		if err != nil {
 			return err
 		}
@@ -155,7 +158,7 @@ func ServeTunnelLoop(ctx context.Context,
 	config *TunnelConfig,
 	addr *net.TCPAddr,
 	connectionID uint8,
-	connectedSignal chan struct{},
+	connectedSignal *signal.Signal,
 	u uuid.UUID,
 ) error {
 	logger := config.Logger
@@ -165,7 +168,7 @@ func ServeTunnelLoop(ctx context.Context,
 	connectedFuse := h2mux.NewBooleanFuse()
 	go func() {
 		if connectedFuse.Await() {
-			config.CloseConnOnce.Do(func() { close(connectedSignal) })
+			connectedSignal.Notify()
 		}
 	}()
 	// Ensure the above goroutine will terminate if we return without connecting

signal/safe_signal.go

@@ -0,0 +1,33 @@
+package signal
+
+import (
+	"sync"
+)
+
+// Signal lets goroutines signal that some event has occurred. Other goroutines can wait for the signal.
+type Signal struct {
+	ch   chan struct{}
+	once sync.Once
+}
+
+// New wraps a channel and turns it into a signal for a one-time event.
+func New(ch chan struct{}) *Signal {
+	return &Signal{
+		ch:   ch,
+		once: sync.Once{},
+	}
+}
+
+// Notify alerts any goroutines waiting on this signal that the event has occurred.
+// After the first call to Notify(), future calls are no-op.
+func (s *Signal) Notify() {
+	s.once.Do(func() {
+		close(s.ch)
+	})
+}
+
+// Wait returns a channel which will be written to when Notify() is called for the first time.
+// This channel will never be written to a second time.
+func (s *Signal) Wait() <-chan struct{} {
+	return s.ch
+}

signal/safe_signal_test.go

@@ -0,0 +1,25 @@
+package signal
+
+import (
+	"testing"
+)
+
+func TestMultiNotifyDoesntCrash(t *testing.T) {
+	sig := New(make(chan struct{}))
+	sig.Notify()
+	sig.Notify()
+	// If code has reached here without crashing, the test has passed.
+}
+
+func TestWait(t *testing.T) {
+	sig := New(make(chan struct{}))
+	sig.Notify()
+	select {
+	case <-sig.Wait():
+		// Test succeeds
+		return
+	default:
+		// sig.Wait() should have been read from, because sig.Notify() wrote to it.
+		t.Fail()
+	}
+}

tunneldns/https_upstream.go

@@ -39,6 +39,7 @@ func NewUpstreamHTTPS(endpoint string) (Upstream, error) {
 		TLSClientConfig:    tls,
 		DisableCompression: true,
 		MaxIdleConns:       1,
+		Proxy:              http.ProxyFromEnvironment,
 	}
 	http2.ConfigureTransport(transport)
 

validation/validation.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/url"
 	"strings"
+	"time"
 
 	"net/http"
 
@@ -14,7 +15,10 @@ import (
 
 const defaultScheme = "http"
 
-var supportedProtocol = [2]string{"http", "https"}
+var (
+	supportedProtocol = [2]string{"http", "https"}
+	validationTimeout = time.Duration(30 * time.Second)
+)
 
 func ValidateHostname(hostname string) (string, error) {
 	if hostname == "" {
@@ -149,6 +153,7 @@ func ValidateHTTPService(originURL string, hostname string, transport http.Round
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
 			return http.ErrUseLastResponse
 		},
+		Timeout: validationTimeout,
 	}
 
 	initialRequest, err := http.NewRequest("GET", parsedURL.String(), nil)

validation/validation_test.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"testing"
+	"time"
 
 	"context"
 	"crypto/tls"
@@ -383,6 +384,36 @@ func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
 	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
 }
 
+// error path 3: origin URL is nonresponsive
+func TestValidateHTTPService_NonResponsiveOrigin(t *testing.T) {
+	originURL := "https://127.0.0.1/"
+	hostname := "example.com"
+	oldValidationTimeout := validationTimeout
+	defer func() {
+		validationTimeout = oldValidationTimeout
+	}()
+	validationTimeout = 500 * time.Millisecond
+
+	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:443", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		time.Sleep(1 * time.Second)
+		w.WriteHeader(200)
+	}))
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	defer server.Close()
+
+	err = ValidateHTTPService(originURL, hostname, client.Transport)
+	if err, ok := err.(net.Error); assert.True(t, ok) {
+		assert.True(t, err.Timeout())
+	}
+}
+
 type testRoundTripper func(req *http.Request) (*http.Response, error)
 
 func (f testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {