Release 2020.9.2

Dockerfile

@@ -1,7 +1,7 @@
 # use a builder image for building cloudflare
 ARG TARGET_GOOS
 ARG TARGET_GOARCH
-FROM golang:1.15.3 as builder
+FROM golang:1.13.3 as builder
 ENV GO111MODULE=on \
     CGO_ENABLED=0 \
     TARGET_GOOS=${TARGET_GOOS} \

README.md

@@ -1,32 +1,9 @@
 # Argo Tunnel client
 
-Contains the command-line client for Argo Tunnel, a tunneling daemon that proxies any local webserver through the Cloudflare network. Extensive documentation can be found in the [Argo Tunnel section](https://developers.cloudflare.com/argo-tunnel/) of the Cloudflare Docs.
+Contains the command-line client and its libraries for Argo Tunnel, a tunneling daemon that proxies any local webserver through the Cloudflare network.
 
-## Before you get started
+## Getting started
 
-Before you use Argo Tunnel, you'll need to complete a few steps in the Cloudflare dashboard. The website you add to Cloudflare will be used to route traffic to your Tunnel.
-
-1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
-2. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708)
-
-## Installing `cloudflared`
-
-Downloads are available as standalone binaries, a Docker image, and Debian, RPM, and Homebrew packages. You can also find releases here on the `cloudflared` GitHub repository.
-
-* You can [install on macOS](https://developers.cloudflare.com/argo-tunnel/getting-started/installation#macos) via Homebrew or by downloading the [latest Darwin amd64 release](https://github.com/cloudflare/cloudflared/releases)
-* Binaries, Debian, and RPM packages for Linux [can be found here](https://developers.cloudflare.com/argo-tunnel/getting-started/installation#linux)
-* A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared)
-* You can install on Windows machines with the [steps here](https://developers.cloudflare.com/argo-tunnel/getting-started/installation#windows)
+    go install github.com/cloudflare/cloudflared/cmd/cloudflared
 
 User documentation for Argo Tunnel can be found at https://developers.cloudflare.com/argo-tunnel/
-
-## Creating Tunnels and routing traffic
-
-Once installed, you can authenticate `cloudflared` into your Cloudflare account and begin creating Tunnels that serve traffic for hostnames in your account.
-
-* Create a Tunnel with [these instructions](https://developers.cloudflare.com/argo-tunnel/create-tunnel)
-* Route traffic to that Tunnel with [DNS records in Cloudflare](https://developers.cloudflare.com/argo-tunnel/routing-to-tunnel/dns) or with a [Cloudflare Load Balancer](https://developers.cloudflare.com/argo-tunnel/routing-to-tunnel/lb)
-
-## TryCloudflare
-
-Want to test Argo Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/argo-tunnel/learning/trycloudflare).

RELEASE_NOTES

@@ -1,63 +1,3 @@
-2020.11.2
-
-
-2020.11.1
-- 2020-11-10 TUN-3527: More specific error for invalid YAML/JSON
-- 2020-11-06 Update README.md (#256)
-
-2020.11.0
-- 2020-11-04 TUN-3484: OriginService that responds with configured HTTP status
-- 2020-11-05 TUN-3505: Response body for status code origin returns EOF on Read
-- 2020-11-04 TUN-3503: Matching ingress rule should not take port into account
-- 2020-11-05 TUN-3506: OriginService needs to set request host and scheme for websocket requests
-- 2020-11-09 TUN-3516: Better error message when parsing invalid YAML config
-- 2020-11-09 TUN-3522: ingress validate checks that the config file exists
-- 2020-11-09 TUN-3524: Don't ignore errors from app-level action handler (#248)
-- 2020-11-09 TUN-3461: Show all origin services in the UI
-- 2020-10-30 TUN-3494: Proceed to create tunnel if at least one edge address can be resolved
-- 2020-10-30 TUN-3492: Refactor OriginService, shrink its interface
-- 2020-10-22 TUN-3478: Increase download timeout to 60s
-- 2020-10-15 TUN-2640: Users can configure per-origin config. Unify single-rule CLI flow with multi-rule config file code.
-
-2020.10.2
-- 2020-10-21 Release 2020.10.1
-- 2020-10-21 AUTH-3185 fixed indention error
-- 2020-10-19 TUN-3459: Make service install on linux use named tunnels
-
-2020.10.1
-- 2020-10-20 Split out typed config from legacy command-line switches; refactor ingress commands and fix tests
-- 2020-10-20 Move raw ingress rules to config package
-- 2020-10-21 TUN-3476: Fix conversion to string and int slice
-- 2020-10-12 TUN-3441:  Multiple-origin routing via ingress rules
-- 2020-10-15 TUN-3464: Newtype to wrap []ingress.Rule
-- 2020-10-15 TUN-3465: Use Go 1.15.3
-- 2020-10-15 TUN-3463: Let users run a named tunnel via config file setting
-- 2020-10-19 TUN-3475: Unify config file handling with typed config for new fields
-- 2020-10-19 TUN-3459: Make service install on linux use named tunnels
-- 2020-10-06 AUTH-3148 fixed cloudflared copy and match all the files in the checksum upload
-- 2020-10-06 TUN-3436, TUN-3437: Parse ingress from YAML, ensure last rule catches everything
-- 2020-10-06 TUN-3446: Use go 1.15.2 and add a step to build cloudflared in the dev Dockerfile
-- 2020-10-07 TUN-3439: 'tunnel validate' command to check ingress rules
-- 2020-10-07 TUN-3440: 'tunnel rule' command to test ingress rules
-- 2020-10-08 TUN-3451: Cloudflared tunnel ingress command
-- 2020-10-09 TUN-3452: Fix loading of flags from config file for tunnel run subcommand. This change also cleans up building of tunnel subcommand list, hides deprecated subcommands and improves help.
-- 2020-10-08 TUN-3438: move ingress into own package, read into TunnelConfig
-
-2020.10.0
-- 2020-10-02 AUTH-2993 cleaned up worker service tests
-- 2020-10-02 TUN-3443: Decode as v4api response on non-200 status
-- 2020-09-24 TRAFFIC-448: allow the user to specify the proxy address and port to bind to, falling back to 127.0.0.1 and random port if not specified
-- 2020-09-28 TUN-3427: Define a struct that only implements RegistrationServer in tunnelpogs
-- 2020-09-29 TUN-3430: Copy flags to configure proxy to run subcommand, print relevant tunnel flags in help
-- 2020-08-12 AUTH-2993 added workers updater logic
-
-2020.9.3
-- 2020-09-22 TRAFFIC-448: build cloudflare for junos and publish to s3
-- 2020-09-22 TUN-3410: Request the v1 Tunnelstore API
-- 2020-09-23 Release 2020.9.2
-- 2020-09-17 updater service exit code should be 11
-- 2020-09-18 AUTH-3109 upload the checksum to workers kv on github releases
-
 2020.9.2
 - 2020-09-22 TRAFFIC-448: build cloudflare for junos and publish to s3
 - 2020-09-22 TUN-3410: Request the v1 Tunnelstore API

cfsetup.yaml

@@ -1,4 +1,4 @@
-pinned_go: &pinned_go go=1.15.3-1
+pinned_go: &pinned_go go=1.15.2-1
 build_dir: &build_dir /cfsetup_build
 default-flavor: stretch
 stretch: &stretch
@@ -250,8 +250,8 @@ centos-7:
       - https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
     pre-cache:
       - yum install -y fakeroot
-      - wget https://golang.org/dl/go1.15.3.linux-amd64.tar.gz -P /tmp/
-      - tar -C /usr/local -xzf /tmp/go1.15.3.linux-amd64.tar.gz
+      - wget https://golang.org/dl/go1.15.2.linux-amd64.tar.gz -P /tmp/
+      - tar -C /usr/local -xzf /tmp/go1.15.2.linux-amd64.tar.gz
     post-cache:
       - export PATH=$PATH:/usr/local/go/bin
       - export GOOS=linux
@@ -262,8 +262,8 @@ centos-7:
     builddeps: *el7_builddeps
     pre-cache:
       - yum install -y fakeroot
-      - wget https://golang.org/dl/go1.15.3.linux-amd64.tar.gz -P /tmp/
-      - tar -C /usr/local -xzf /tmp/go1.15.3.linux-amd64.tar.gz
+      - wget https://golang.org/dl/go1.15.2.linux-amd64.tar.gz -P /tmp/
+      - tar -C /usr/local -xzf /tmp/go1.15.2.linux-amd64.tar.gz
     post-cache:
       - export PATH=$PATH:/usr/local/go/bin
       - export GOOS=linux

cmd/cloudflared/cliutil/errors.go

@@ -27,17 +27,17 @@ func UsageError(format string, args ...interface{}) error {
 // Ensures exit with error code if actionFunc returns an error
 func ErrorHandler(actionFunc cli.ActionFunc) cli.ActionFunc {
 	return func(ctx *cli.Context) error {
-		defer logger.SharedWriteManager.Shutdown()
-
 		err := actionFunc(ctx)
 		if err != nil {
 			if _, ok := err.(usageError); ok {
 				msg := fmt.Sprintf("%s\nSee 'cloudflared %s --help'.", err.Error(), ctx.Command.FullName())
-				err = cli.Exit(msg, -1)
-			} else if _, ok := err.(cli.ExitCoder); !ok {
-				err = cli.Exit(err.Error(), 1)
+				return cli.Exit(msg, -1)
 			}
+			// os.Exits with error code if err is cli.ExitCoder or cli.MultiError
+			cli.HandleExitCoder(err)
+			err = cli.Exit(err.Error(), 1)
 		}
+		logger.SharedWriteManager.Shutdown()
 		return err
 	}
 }

cmd/cloudflared/config/configuration.go

@@ -1,18 +1,16 @@
 package config
 
 import (
-	"fmt"
+	"errors"
 	"os"
 	"path/filepath"
 	"runtime"
-	"time"
 
 	homedir "github.com/mitchellh/go-homedir"
-	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v2/altsrc"
 	"gopkg.in/yaml.v2"
 
-	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/validation"
 )
 
@@ -30,16 +28,9 @@ var (
 	// Windows default config dir was ~/cloudflare-warp in documentation; let's keep it compatible
 	defaultUserConfigDirs = []string{"~/.cloudflared", "~/.cloudflare-warp", "~/cloudflare-warp"}
 	defaultNixConfigDirs  = []string{"/etc/cloudflared", DefaultUnixConfigLocation}
-
-	ErrNoConfigFile = fmt.Errorf("Cannot determine default configuration path. No file %v in %v", DefaultConfigFiles, DefaultConfigSearchDirectories())
 )
 
-const (
-	DefaultCredentialFile = "cert.pem"
-
-	// BastionFlag is to enable bastion, or jump host, operation
-	BastionFlag = "bastion"
-)
+const DefaultCredentialFile = "cert.pem"
 
 // DefaultConfigDirectory returns the default directory of the config file
 func DefaultConfigDirectory() string {
@@ -97,6 +88,14 @@ func FileExists(path string) (bool, error) {
 	return true, nil
 }
 
+// FindInputSourceContext pulls the input source from the config flag.
+func FindInputSourceContext(context *cli.Context) (altsrc.InputSourceContext, error) {
+	if context.String("config") != "" {
+		return altsrc.NewYamlSourceFromFile(context.String("config"))
+	}
+	return nil, nil
+}
+
 // FindDefaultConfigPath returns the first path that contains a config file.
 // If none of the combination of DefaultConfigSearchDirectories() and DefaultConfigFiles
 // contains a config file, return empty string.
@@ -200,199 +199,3 @@ func ValidateUrl(c *cli.Context, allowFromArgs bool) (string, error) {
 	validUrl, err := validation.ValidateUrl(url)
 	return validUrl, err
 }
-
-type UnvalidatedIngressRule struct {
-	Hostname      string
-	Path          string
-	Service       string
-	OriginRequest OriginRequestConfig `yaml:"originRequest"`
-}
-
-// OriginRequestConfig is a set of optional fields that users may set to
-// customize how cloudflared sends requests to origin services. It is used to set
-// up general config that apply to all rules, and also, specific per-rule
-// config.
-// Note: To specify a time.Duration in go-yaml, use e.g. "3s" or "24h".
-type OriginRequestConfig struct {
-	// HTTP proxy timeout for establishing a new connection
-	ConnectTimeout *time.Duration `yaml:"connectTimeout"`
-	// HTTP proxy timeout for completing a TLS handshake
-	TLSTimeout *time.Duration `yaml:"tlsTimeout"`
-	// HTTP proxy TCP keepalive duration
-	TCPKeepAlive *time.Duration `yaml:"tcpKeepAlive"`
-	// HTTP proxy should disable "happy eyeballs" for IPv4/v6 fallback
-	NoHappyEyeballs *bool `yaml:"noHappyEyeballs"`
-	// HTTP proxy maximum keepalive connection pool size
-	KeepAliveConnections *int `yaml:"keepAliveConnections"`
-	// HTTP proxy timeout for closing an idle connection
-	KeepAliveTimeout *time.Duration `yaml:"keepAliveTimeout"`
-	// Sets the HTTP Host header for the local webserver.
-	HTTPHostHeader *string `yaml:"httpHostHeader"`
-	// Hostname on the origin server certificate.
-	OriginServerName *string `yaml:"originServerName"`
-	// Path to the CA for the certificate of your origin.
-	// This option should be used only if your certificate is not signed by Cloudflare.
-	CAPool *string `yaml:"caPool"`
-	// Disables TLS verification of the certificate presented by your origin.
-	// Will allow any certificate from the origin to be accepted.
-	// Note: The connection from your machine to Cloudflare's Edge is still encrypted.
-	NoTLSVerify *bool `yaml:"noTLSVerify"`
-	// Disables chunked transfer encoding.
-	// Useful if you are running a WSGI server.
-	DisableChunkedEncoding *bool `yaml:"disableChunkedEncoding"`
-	// Runs as jump host
-	BastionMode *bool `yaml:"bastionMode"`
-	// Listen address for the proxy.
-	ProxyAddress *string `yaml:"proxyAddress"`
-	// Listen port for the proxy.
-	ProxyPort *uint `yaml:"proxyPort"`
-	// Valid options are 'socks' or empty.
-	ProxyType *string `yaml:"proxyType"`
-}
-
-type Configuration struct {
-	TunnelID      string `yaml:"tunnel"`
-	Ingress       []UnvalidatedIngressRule
-	OriginRequest OriginRequestConfig `yaml:"originRequest"`
-	sourceFile    string
-}
-
-type configFileSettings struct {
-	Configuration `yaml:",inline"`
-	// older settings will be aggregated into the generic map, should be read via cli.Context
-	Settings map[string]interface{} `yaml:",inline"`
-}
-
-func (c *Configuration) Source() string {
-	return c.sourceFile
-}
-
-func (c *configFileSettings) Int(name string) (int, error) {
-	if raw, ok := c.Settings[name]; ok {
-		if v, ok := raw.(int); ok {
-			return v, nil
-		}
-		return 0, fmt.Errorf("expected int found %T for %s", raw, name)
-	}
-	return 0, nil
-}
-
-func (c *configFileSettings) Duration(name string) (time.Duration, error) {
-	if raw, ok := c.Settings[name]; ok {
-		switch v := raw.(type) {
-		case time.Duration:
-			return v, nil
-		case string:
-			return time.ParseDuration(v)
-		}
-		return 0, fmt.Errorf("expected duration found %T for %s", raw, name)
-	}
-	return 0, nil
-}
-
-func (c *configFileSettings) Float64(name string) (float64, error) {
-	if raw, ok := c.Settings[name]; ok {
-		if v, ok := raw.(float64); ok {
-			return v, nil
-		}
-		return 0, fmt.Errorf("expected float found %T for %s", raw, name)
-	}
-	return 0, nil
-}
-
-func (c *configFileSettings) String(name string) (string, error) {
-	if raw, ok := c.Settings[name]; ok {
-		if v, ok := raw.(string); ok {
-			return v, nil
-		}
-		return "", fmt.Errorf("expected string found %T for %s", raw, name)
-	}
-	return "", nil
-}
-
-func (c *configFileSettings) StringSlice(name string) ([]string, error) {
-	if raw, ok := c.Settings[name]; ok {
-		if slice, ok := raw.([]interface{}); ok {
-			strSlice := make([]string, len(slice))
-			for i, v := range slice {
-				str, ok := v.(string)
-				if !ok {
-					return nil, fmt.Errorf("expected string, found %T for %v", i, v)
-				}
-				strSlice[i] = str
-			}
-			return strSlice, nil
-		}
-		return nil, fmt.Errorf("expected string slice found %T for %s", raw, name)
-	}
-	return nil, nil
-}
-
-func (c *configFileSettings) IntSlice(name string) ([]int, error) {
-	if raw, ok := c.Settings[name]; ok {
-		if slice, ok := raw.([]interface{}); ok {
-			intSlice := make([]int, len(slice))
-			for i, v := range slice {
-				str, ok := v.(int)
-				if !ok {
-					return nil, fmt.Errorf("expected int, found %T for %v ", v, v)
-				}
-				intSlice[i] = str
-			}
-			return intSlice, nil
-		}
-		if v, ok := raw.([]int); ok {
-			return v, nil
-		}
-		return nil, fmt.Errorf("expected int slice found %T for %s", raw, name)
-	}
-	return nil, nil
-}
-
-func (c *configFileSettings) Generic(name string) (cli.Generic, error) {
-	return nil, errors.New("option type Generic not supported")
-}
-
-func (c *configFileSettings) Bool(name string) (bool, error) {
-	if raw, ok := c.Settings[name]; ok {
-		if v, ok := raw.(bool); ok {
-			return v, nil
-		}
-		return false, fmt.Errorf("expected boolean found %T for %s", raw, name)
-	}
-	return false, nil
-}
-
-var configuration configFileSettings
-
-func GetConfiguration() *Configuration {
-	return &configuration.Configuration
-}
-
-// ReadConfigFile returns InputSourceContext initialized from the configuration file.
-// On repeat calls returns with the same file, returns without reading the file again; however,
-// if value of "config" flag changes, will read the new config file
-func ReadConfigFile(c *cli.Context, log logger.Service) (*configFileSettings, error) {
-	configFile := c.String("config")
-	if configuration.Source() == configFile || configFile == "" {
-		if configuration.Source() == "" {
-			return nil, ErrNoConfigFile
-		}
-		return &configuration, nil
-	}
-
-	log.Debugf("Loading configuration from %s", configFile)
-	file, err := os.Open(configFile)
-	if err != nil {
-		if os.IsNotExist(err) {
-			err = ErrNoConfigFile
-		}
-		return nil, err
-	}
-	defer file.Close()
-	if err := yaml.NewDecoder(file).Decode(&configuration); err != nil {
-		return nil, errors.Wrap(err, "error parsing YAML in config file at "+configFile)
-	}
-	configuration.sourceFile = configFile
-	return &configuration, nil
-}

cmd/cloudflared/config/configuration_test.go

@@ -1,76 +0,0 @@
-package config
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v2"
-)
-
-func TestConfigFileSettings(t *testing.T) {
-	var (
-		firstIngress = UnvalidatedIngressRule{
-			Hostname: "tunnel1.example.com",
-			Path:     "/id",
-			Service:  "https://localhost:8000",
-		}
-		secondIngress = UnvalidatedIngressRule{
-			Hostname: "*",
-			Path:     "",
-			Service:  "https://localhost:8001",
-		}
-	)
-	rawYAML := `
-tunnel: config-file-test
-ingress:
- - hostname: tunnel1.example.com
-   path: /id
-   service: https://localhost:8000
- - hostname: "*"
-   service: https://localhost:8001
-retries: 5
-grace-period: 30s
-percentage: 3.14
-hostname: example.com
-tag:
- - test
- - central-1
-counters:
- - 123
- - 456
-`
-	var config configFileSettings
-	err := yaml.Unmarshal([]byte(rawYAML), &config)
-	assert.NoError(t, err)
-
-	assert.Equal(t, "config-file-test", config.TunnelID)
-	assert.Equal(t, firstIngress, config.Ingress[0])
-	assert.Equal(t, secondIngress, config.Ingress[1])
-
-	retries, err := config.Int("retries")
-	assert.NoError(t, err)
-	assert.Equal(t, 5, retries)
-
-	gracePeriod, err := config.Duration("grace-period")
-	assert.NoError(t, err)
-	assert.Equal(t, time.Second*30, gracePeriod)
-
-	percentage, err := config.Float64("percentage")
-	assert.NoError(t, err)
-	assert.Equal(t, 3.14, percentage)
-
-	hostname, err := config.String("hostname")
-	assert.NoError(t, err)
-	assert.Equal(t, "example.com", hostname)
-
-	tags, err := config.StringSlice("tag")
-	assert.NoError(t, err)
-	assert.Equal(t, "test", tags[0])
-	assert.Equal(t, "central-1", tags[1])
-
-	counters, err := config.IntSlice("counters")
-	assert.NoError(t, err)
-	assert.Equal(t, 123, counters[0])
-	assert.Equal(t, 456, counters[1])
-}

cmd/cloudflared/config/manager.go

@@ -1,11 +1,11 @@
 package config
 
 import (
+	"errors"
 	"os"
 
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/watcher"
-	"github.com/pkg/errors"
 	"gopkg.in/yaml.v2"
 )
 
@@ -80,7 +80,7 @@ func readConfigFromPath(configPath string) (Root, error) {
 
 	var config Root
 	if err := yaml.NewDecoder(file).Decode(&config); err != nil {
-		return Root{}, errors.Wrap(err, "error parsing YAML in config file at "+configPath)
+		return Root{}, err
 	}
 
 	return config, nil

cmd/cloudflared/config/manager_test.go

@@ -4,10 +4,9 @@ import (
 	"os"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
-
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/watcher"
+	"github.com/stretchr/testify/assert"
 )
 
 type mockNotifier struct {

cmd/cloudflared/linux_service.go

@@ -7,12 +7,11 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/pkg/errors"
-	cli "github.com/urfave/cli/v2"
-
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
+	"github.com/pkg/errors"
+	cli "github.com/urfave/cli/v2"
 )
 
 func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
@@ -24,12 +23,6 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 				Name:   "install",
 				Usage:  "Install Argo Tunnel as a system service",
 				Action: cliutil.ErrorHandler(installLinuxService),
-				Flags: []cli.Flag{
-					&cli.BoolFlag{
-						Name:  "legacy",
-						Usage: "Generate service file for non-named tunnels",
-					},
-				},
 			},
 			&cli.Command{
 				Name:   "uninstall",
@@ -47,7 +40,6 @@ const (
 	serviceConfigDir      = "/etc/cloudflared"
 	serviceConfigFile     = "config.yml"
 	serviceCredentialFile = "cert.pem"
-	serviceConfigPath     = serviceConfigDir + "/" + serviceConfigFile
 )
 
 var systemdTemplates = []ServiceTemplate{
@@ -60,7 +52,7 @@ After=network.target
 [Service]
 TimeoutStartSec=0
 Type=notify
-ExecStart={{ .Path }} --config /etc/cloudflared/config.yml --no-autoupdate{{ range .ExtraArgs }} {{ . }}{{ end }}
+ExecStart={{ .Path }} --config /etc/cloudflared/config.yml --origincert /etc/cloudflared/cert.pem --no-autoupdate
 Restart=on-failure
 RestartSec=5s
 
@@ -110,7 +102,7 @@ var sysvTemplate = ServiceTemplate{
 # Description:       Argo Tunnel agent
 ### END INIT INFO
 name=$(basename $(readlink -f $0))
-cmd="{{.Path}} --config /etc/cloudflared/config.yml --pidfile /var/run/$name.pid --autoupdate-freq 24h0m0s{{ range .ExtraArgs }} {{ . }}{{ end }}"
+cmd="{{.Path}} --config /etc/cloudflared/config.yml --origincert /etc/cloudflared/cert.pem --pidfile /var/run/$name.pid --autoupdate-freq 24h0m0s"
 pid_file="/var/run/$name.pid"
 stdout_log="/var/log/$name.log"
 stderr_log="/var/log/$name.err"
@@ -190,6 +182,10 @@ func isSystemd() bool {
 }
 
 func copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile string, logger logger.Service) error {
+	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
+		return err
+	}
+
 	srcCredentialPath := filepath.Join(userConfigDir, userCredentialFile)
 	destCredentialPath := filepath.Join(serviceConfigDir, serviceCredentialFile)
 	if srcCredentialPath != destCredentialPath {
@@ -220,63 +216,23 @@ func installLinuxService(c *cli.Context) error {
 	if err != nil {
 		return fmt.Errorf("error determining executable path: %v", err)
 	}
-	templateArgs := ServiceTemplateArgs{
-		Path: etPath,
-	}
+	templateArgs := ServiceTemplateArgs{Path: etPath}
 
-	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
+	userConfigDir := filepath.Dir(c.String("config"))
+	userConfigFile := filepath.Base(c.String("config"))
+	userCredentialFile := config.DefaultCredentialFile
+	if err = copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile, logger); err != nil {
+		logger.Errorf("Failed to copy user configuration: %s. Before running the service, ensure that %s contains two files, %s and %s", err,
+			serviceConfigDir, serviceCredentialFile, serviceConfigFile)
 		return err
 	}
-	if c.Bool("legacy") {
-		userConfigDir := filepath.Dir(c.String("config"))
-		userConfigFile := filepath.Base(c.String("config"))
-		userCredentialFile := config.DefaultCredentialFile
-		if err = copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile, logger); err != nil {
-			logger.Errorf("Failed to copy user configuration: %s. Before running the service, ensure that %s contains two files, %s and %s", err,
-				serviceConfigDir, serviceCredentialFile, serviceConfigFile)
-			return err
-		}
-		templateArgs.ExtraArgs = []string{
-			"--origincert", serviceConfigDir + "/" + serviceCredentialFile,
-		}
-	} else {
-		src, err := config.ReadConfigFile(c, logger)
-		if err != nil {
-			return err
-		}
-
-		// can't use context because this command doesn't define "credentials-file" flag
-		configPresent := func(s string) bool {
-			val, err := src.String(s)
-			return err == nil && val != ""
-		}
-		if src.TunnelID == "" || !configPresent("credentials-file") {
-			return fmt.Errorf(`Configuration file %s must contain entries for the tunnel to run and its associated credentials:
-tunnel: TUNNEL-UUID
-credentials-file: CREDENTIALS-FILE
-`, src.Source())
-		}
-		if src.Source() != serviceConfigPath {
-			if exists, err := config.FileExists(serviceConfigPath); err != nil || exists {
-				return fmt.Errorf("Possible conflicting configuration in %[1]s and %[2]s. Either remove %[2]s or run `cloudflared --config %[2]s service install`", src.Source(), serviceConfigPath)
-			}
-
-			if err := copyFile(src.Source(), serviceConfigPath); err != nil {
-				return fmt.Errorf("failed to copy %s to %s: %w", src.Source(), serviceConfigPath, err)
-			}
-		}
-
-		templateArgs.ExtraArgs = []string{
-			"tunnel", "run",
-		}
-	}
 
 	switch {
 	case isSystemd():
 		logger.Infof("Using Systemd")
 		return installSystemd(&templateArgs, logger)
 	default:
-		logger.Infof("Using SysV")
+		logger.Infof("Using Sysv")
 		return installSysv(&templateArgs, logger)
 	}
 }
@@ -335,7 +291,7 @@ func uninstallLinuxService(c *cli.Context) error {
 		logger.Infof("Using Systemd")
 		return uninstallSystemd(logger)
 	default:
-		logger.Infof("Using SysV")
+		logger.Infof("Using Sysv")
 		return uninstallSysv(logger)
 	}
 }

cmd/cloudflared/main.go

@@ -13,7 +13,6 @@ import (
 	log "github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/overwatch"
-	"github.com/cloudflare/cloudflared/tunneldns"
 	"github.com/cloudflare/cloudflared/watcher"
 
 	raven "github.com/getsentry/raven-go"
@@ -77,42 +76,21 @@ func main() {
 	and configure access control.`
 	app.Flags = flags()
 	app.Action = action(Version, shutdownC, graceShutdownC)
-	app.Before = tunnel.SetFlagsFromConfigFile
+	app.Before = tunnel.Before
 	app.Commands = commands(cli.ShowVersion)
 
 	tunnel.Init(Version, shutdownC, graceShutdownC) // we need this to support the tunnel sub command...
 	access.Init(shutdownC, graceShutdownC)
-	updater.Init(Version)
 	runApp(app, shutdownC, graceShutdownC)
 }
 
 func commands(version func(c *cli.Context)) []*cli.Command {
 	cmds := []*cli.Command{
 		{
-			Name:   "update",
-			Action: cliutil.ErrorHandler(updater.Update),
-			Usage:  "Update the agent if a new version exists",
-			Flags: []cli.Flag{
-				&cli.BoolFlag{
-					Name:  "beta",
-					Usage: "specify if you wish to update to the latest beta version",
-				},
-				&cli.BoolFlag{
-					Name:   "force",
-					Usage:  "specify if you wish to force an upgrade to the latest version regardless of the current version",
-					Hidden: true,
-				},
-				&cli.BoolFlag{
-					Name:   "staging",
-					Usage:  "specify if you wish to use the staging url for updating",
-					Hidden: true,
-				},
-				&cli.StringFlag{
-					Name:   "version",
-					Usage:  "specify a version you wish to upgrade or downgrade to",
-					Hidden: false,
-				},
-			},
+			Name:      "update",
+			Action:    cliutil.ErrorHandler(updater.Update),
+			Usage:     "Update the agent if a new version exists",
+			ArgsUsage: " ",
 			Description: `Looks for a new version on the official download server.
 If a new version exists, updates the agent binary and quits.
 Otherwise, does nothing.
@@ -130,7 +108,6 @@ To determine if an update happened in a script, check for error code 64.`,
 		},
 	}
 	cmds = append(cmds, tunnel.Commands()...)
-	cmds = append(cmds, tunneldns.Command(false))
 	cmds = append(cmds, access.Commands()...)
 	return cmds
 }
@@ -145,7 +122,7 @@ func isEmptyInvocation(c *cli.Context) bool {
 }
 
 func action(version string, shutdownC, graceShutdownC chan struct{}) cli.ActionFunc {
-	return cliutil.ErrorHandler(func(c *cli.Context) (err error) {
+	return func(c *cli.Context) (err error) {
 		if isEmptyInvocation(c) {
 			return handleServiceMode(shutdownC)
 		}
@@ -153,11 +130,15 @@ func action(version string, shutdownC, graceShutdownC chan struct{}) cli.ActionF
 		tags["hostname"] = c.String("hostname")
 		raven.SetTagsContext(tags)
 		raven.CapturePanic(func() { err = tunnel.TunnelCommand(c) }, nil)
+		exitCode := 0
 		if err != nil {
-			captureError(err)
+			handleError(err)
+			exitCode = 1
 		}
-		return err
-	})
+		// we already handle error printing, so we pass an empty string so we
+		// don't have to print again.
+		return cli.Exit("", exitCode)
+	}
 }
 
 func userHomeDir() (string, error) {
@@ -173,7 +154,7 @@ func userHomeDir() (string, error) {
 }
 
 // In order to keep the amount of noise sent to Sentry low, typical network errors can be filtered out here by a substring match.
-func captureError(err error) {
+func handleError(err error) {
 	errorMessage := err.Error()
 	for _, ignoredErrorMessage := range ignoredErrors {
 		if strings.Contains(errorMessage, ignoredErrorMessage) {

cmd/cloudflared/service_template.go

@@ -10,9 +10,8 @@ import (
 	"os/exec"
 	"text/template"
 
-	"github.com/mitchellh/go-homedir"
-
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/mitchellh/go-homedir"
 )
 
 type ServiceTemplate struct {
@@ -22,8 +21,7 @@ type ServiceTemplate struct {
 }
 
 type ServiceTemplateArgs struct {
-	Path      string
-	ExtraArgs []string
+	Path string
 }
 
 func (st *ServiceTemplate) ResolvePath() (string, error) {
@@ -141,33 +139,6 @@ func copyCredential(srcCredentialPath, destCredentialPath string) error {
 	return nil
 }
 
-func copyFile(src, dest string) error {
-	srcFile, err := os.Open(src)
-	if err != nil {
-		return err
-	}
-	defer srcFile.Close()
-
-	destFile, err := os.Create(dest)
-	if err != nil {
-		return err
-	}
-	ok := false
-	defer func() {
-		destFile.Close()
-		if !ok {
-			_ = os.Remove(dest)
-		}
-	}()
-
-	if _, err := io.Copy(destFile, srcFile); err != nil {
-		return err
-	}
-
-	ok = true
-	return nil
-}
-
 func copyConfig(srcConfigPath, destConfigPath string) error {
 	// Copy or create config
 	destFile, exists, err := openFile(destConfigPath, true)

cmd/cloudflared/tunnel/cmd.go

@@ -5,32 +5,42 @@ import (
 	"context"
 	"fmt"
 	"io/ioutil"
+	"net"
+	"net/http"
 	"net/url"
 	"os"
 	"reflect"
+	"runtime"
 	"runtime/trace"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/cloudflare/cloudflared/awsuploader"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/buildinfo"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/ui"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
 	"github.com/cloudflare/cloudflared/dbconnect"
-	"github.com/cloudflare/cloudflared/ingress"
+	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/signal"
+	"github.com/cloudflare/cloudflared/socks"
+	"github.com/cloudflare/cloudflared/sshlog"
+	"github.com/cloudflare/cloudflared/sshserver"
 	"github.com/cloudflare/cloudflared/tlsconfig"
 	"github.com/cloudflare/cloudflared/tunneldns"
 	"github.com/cloudflare/cloudflared/tunnelstore"
+	"github.com/cloudflare/cloudflared/websocket"
 
 	"github.com/coreos/go-systemd/daemon"
 	"github.com/facebookgo/grace/gracenet"
 	"github.com/getsentry/raven-go"
+	"github.com/gliderlabs/ssh"
 	"github.com/google/uuid"
 	"github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
@@ -73,6 +83,15 @@ const (
 	// hostKeyPath is the path of the dir to save SSH host keys too
 	hostKeyPath = "host-key-path"
 
+	//sshServerFlag enables cloudflared ssh proxy server
+	sshServerFlag = "ssh-server"
+
+	// socks5Flag is to enable the socks server to deframe
+	socks5Flag = "socks5"
+
+	// bastionFlag is to enable bastion, or jump host, operation
+	bastionFlag = "bastion"
+
 	// uiFlag is to enable launching cloudflared in interactive UI mode
 	uiFlag = "ui"
 
@@ -93,33 +112,86 @@ func Flags() []cli.Flag {
 }
 
 func Commands() []*cli.Command {
-	subcommands := []*cli.Command{
-		buildLoginSubcommand(false),
-		buildCreateCommand(),
-		buildRouteCommand(),
-		buildRunCommand(),
-		buildListCommand(),
-		buildIngressSubcommand(),
-		buildDeleteCommand(),
-		buildCleanupCommand(),
-		// for compatibility, allow following as tunnel subcommands
-		tunneldns.Command(true),
+	cmds := []*cli.Command{
+		{
+			Name:      "login",
+			Action:    cliutil.ErrorHandler(login),
+			Usage:     "Generate a configuration file with your login details",
+			ArgsUsage: " ",
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name:   "url",
+					Hidden: true,
+				},
+			},
+			Hidden: true,
+		},
+		{
+			Name:   "proxy-dns",
+			Action: cliutil.ErrorHandler(tunneldns.Run),
+			Usage:  "Run a DNS over HTTPS proxy server.",
+			Flags: []cli.Flag{
+				&cli.StringFlag{
+					Name:    "metrics",
+					Value:   "localhost:",
+					Usage:   "Listen address for metrics reporting.",
+					EnvVars: []string{"TUNNEL_METRICS"},
+				},
+				&cli.StringFlag{
+					Name:    "address",
+					Usage:   "Listen address for the DNS over HTTPS proxy server.",
+					Value:   "localhost",
+					EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
+				},
+				&cli.IntFlag{
+					Name:    "port",
+					Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
+					Value:   53,
+					EnvVars: []string{"TUNNEL_DNS_PORT"},
+				},
+				&cli.StringSliceFlag{
+					Name:    "upstream",
+					Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
+					Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
+					EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
+				},
+				&cli.StringSliceFlag{
+					Name:    "bootstrap",
+					Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
+					Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
+					EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
+				},
+			},
+			ArgsUsage: " ", // can't be the empty string or we get the default output
+			Hidden:    false,
+		},
 		dbConnectCmd(),
 	}
 
-	return []*cli.Command{
-		buildTunnelCommand(subcommands),
-		// for compatibility, allow following as top-level subcommands
-		buildLoginSubcommand(true),
-		dbConnectCmd(),
+	var subcommands []*cli.Command
+	for _, cmd := range cmds {
+		c := *cmd
+		c.Hidden = false
+		subcommands = append(subcommands, &c)
 	}
+
+	subcommands = append(subcommands, buildCreateCommand())
+	subcommands = append(subcommands, buildListCommand())
+	subcommands = append(subcommands, buildDeleteCommand())
+	subcommands = append(subcommands, buildRunCommand())
+	subcommands = append(subcommands, buildCleanupCommand())
+	subcommands = append(subcommands, buildRouteCommand())
+
+	cmds = append(cmds, buildTunnelCommand(subcommands))
+
+	return cmds
 }
 
 func buildTunnelCommand(subcommands []*cli.Command) *cli.Command {
 	return &cli.Command{
 		Name:      "tunnel",
 		Action:    cliutil.ErrorHandler(TunnelCommand),
-		Before:    SetFlagsFromConfigFile,
+		Before:    Before,
 		Category:  "Tunnel",
 		Usage:     "Make a locally-running web service accessible over the internet using Argo Tunnel.",
 		ArgsUsage: " ",
@@ -147,27 +219,24 @@ func buildTunnelCommand(subcommands []*cli.Command) *cli.Command {
 }
 
 func TunnelCommand(c *cli.Context) error {
-	sc, err := newSubcommandContext(c)
-	if err != nil {
-		return err
-	}
 	if name := c.String("name"); name != "" { // Start a named tunnel
-		return runAdhocNamedTunnel(sc, name)
+		return adhocNamedTunnel(c, name)
+	} else { // Start a classic tunnel
+		return classicTunnel(c)
 	}
-	if ref := config.GetConfiguration().TunnelID; ref != "" {
-		return fmt.Errorf("Use `cloudflared tunnel run` to start tunnel %s", ref)
-	}
-
-	// Start a classic tunnel
-	return runClassicTunnel(sc)
 }
 
 func Init(v string, s, g chan struct{}) {
 	version, shutdownC, graceShutdownC = v, s, g
 }
 
-// runAdhocNamedTunnel create, route and run a named tunnel in one command
-func runAdhocNamedTunnel(sc *subcommandContext, name string) error {
+// adhocNamedTunnel create, route and run a named tunnel in one command
+func adhocNamedTunnel(c *cli.Context, name string) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+
 	tunnel, ok, err := sc.tunnelActive(name)
 	if err != nil || !ok {
 		tunnel, err = sc.create(name)
@@ -178,7 +247,7 @@ func runAdhocNamedTunnel(sc *subcommandContext, name string) error {
 		sc.logger.Infof("Tunnel already created with ID %s", tunnel.ID)
 	}
 
-	if r, ok := routeFromFlag(sc.c); ok {
+	if r, ok := routeFromFlag(c); ok {
 		if res, err := sc.route(tunnel.ID, r); err != nil {
 			sc.logger.Errorf("failed to create route, please create it manually. err: %v.", err)
 		} else {
@@ -193,9 +262,14 @@ func runAdhocNamedTunnel(sc *subcommandContext, name string) error {
 	return nil
 }
 
-// runClassicTunnel creates a "classic" non-named tunnel
-func runClassicTunnel(sc *subcommandContext) error {
-	return StartServer(sc.c, version, shutdownC, graceShutdownC, nil, sc.logger, sc.isUIEnabled)
+// classicTunnel creates a "classic" non-named tunnel
+func classicTunnel(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+
+	return StartServer(c, version, shutdownC, graceShutdownC, nil, sc.logger, sc.isUIEnabled)
 }
 
 func routeFromFlag(c *cli.Context) (tunnelstore.Route, bool) {
@@ -258,8 +332,12 @@ func StartServer(
 	connectedSignal := signal.New(make(chan struct{}))
 	dnsReadySignal := make(chan struct{})
 
-	if config.GetConfiguration().Source() == "" {
-		log.Infof(config.ErrNoConfigFile.Error())
+	if c.String("config") == "" {
+		log.Infof(
+			"Cannot determine default configuration path. No file %v in %v",
+			config.DefaultConfigFiles,
+			config.DefaultConfigSearchDirectories(),
+		)
 	}
 
 	if c.IsSet("trace-output") {
@@ -353,6 +431,72 @@ func StartServer(
 		return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, 0, log)
 	}
 
+	if c.IsSet("hello-world") {
+		log.Infof("hello-world set")
+		helloListener, err := hello.CreateTLSListener("127.0.0.1:")
+		if err != nil {
+			log.Errorf("Cannot start Hello World Server: %s", err)
+			return errors.Wrap(err, "Cannot start Hello World Server")
+		}
+		defer helloListener.Close()
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_ = hello.StartHelloWorldServer(log, helloListener, shutdownC)
+		}()
+		forceSetFlag(c, "url", "https://"+helloListener.Addr().String())
+	}
+
+	if c.IsSet(sshServerFlag) {
+		if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
+			msg := fmt.Sprintf("--ssh-server is not supported on %s", runtime.GOOS)
+			log.Error(msg)
+			return errors.New(msg)
+		}
+
+		log.Infof("ssh-server set")
+
+		logManager := sshlog.NewEmptyManager()
+		if c.IsSet(bucketNameFlag) && c.IsSet(regionNameFlag) && c.IsSet(accessKeyIDFlag) && c.IsSet(secretIDFlag) {
+			uploader, err := awsuploader.NewFileUploader(c.String(bucketNameFlag), c.String(regionNameFlag),
+				c.String(accessKeyIDFlag), c.String(secretIDFlag), c.String(sessionTokenIDFlag), c.String(s3URLFlag))
+			if err != nil {
+				msg := "Cannot create uploader for SSH Server"
+				log.Errorf("%s: %s", msg, err)
+				return errors.Wrap(err, msg)
+			}
+
+			if err := os.MkdirAll(sshLogFileDirectory, 0700); err != nil {
+				msg := fmt.Sprintf("Cannot create SSH log file directory %s", sshLogFileDirectory)
+				log.Errorf("%s: %s", msg, err)
+				return errors.Wrap(err, msg)
+			}
+
+			logManager = sshlog.New(sshLogFileDirectory)
+
+			uploadManager := awsuploader.NewDirectoryUploadManager(log, uploader, sshLogFileDirectory, 30*time.Minute, shutdownC)
+			uploadManager.Start()
+		}
+
+		localServerAddress := "127.0.0.1:" + c.String(sshPortFlag)
+		server, err := sshserver.New(logManager, log, version, localServerAddress, c.String("hostname"), c.Path(hostKeyPath), shutdownC, c.Duration(sshIdleTimeoutFlag), c.Duration(sshMaxTimeoutFlag))
+		if err != nil {
+			msg := "Cannot create new SSH Server"
+			log.Errorf("%s: %s", msg, err)
+			return errors.Wrap(err, msg)
+		}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if err = server.Start(); err != nil && err != ssh.ErrServerClosed {
+				log.Errorf("SSH server error: %s", err)
+				// TODO: remove when declarative tunnels are implemented.
+				close(shutdownC)
+			}
+		}()
+		forceSetFlag(c, "url", "ssh://"+localServerAddress)
+	}
+
 	url := c.String("url")
 	hostname := c.String("hostname")
 	if url == hostname && url != "" && hostname != "" {
@@ -361,6 +505,42 @@ func StartServer(
 		return fmt.Errorf(errText)
 	}
 
+	if staticHost := hostnameFromURI(c.String("url")); isProxyDestinationConfigured(staticHost, c) {
+		listener, err := net.Listen("tcp", "127.0.0.1:")
+		if err != nil {
+			log.Errorf("Cannot start Websocket Proxy Server: %s", err)
+			return errors.Wrap(err, "Cannot start Websocket Proxy Server")
+		}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			streamHandler := websocket.DefaultStreamHandler
+			if c.IsSet(socks5Flag) {
+				log.Info("SOCKS5 server started")
+				streamHandler = func(wsConn *websocket.Conn, remoteConn net.Conn, _ http.Header) {
+					dialer := socks.NewConnDialer(remoteConn)
+					requestHandler := socks.NewRequestHandler(dialer)
+					socksServer := socks.NewConnectionHandler(requestHandler)
+
+					socksServer.Serve(wsConn)
+				}
+			} else if c.IsSet(sshServerFlag) {
+				streamHandler = func(wsConn *websocket.Conn, remoteConn net.Conn, requestHeaders http.Header) {
+					if finalDestination := requestHeaders.Get(h2mux.CFJumpDestinationHeader); finalDestination != "" {
+						token := requestHeaders.Get(h2mux.CFAccessTokenHeader)
+						if err := websocket.SendSSHPreamble(remoteConn, finalDestination, token); err != nil {
+							log.Errorf("Failed to send SSH preamble: %s", err)
+							return
+						}
+					}
+					websocket.DefaultStreamHandler(wsConn, remoteConn, requestHeaders)
+				}
+			}
+			errC <- websocket.StartProxyServer(log, listener, staticHost, shutdownC, streamHandler)
+		}()
+		forceSetFlag(c, "url", "http://"+listener.Addr().String())
+	}
+
 	transportLogger, err := createLogger(c, true, false)
 	if err != nil {
 		return errors.Wrap(err, "error setting up transport logger")
@@ -371,8 +551,6 @@ func StartServer(
 		return err
 	}
 
-	tunnelConfig.IngressRules.StartOrigins(&wg, log, shutdownC, errC)
-
 	reconnectCh := make(chan origin.ReconnectSignal, 1)
 	if c.IsSet("stdin-control") {
 		log.Info("Enabling control through stdin")
@@ -394,8 +572,7 @@ func StartServer(
 			version,
 			hostname,
 			metricsListener.Addr().String(),
-			// TODO (TUN-3461): Update UI to show multiple origin URLs
-			&tunnelConfig.IngressRules,
+			tunnelConfig.OriginUrl,
 			tunnelConfig.HAConnections,
 		)
 		logLevels, err := logger.ParseLevelString(c.String("loglevel"))
@@ -417,29 +594,35 @@ func forceSetFlag(c *cli.Context, name, value string) {
 	}
 }
 
-func SetFlagsFromConfigFile(c *cli.Context) error {
-	const exitCode = 1
-	log, err := createLogger(c, false, false)
+func Before(c *cli.Context) error {
+	logger, err := createLogger(c, false, false)
 	if err != nil {
 		return cliutil.PrintLoggerSetupError("error setting up logger", err)
 	}
-	inputSource, err := config.ReadConfigFile(c, log)
+
+	if c.String("config") == "" {
+		logger.Debugf("Cannot determine default configuration path. No file %v in %v", config.DefaultConfigFiles, config.DefaultConfigSearchDirectories())
+	}
+	inputSource, err := config.FindInputSourceContext(c)
 	if err != nil {
-		if err == config.ErrNoConfigFile {
-			return nil
+		logger.Errorf("Cannot load configuration from %s: %s", c.String("config"), err)
+		return err
+	} else if inputSource != nil {
+		err := altsrc.ApplyInputSourceValues(c, inputSource, c.App.Flags)
+		if err != nil {
+			logger.Errorf("Cannot apply configuration from %s: %s", c.String("config"), err)
+			return err
 		}
-		return cli.Exit(err, exitCode)
-	}
-	targetFlags := c.Command.Flags
-	if c.Command.Name == "" {
-		targetFlags = c.App.Flags
-	}
-	if err := altsrc.ApplyInputSourceValues(c, inputSource, targetFlags); err != nil {
-		return cli.Exit(err, exitCode)
+		logger.Debugf("Applied configuration from %s", c.String("config"))
 	}
 	return nil
 }
 
+// isProxyDestinationConfigured returns true if there is a static host set or if bastion mode is set.
+func isProxyDestinationConfigured(staticHost string, c *cli.Context) bool {
+	return staticHost != "" || c.IsSet(bastionFlag)
+}
+
 func waitToShutdown(wg *sync.WaitGroup,
 	errC chan error,
 	shutdownC, graceShutdownC chan struct{},
@@ -522,7 +705,7 @@ func dbConnectCmd() *cli.Command {
 
 	// Override before to run tunnel validation before dbconnect validation.
 	cmd.Before = func(c *cli.Context) error {
-		err := SetFlagsFromConfigFile(c)
+		err := Before(c)
 		if err == nil {
 			err = dbconnect.CmdBefore(c)
 		}
@@ -569,11 +752,26 @@ func appendFlags(flags []cli.Flag, extraFlags ...cli.Flag) []cli.Flag {
 }
 
 func tunnelFlags(shouldHide bool) []cli.Flag {
-	flags := configureCloudflaredFlags(shouldHide)
-	flags = append(flags, configureProxyFlags(shouldHide)...)
-	flags = append(flags, configureLoggingFlags(shouldHide)...)
-	flags = append(flags, configureProxyDNSFlags(shouldHide)...)
-	flags = append(flags, []cli.Flag{
+	flags := []cli.Flag{
+		&cli.StringFlag{
+			Name:   "config",
+			Usage:  "Specifies a config file in YAML format.",
+			Value:  config.FindDefaultConfigPath(),
+			Hidden: shouldHide,
+		},
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "autoupdate-freq",
+			Usage:  fmt.Sprintf("Autoupdate frequency. Default is %v.", updater.DefaultCheckUpdateFreq),
+			Value:  updater.DefaultCheckUpdateFreq,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "no-autoupdate",
+			Usage:   "Disable periodic check for updates, restarting the server with the new version.",
+			EnvVars: []string{"NO_AUTOUPDATE"},
+			Value:   false,
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
 			Name:   "is-autoupdated",
 			Usage:  "Signal the new process that Argo Tunnel client has been autoupdated",
@@ -592,12 +790,49 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_CACERT"},
 			Hidden:  true,
 		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "no-tls-verify",
+			Usage:   "Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. Note: The connection from your machine to Cloudflare's Edge is still encrypted.",
+			EnvVars: []string{"NO_TLS_VERIFY"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "origincert",
+			Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
+			EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
+			Value:   findDefaultOriginCertPath(),
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    tlsconfig.OriginCAPoolFlag,
+			Usage:   "Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.",
+			EnvVars: []string{"TUNNEL_ORIGIN_CA_POOL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "unix-socket",
+			Usage:   "Path to unix socket to use instead of --url",
+			EnvVars: []string{"TUNNEL_UNIX_SOCKET"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "hostname",
 			Usage:   "Set a hostname on a Cloudflare zone to route traffic through this tunnel.",
 			EnvVars: []string{"TUNNEL_HOSTNAME"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "http-host-header",
+			Usage:   "Sets the HTTP Host header for the local webserver.",
+			EnvVars: []string{"TUNNEL_HTTP_HOST_HEADER"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "origin-server-name",
+			Usage:   "Hostname on the origin server certificate.",
+			EnvVars: []string{"TUNNEL_ORIGIN_SERVER_NAME"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "id",
 			Usage:   "A unique identifier used to tie connections to this tunnel instance.",
@@ -635,6 +870,13 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:   "https://api.cloudflare.com/client/v4",
 			Hidden:  true,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "metrics",
+			Value:   "localhost:",
+			Usage:   "Listen address for metrics reporting.",
+			EnvVars: []string{"TUNNEL_METRICS"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
 			Name:    "metrics-update-freq",
 			Usage:   "Frequency to update tunnel metrics",
@@ -660,6 +902,21 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:  5,
 			Hidden: true,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "loglevel",
+			Value:   "info",
+			Usage:   "Application logging level {fatal, error, info, debug}. " + debugLevelWarning,
+			EnvVars: []string{"TUNNEL_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "transport-loglevel",
+			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
+			Value:   "fatal",
+			Usage:   "Transport logging level(previously called protocol logging level) {fatal, error, info, debug}",
+			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewUintFlag(&cli.UintFlag{
 			Name:    "retries",
 			Value:   5,
@@ -667,11 +924,110 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_RETRIES"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "pidfile",
+			Usage:   "Write the application's PID to this file after first successful connection.",
+			EnvVars: []string{"TUNNEL_PIDFILE"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "logfile",
+			Usage:   "Save application log to this file for reporting issues.",
+			EnvVars: []string{"TUNNEL_LOGFILE"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    logDirectoryFlag,
+			Usage:   "Save application log to this directory for reporting issues.",
+			EnvVars: []string{"TUNNEL_LOGDIRECTORY"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewIntFlag(&cli.IntFlag{
 			Name:   "ha-connections",
 			Value:  4,
 			Hidden: true,
 		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-connect-timeout",
+			Usage:  "HTTP proxy timeout for establishing a new connection",
+			Value:  time.Second * 30,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-tls-timeout",
+			Usage:  "HTTP proxy timeout for completing a TLS handshake",
+			Value:  time.Second * 10,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-tcp-keepalive",
+			Usage:  "HTTP proxy TCP keepalive duration",
+			Value:  time.Second * 30,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:   "proxy-no-happy-eyeballs",
+			Usage:  "HTTP proxy should disable \"happy eyeballs\" for IPv4/v6 fallback",
+			Hidden: shouldHide,
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:   "proxy-keepalive-connections",
+			Usage:  "HTTP proxy maximum keepalive connection pool size",
+			Value:  100,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-keepalive-timeout",
+			Usage:  "HTTP proxy timeout for closing an idle connection",
+			Value:  time.Second * 90,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-connection-timeout",
+			Usage:  "HTTP proxy timeout for closing an idle connection",
+			Value:  time.Second * 90,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "proxy-expect-continue-timeout",
+			Usage:  "HTTP proxy timeout for closing an idle connection",
+			Value:  time.Second * 90,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "proxy-dns",
+			Usage:   "Run a DNS over HTTPS proxy server.",
+			EnvVars: []string{"TUNNEL_DNS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:    "proxy-dns-port",
+			Value:   53,
+			Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
+			EnvVars: []string{"TUNNEL_DNS_PORT"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "proxy-dns-address",
+			Usage:   "Listen address for the DNS over HTTPS proxy server.",
+			Value:   "localhost",
+			EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name:    "proxy-dns-upstream",
+			Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
+			Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
+			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name:    "proxy-dns-bootstrap",
+			Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
+			Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
+			EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
 			Name:    "grace-period",
 			Usage:   "Duration to accept new requests after cloudflared receives first SIGINT/SIGTERM. A second SIGINT/SIGTERM will force cloudflared to shutdown immediately.",
@@ -686,6 +1042,18 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_COMPRESSION_LEVEL"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "no-chunked-encoding",
+			Usage:   "Disables chunked transfer encoding; useful if you are running a WSGI server.",
+			EnvVars: []string{"TUNNEL_NO_CHUNKED_ENCODING"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "trace-output",
+			Usage:   "Name of trace output file, generated when cloudflared stops.",
+			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
 			Name:    "use-reconnect-token",
 			Usage:   "Test reestablishing connections with the new 'reconnect token' flow.",
@@ -719,166 +1087,33 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:  false,
 			Hidden: shouldHide,
 		}),
-	}...)
-
-	return flags
-}
-
-// Flags in tunnel command that is relevant to run subcommand
-func configureCloudflaredFlags(shouldHide bool) []cli.Flag {
-	return []cli.Flag{
-		&cli.StringFlag{
-			Name:   "config",
-			Usage:  "Specifies a config file in YAML format.",
-			Value:  config.FindDefaultConfigPath(),
-			Hidden: shouldHide,
-		},
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "origincert",
-			Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
-			EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
-			Value:   findDefaultOriginCertPath(),
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   "autoupdate-freq",
-			Usage:  fmt.Sprintf("Autoupdate frequency. Default is %v.", updater.DefaultCheckUpdateFreq),
-			Value:  updater.DefaultCheckUpdateFreq,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "no-autoupdate",
-			Usage:   "Disable periodic check for updates, restarting the server with the new version.",
-			EnvVars: []string{"NO_AUTOUPDATE"},
-			Value:   false,
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "metrics",
-			Value:   "localhost:",
-			Usage:   "Listen address for metrics reporting.",
-			EnvVars: []string{"TUNNEL_METRICS"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "pidfile",
-			Usage:   "Write the application's PID to this file after first successful connection.",
-			EnvVars: []string{"TUNNEL_PIDFILE"},
-			Hidden:  shouldHide,
-		}),
-	}
-}
-
-func configureProxyFlags(shouldHide bool) []cli.Flag {
-	flags := []cli.Flag{
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "url",
-			Value:   "http://localhost:8080",
-			Usage:   "Connect to the local webserver at `URL`.",
-			EnvVars: []string{"TUNNEL_URL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "hello-world",
-			Value:   false,
-			Usage:   "Run Hello World Server",
-			EnvVars: []string{"TUNNEL_HELLO_WORLD"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    ingress.Socks5Flag,
-			Usage:   "specify if this tunnel is running as a SOCK5 Server",
-			EnvVars: []string{"TUNNEL_SOCKS"},
-			Value:   false,
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   ingress.ProxyConnectTimeoutFlag,
-			Usage:  "HTTP proxy timeout for establishing a new connection",
-			Value:  time.Second * 30,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   ingress.ProxyTLSTimeoutFlag,
-			Usage:  "HTTP proxy timeout for completing a TLS handshake",
-			Value:  time.Second * 10,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   ingress.ProxyTCPKeepAlive,
-			Usage:  "HTTP proxy TCP keepalive duration",
-			Value:  time.Second * 30,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:   ingress.ProxyNoHappyEyeballsFlag,
-			Usage:  "HTTP proxy should disable \"happy eyeballs\" for IPv4/v6 fallback",
-			Hidden: shouldHide,
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:   ingress.ProxyKeepAliveConnectionsFlag,
-			Usage:  "HTTP proxy maximum keepalive connection pool size",
-			Value:  100,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   ingress.ProxyKeepAliveTimeoutFlag,
-			Usage:  "HTTP proxy timeout for closing an idle connection",
-			Value:  time.Second * 90,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   "proxy-connection-timeout",
-			Usage:  "DEPRECATED. No longer has any effect.",
-			Value:  time.Second * 90,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   "proxy-expect-continue-timeout",
-			Usage:  "DEPRECATED. No longer has any effect.",
-			Value:  time.Second * 90,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    ingress.HTTPHostHeaderFlag,
-			Usage:   "Sets the HTTP Host header for the local webserver.",
-			EnvVars: []string{"TUNNEL_HTTP_HOST_HEADER"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    ingress.OriginServerNameFlag,
-			Usage:   "Hostname on the origin server certificate.",
-			EnvVars: []string{"TUNNEL_ORIGIN_SERVER_NAME"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "unix-socket",
-			Usage:   "Path to unix socket to use instead of --url",
-			EnvVars: []string{"TUNNEL_UNIX_SOCKET"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    tlsconfig.OriginCAPoolFlag,
-			Usage:   "Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.",
-			EnvVars: []string{"TUNNEL_ORIGIN_CA_POOL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    ingress.NoTLSVerifyFlag,
-			Usage:   "Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. Note: The connection from your machine to Cloudflare's Edge is still encrypted.",
-			EnvVars: []string{"NO_TLS_VERIFY"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    ingress.NoChunkedEncodingFlag,
-			Usage:   "Disables chunked transfer encoding; useful if you are running a WSGI server.",
-			EnvVars: []string{"TUNNEL_NO_CHUNKED_ENCODING"},
-			Hidden:  shouldHide,
-		}),
+		urlFlag(shouldHide),
+		helloWorldFlag(shouldHide),
+		createSocks5Flag(shouldHide),
 	}
 	return append(flags, sshFlags(shouldHide)...)
 }
 
+func urlFlag(shouldHide bool) cli.Flag {
+	return altsrc.NewStringFlag(&cli.StringFlag{
+		Name:    "url",
+		Value:   "http://localhost:8080",
+		Usage:   "Connect to the local webserver at `URL`.",
+		EnvVars: []string{"TUNNEL_URL"},
+		Hidden:  shouldHide,
+	})
+}
+
+func helloWorldFlag(shouldHide bool) cli.Flag {
+	return altsrc.NewBoolFlag(&cli.BoolFlag{
+		Name:    "hello-world",
+		Value:   false,
+		Usage:   "Run Hello World Server",
+		EnvVars: []string{"TUNNEL_HELLO_WORLD"},
+		Hidden:  shouldHide,
+	})
+}
+
 func sshFlags(shouldHide bool) []cli.Flag {
 	return []cli.Flag{
 		altsrc.NewStringFlag(&cli.StringFlag{
@@ -943,111 +1178,30 @@ func sshFlags(shouldHide bool) []cli.Flag {
 			Hidden:  true,
 		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    ingress.SSHServerFlag,
+			Name:    sshServerFlag,
 			Value:   false,
 			Usage:   "Run an SSH Server",
 			EnvVars: []string{"TUNNEL_SSH_SERVER"},
 			Hidden:  true, // TODO: remove when feature is complete
 		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    config.BastionFlag,
+			Name:    bastionFlag,
 			Value:   false,
 			Usage:   "Runs as jump host",
 			EnvVars: []string{"TUNNEL_BASTION"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    ingress.ProxyAddressFlag,
-			Usage:   "Listen address for the proxy.",
-			Value:   "127.0.0.1",
-			EnvVars: []string{"TUNNEL_PROXY_ADDRESS"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:    ingress.ProxyPortFlag,
-			Usage:   "Listen port for the proxy.",
-			Value:   0,
-			EnvVars: []string{"TUNNEL_PROXY_PORT"},
-			Hidden:  shouldHide,
-		}),
 	}
 }
 
-func configureLoggingFlags(shouldHide bool) []cli.Flag {
-	return []cli.Flag{
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "loglevel",
-			Value:   "info",
-			Usage:   "Application logging level {fatal, error, info, debug}. " + debugLevelWarning,
-			EnvVars: []string{"TUNNEL_LOGLEVEL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "transport-loglevel",
-			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
-			Value:   "fatal",
-			Usage:   "Transport logging level(previously called protocol logging level) {fatal, error, info, debug}",
-			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "logfile",
-			Usage:   "Save application log to this file for reporting issues.",
-			EnvVars: []string{"TUNNEL_LOGFILE"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    logDirectoryFlag,
-			Usage:   "Save application log to this directory for reporting issues.",
-			EnvVars: []string{"TUNNEL_LOGDIRECTORY"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "trace-output",
-			Usage:   "Name of trace output file, generated when cloudflared stops.",
-			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
-			Hidden:  shouldHide,
-		}),
-	}
-}
-
-func configureProxyDNSFlags(shouldHide bool) []cli.Flag {
-	return []cli.Flag{
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "proxy-dns",
-			Usage:   "Run a DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:    "proxy-dns-port",
-			Value:   53,
-			Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS_PORT"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "proxy-dns-address",
-			Usage:   "Listen address for the DNS over HTTPS proxy server.",
-			Value:   "localhost",
-			EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "proxy-dns-upstream",
-			Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-			Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "proxy-dns-bootstrap",
-			Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
-			Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
-			EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
-			Hidden:  shouldHide,
-		}),
-	}
+func createSocks5Flag(shouldHide bool) cli.Flag {
+	return altsrc.NewBoolFlag(&cli.BoolFlag{
+		Name:    socks5Flag,
+		Usage:   "specify if this tunnel is running as a SOCK5 Server",
+		EnvVars: []string{"TUNNEL_SOCKS"},
+		Value:   false,
+		Hidden:  shouldHide,
+	})
 }
 
 func stdinControl(reconnectCh chan origin.ReconnectSignal, logger logger.Service) {

cmd/cloudflared/tunnel/configuration.go

@@ -1,15 +1,19 @@
 package tunnel
 
 import (
+	"context"
+	"crypto/tls"
 	"fmt"
 	"io/ioutil"
+	"net"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/buildinfo"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
-	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/tlsconfig"
@@ -180,6 +184,12 @@ func prepareTunnelConfig(
 
 	tags = append(tags, tunnelpogs.Tag{Name: "ID", Value: clientID})
 
+	originURL, err := config.ValidateUrl(c, compatibilityMode)
+	if err != nil {
+		logger.Errorf("Error validating origin URL: %s", err)
+		return nil, errors.Wrap(err, "Error validating origin URL")
+	}
+
 	var originCert []byte
 	if !isFreeTunnel {
 		originCert, err = getOriginCert(c, logger)
@@ -188,9 +198,65 @@ func prepareTunnelConfig(
 		}
 	}
 
-	tunnelMetrics := origin.NewTunnelMetrics()
+	originCertPool, err := tlsconfig.LoadOriginCA(c, logger)
+	if err != nil {
+		logger.Errorf("Error loading cert pool: %s", err)
+		return nil, errors.Wrap(err, "Error loading cert pool")
+	}
+
+	tunnelMetrics := origin.NewTunnelMetrics()
+	httpTransport := &http.Transport{
+		Proxy:                 http.ProxyFromEnvironment,
+		MaxIdleConns:          c.Int("proxy-keepalive-connections"),
+		MaxIdleConnsPerHost:   c.Int("proxy-keepalive-connections"),
+		IdleConnTimeout:       c.Duration("proxy-keepalive-timeout"),
+		TLSHandshakeTimeout:   c.Duration("proxy-tls-timeout"),
+		ExpectContinueTimeout: 1 * time.Second,
+		TLSClientConfig:       &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: c.IsSet("no-tls-verify")},
+	}
+
+	dialer := &net.Dialer{
+		Timeout:   c.Duration("proxy-connect-timeout"),
+		KeepAlive: c.Duration("proxy-tcp-keepalive"),
+	}
+	if c.Bool("proxy-no-happy-eyeballs") {
+		dialer.FallbackDelay = -1 // As of Golang 1.12, a negative delay disables "happy eyeballs"
+	}
+	dialContext := dialer.DialContext
+
+	if c.IsSet("unix-socket") {
+		unixSocket, err := config.ValidateUnixSocket(c)
+		if err != nil {
+			logger.Errorf("Error validating --unix-socket: %s", err)
+			return nil, errors.Wrap(err, "Error validating --unix-socket")
+		}
+
+		logger.Infof("Proxying tunnel requests to unix:%s", unixSocket)
+		httpTransport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
+			// if --unix-socket specified, enforce network type "unix"
+			return dialContext(ctx, "unix", unixSocket)
+		}
+	} else {
+		logger.Infof("Proxying tunnel requests to %s", originURL)
+		httpTransport.DialContext = dialContext
+	}
+
+	if !c.IsSet("hello-world") && c.IsSet("origin-server-name") {
+		httpTransport.TLSClientConfig.ServerName = c.String("origin-server-name")
+	}
+	// If tunnel running in bastion mode, a connection to origin will not exist until initiated by the client.
+	if !c.IsSet(bastionFlag) {
+		if err = validation.ValidateHTTPService(originURL, hostname, httpTransport); err != nil {
+			logger.Errorf("unable to connect to the origin: %s", err)
+		}
+	}
+
+	toEdgeTLSConfig, err := tlsconfig.CreateTunnelConfig(c)
+	if err != nil {
+		logger.Errorf("unable to create TLS config to connect with edge: %s", err)
+		return nil, errors.Wrap(err, "unable to create TLS config to connect with edge")
+	}
 
-	var ingressRules ingress.Ingress
 	if namedTunnel != nil {
 		clientUUID, err := uuid.NewRandom()
 		if err != nil {
@@ -202,37 +268,20 @@ func prepareTunnelConfig(
 			Version:  version,
 			Arch:     fmt.Sprintf("%s_%s", buildInfo.GoOS, buildInfo.GoArch),
 		}
-		ingressRules, err = ingress.ParseIngress(config.GetConfiguration())
-		if err != nil && err != ingress.ErrNoIngressRules {
-			return nil, err
-		}
-		if !ingressRules.IsEmpty() && c.IsSet("url") {
-			return nil, ingress.ErrURLIncompatibleWithIngress
-		}
 	}
 
-	// Convert single-origin configuration into multi-origin configuration.
-	if ingressRules.IsEmpty() {
-		ingressRules, err = ingress.NewSingleOrigin(c, compatibilityMode, logger)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	toEdgeTLSConfig, err := tlsconfig.CreateTunnelConfig(c)
-	if err != nil {
-		logger.Errorf("unable to create TLS config to connect with edge: %s", err)
-		return nil, errors.Wrap(err, "unable to create TLS config to connect with edge")
-	}
 	return &origin.TunnelConfig{
 		BuildInfo:          buildInfo,
 		ClientID:           clientID,
+		ClientTlsConfig:    httpTransport.TLSClientConfig,
 		CompressionQuality: c.Uint64("compression-quality"),
 		EdgeAddrs:          c.StringSlice("edge"),
 		GracePeriod:        c.Duration("grace-period"),
 		HAConnections:      c.Int("ha-connections"),
+		HTTPTransport:      httpTransport,
 		HeartbeatInterval:  c.Duration("heartbeat-interval"),
 		Hostname:           hostname,
+		HTTPHostHeader:     c.String("http-host-header"),
 		IncidentLookup:     origin.NewIncidentLookup(),
 		IsAutoupdated:      c.Bool("is-autoupdated"),
 		IsFreeTunnel:       isFreeTunnel,
@@ -242,7 +291,9 @@ func prepareTunnelConfig(
 		MaxHeartbeats:      c.Uint64("heartbeat-count"),
 		Metrics:            tunnelMetrics,
 		MetricsUpdateFreq:  c.Duration("metrics-update-freq"),
+		NoChunkedEncoding:  c.Bool("no-chunked-encoding"),
 		OriginCert:         originCert,
+		OriginUrl:          originURL,
 		ReportedVersion:    version,
 		Retries:            c.Uint("retries"),
 		RunFromTerminal:    isRunningFromTerminal(),
@@ -250,7 +301,6 @@ func prepareTunnelConfig(
 		TlsConfig:          toEdgeTLSConfig,
 		NamedTunnel:        namedTunnel,
 		ReplaceExisting:    c.Bool("force"),
-		IngressRules:       ingressRules,
 		// turn off use of reconnect token and auth refresh when using named tunnels
 		UseReconnectToken: compatibilityMode && c.Bool("use-reconnect-token"),
 	}, nil

cmd/cloudflared/tunnel/ingress_subcommands.go

@@ -1,114 +0,0 @@
-package tunnel
-
-import (
-	"fmt"
-	"net/url"
-
-	"github.com/pkg/errors"
-	"github.com/urfave/cli/v2"
-
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
-	"github.com/cloudflare/cloudflared/ingress"
-)
-
-func buildIngressSubcommand() *cli.Command {
-	return &cli.Command{
-		Name:      "ingress",
-		Category:  "Tunnel",
-		Usage:     "Validate and test cloudflared tunnel's ingress configuration",
-		UsageText: "cloudflared tunnel [--config FILEPATH] ingress COMMAND [arguments...]",
-		Hidden:    true,
-		Description: ` Cloudflared lets you route traffic from the internet to multiple different addresses on your
-		origin. Multiple-origin routing is configured by a set of rules. Each rule matches traffic
-		by its hostname or path, and routes it to an address. These rules are configured under the
-		'ingress' key of your config.yaml, for example:
-
-		ingress:
-		  - hostname: www.example.com
-		    service: https://localhost:8000
-		  - hostname: *.example.xyz
-		    path: /[a-zA-Z]+.html
-		    service: https://localhost:8001
-		  - hostname: *
-		    service: https://localhost:8002
-
-		To ensure cloudflared can route all incoming requests, the last rule must be a catch-all
-		rule that matches all traffic. You can validate these rules with the 'ingress validate'
-		command, and test which rule matches a particular URL with 'ingress rule <URL>'.
-
-		Multiple-origin routing is incompatible with the --url flag.`,
-		Subcommands: []*cli.Command{buildValidateIngressCommand(), buildTestURLCommand()},
-	}
-}
-
-func buildValidateIngressCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "validate",
-		Action:      cliutil.ErrorHandler(validateIngressCommand),
-		Usage:       "Validate the ingress configuration ",
-		UsageText:   "cloudflared tunnel [--config FILEPATH] ingress validate",
-		Description: "Validates the configuration file, ensuring your ingress rules are OK.",
-	}
-}
-
-func buildTestURLCommand() *cli.Command {
-	return &cli.Command{
-		Name:      "rule",
-		Action:    cliutil.ErrorHandler(testURLCommand),
-		Usage:     "Check which ingress rule matches a given request URL",
-		UsageText: "cloudflared tunnel [--config FILEPATH] ingress rule URL",
-		ArgsUsage: "URL",
-		Description: "Check which ingress rule matches a given request URL. " +
-			"Ingress rules match a request's hostname and path. Hostname is " +
-			"optional and is either a full hostname like `www.example.com` or a " +
-			"hostname with a `*` for its subdomains, e.g. `*.example.com`. Path " +
-			"is optional and matches a regular expression, like `/[a-zA-Z0-9_]+.html`",
-	}
-}
-
-// validateIngressCommand check the syntax of the ingress rules in the cloudflared config file
-func validateIngressCommand(c *cli.Context) error {
-	conf := config.GetConfiguration()
-	if conf.Source() == "" {
-		fmt.Println("No configuration file was found. Please create one, or use the --config flag to specify its filepath. You can use the help command to learn more about configuration files")
-		return nil
-	}
-	fmt.Println("Validating rules from", conf.Source())
-	if _, err := ingress.ParseIngress(conf); err != nil {
-		return errors.Wrap(err, "Validation failed")
-	}
-	if c.IsSet("url") {
-		return ingress.ErrURLIncompatibleWithIngress
-	}
-	fmt.Println("OK")
-	return nil
-}
-
-// testURLCommand checks which ingress rule matches the given URL.
-func testURLCommand(c *cli.Context) error {
-	requestArg := c.Args().First()
-	if requestArg == "" {
-		return errors.New("cloudflared tunnel rule expects a single argument, the URL to test")
-	}
-
-	requestURL, err := url.Parse(requestArg)
-	if err != nil {
-		return fmt.Errorf("%s is not a valid URL", requestArg)
-	}
-	if requestURL.Hostname() == "" && requestURL.Scheme == "" {
-		return fmt.Errorf("%s doesn't have a hostname, consider adding a scheme", requestArg)
-	}
-
-	conf := config.GetConfiguration()
-	fmt.Println("Using rules from", conf.Source())
-	ing, err := ingress.ParseIngress(conf)
-	if err != nil {
-		return errors.Wrap(err, "Validation failed")
-	}
-
-	_, i := ing.FindMatchingRule(requestURL.Hostname(), requestURL.Path)
-	fmt.Printf("Matched rule #%d\n", i+1)
-	fmt.Println(ing.Rules[i].MultiLineString())
-	return nil
-}

cmd/cloudflared/tunnel/login.go

@@ -7,14 +7,12 @@ import (
 	"path/filepath"
 	"syscall"
 
-	homedir "github.com/mitchellh/go-homedir"
-	"github.com/pkg/errors"
-	cli "github.com/urfave/cli/v2"
-
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/transfer"
 	"github.com/cloudflare/cloudflared/logger"
+	homedir "github.com/mitchellh/go-homedir"
+	"github.com/pkg/errors"
+	cli "github.com/urfave/cli/v2"
 )
 
 const (
@@ -22,22 +20,6 @@ const (
 	callbackStoreURL = "https://login.argotunnel.com/"
 )
 
-func buildLoginSubcommand(hidden bool) *cli.Command {
-	return &cli.Command{
-		Name:      "login",
-		Action:    cliutil.ErrorHandler(login),
-		Usage:     "Generate a configuration file with your login details",
-		ArgsUsage: " ",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:   "url",
-				Hidden: true,
-			},
-		},
-		Hidden: hidden,
-	}
-}
-
 func login(c *cli.Context) error {
 	logger, err := logger.New()
 	if err != nil {

cmd/cloudflared/tunnel/subcommand_context.go

@@ -8,27 +8,17 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/google/uuid"
-	"github.com/pkg/errors"
-	"github.com/urfave/cli/v2"
-
 	"github.com/cloudflare/cloudflared/certutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/tunnelstore"
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+	"github.com/urfave/cli/v2"
 )
 
-type errInvalidJSONCredential struct {
-	err  error
-	path string
-}
-
-func (e errInvalidJSONCredential) Error() string {
-	return "Invalid JSON when parsing tunnel credentials file"
-}
-
 // subcommandContext carries structs shared between subcommands, to reduce number of arguments needed to
 // pass between subcommands, and make sure they are only initialized once
 type subcommandContext struct {
@@ -120,7 +110,7 @@ func (sc *subcommandContext) readTunnelCredentials(tunnelID uuid.UUID) (*pogs.Tu
 
 	var auth pogs.TunnelAuth
 	if err = json.Unmarshal(body, &auth); err != nil {
-		return nil, errInvalidJSONCredential{path: filePath, err: err}
+		return nil, err
 	}
 	return &auth, nil
 }
@@ -130,7 +120,6 @@ func (sc *subcommandContext) tunnelCredentialsPath(tunnelID uuid.UUID) (string,
 		if validFilePath(filePath) {
 			return filePath, nil
 		}
-		return "", fmt.Errorf("Tunnel credentials file %s doesn't exist or is not a file", filePath)
 	}
 
 	// Fallback to look for tunnel credentials in the origin cert directory
@@ -253,10 +242,6 @@ func (sc *subcommandContext) delete(tunnelIDs []uuid.UUID) error {
 func (sc *subcommandContext) run(tunnelID uuid.UUID) error {
 	credentials, err := sc.readTunnelCredentials(tunnelID)
 	if err != nil {
-		if e, ok := err.(errInvalidJSONCredential); ok {
-			sc.logger.Errorf("The credentials file at %s contained invalid JSON. This is probably caused by passing the wrong filepath. Reminder: the credentials file is a .json file created via `cloudflared tunnel create`.", e.path)
-			sc.logger.Errorf("Invalid JSON when parsing credentials file: %s", e.err.Error())
-		}
 		return err
 	}
 

cmd/cloudflared/tunnel/subcommands.go

@@ -17,12 +17,10 @@ import (
 	"github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
-	"github.com/urfave/cli/v2/altsrc"
 	"golang.org/x/net/idna"
 	"gopkg.in/yaml.v2"
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/tunnelstore"
@@ -60,24 +58,24 @@ var (
 		Aliases: []string{"rd"},
 		Usage:   "Include connections that have recently disconnected in the list",
 	}
-	outputFormatFlag = altsrc.NewStringFlag(&cli.StringFlag{
+	outputFormatFlag = &cli.StringFlag{
 		Name:    "output",
 		Aliases: []string{"o"},
 		Usage:   "Render output using given `FORMAT`. Valid options are 'json' or 'yaml'",
-	})
-	forceFlag = altsrc.NewBoolFlag(&cli.BoolFlag{
+	}
+	forceFlag = &cli.BoolFlag{
 		Name:    "force",
 		Aliases: []string{"f"},
 		Usage: "By default, if a tunnel is currently being run from a cloudflared, you can't " +
 			"simultaneously rerun it again from a second cloudflared. The --force flag lets you " +
 			"overwrite the previous tunnel. If you want to use a single hostname with multiple " +
 			"tunnels, you can do so with Cloudflare's Load Balancer product.",
-	})
-	credentialsFileFlag = altsrc.NewStringFlag(&cli.StringFlag{
+	}
+	credentialsFileFlag = &cli.StringFlag{
 		Name:    "credentials-file",
 		Aliases: []string{credFileFlagAlias},
 		Usage:   "File path of tunnel credentials",
-	})
+	}
 	forceDeleteFlag = &cli.BoolFlag{
 		Name:    "force",
 		Aliases: []string{"f"},
@@ -87,18 +85,11 @@ var (
 
 func buildCreateCommand() *cli.Command {
 	return &cli.Command{
-		Name:               "create",
-		Action:             cliutil.ErrorHandler(createCommand),
-		Usage:              "Create a new tunnel with given name",
-		UsageText:          "cloudflared tunnel [tunnel command options] create [subcommand options] NAME",
-		Description:        `Creates a tunnel, registers it with Cloudflare edge and generates credential file used to run this tunnel.
-  Use "cloudflared tunnel route" subcommand to map a DNS name to this tunnel and "cloudflared tunnel run" to start the connection. 
-
-  For example, to create a tunnel named 'my-tunnel' run:
-
-  $ cloudflared tunnel create my-tunnel`,
-		Flags:              []cli.Flag{outputFormatFlag},
-		CustomHelpTemplate: commandHelpTemplate(),
+		Name:      "create",
+		Action:    cliutil.ErrorHandler(createCommand),
+		Usage:     "Create a new tunnel with given name",
+		ArgsUsage: "TUNNEL-NAME",
+		Flags:     []cli.Flag{outputFormatFlag},
 	}
 }
 
@@ -158,13 +149,11 @@ func validFilePath(path string) bool {
 
 func buildListCommand() *cli.Command {
 	return &cli.Command{
-		Name:               "list",
-		Action:             cliutil.ErrorHandler(listCommand),
-		Usage:              "List existing tunnels",
-		UsageText:          "cloudflared tunnel [tunnel command options] list [subcommand options]",
-		Description:        "cloudflared tunnel list will display all active tunnels, their created time and associated connections. Use -d flag to include deleted tunnels. See the list of options to filter the list",
-		Flags:              []cli.Flag{outputFormatFlag, showDeletedFlag, listNameFlag, listExistedAtFlag, listIDFlag, showRecentlyDisconnected},
-		CustomHelpTemplate: commandHelpTemplate(),
+		Name:      "list",
+		Action:    cliutil.ErrorHandler(listCommand),
+		Usage:     "List existing tunnels",
+		ArgsUsage: " ",
+		Flags:     []cli.Flag{outputFormatFlag, showDeletedFlag, listNameFlag, listExistedAtFlag, listIDFlag, showRecentlyDisconnected},
 	}
 }
 
@@ -264,13 +253,11 @@ func fmtConnections(connections []tunnelstore.Connection, showRecentlyDisconnect
 
 func buildDeleteCommand() *cli.Command {
 	return &cli.Command{
-		Name:               "delete",
-		Action:             cliutil.ErrorHandler(deleteCommand),
-		Usage:              "Delete existing tunnel by UUID or name",
-		UsageText:          "cloudflared tunnel [tunnel command options] delete [subcommand options] TUNNEL",
-		Description:        "cloudflared tunnel delete will delete tunnels with the given tunnel UUIDs or names. A tunnel cannot be deleted if it has active connections. To delete the tunnel unconditionally, use -f flag.",
-		Flags:              []cli.Flag{credentialsFileFlag, forceDeleteFlag},
-		CustomHelpTemplate: commandHelpTemplate(),
+		Name:      "delete",
+		Action:    cliutil.ErrorHandler(deleteCommand),
+		Usage:     "Delete existing tunnel by UUID or name",
+		ArgsUsage: "TUNNEL",
+		Flags:     []cli.Flag{credentialsFileFlag, forceDeleteFlag},
 	}
 }
 
@@ -309,25 +296,45 @@ func buildRunCommand() *cli.Command {
 	flags := []cli.Flag{
 		forceFlag,
 		credentialsFileFlag,
+		urlFlag(false),
+		helloWorldFlag(false),
+		createSocks5Flag(false),
 	}
-	flags = append(flags, configureProxyFlags(false)...)
+	flags = append(flags, sshFlags(false)...)
+	var runCommandHelpTemplate = `NAME:
+   {{.HelpName}} - {{.Usage}}
+
+USAGE:
+   {{.UsageText}}
+
+DESCRIPTION:
+   {{.Description}}
+
+TUNNEL COMMAND OPTIONS:
+	See cloudflared tunnel -h
+
+RUN COMMAND OPTIONS:
+   {{range .VisibleFlags}}{{.}}
+   {{end}}
+`
 	return &cli.Command{
 		Name:      "run",
 		Action:    cliutil.ErrorHandler(runCommand),
-		Before:    SetFlagsFromConfigFile,
 		Usage:     "Proxy a local web server by running the given tunnel",
-		UsageText: "cloudflared tunnel [tunnel command options] run [subcommand options] [TUNNEL]",
-		Description: `Runs the tunnel identified by name or UUUD, creating highly available connections 
-  between your server and the Cloudflare edge. You can provide name or UUID of tunnel to run either as the
-  last command line argument or in the configuration file using "tunnel: TUNNEL".
+		UsageText: "cloudflared tunnel [tunnel command options] run [run command options]",
+		ArgsUsage: "TUNNEL",
+		Description: `Runs the tunnel identified by name or UUUD, creating a highly available connection 
+   between your server and the Cloudflare edge.
 
-  This command requires the tunnel credentials file created when "cloudflared tunnel create" was run, 
-  however it does not need access to cert.pem from "cloudflared login" if you identify the tunnel by UUID.
-  If you experience other problems running the tunnel, "cloudflared tunnel cleanup" may help by removing 
-  any old connection records.
+   This command requires the tunnel credentials file created when "cloudflared tunnel create" was run, 
+   however it does not need access to cert.pem from "cloudflared login". If you experience problems running
+   the tunnel, "cloudflared tunnel cleanup" may help by removing any old connection records.
+
+   All the flags from the tunnel command are available, note that they have to be specified before the run command. There are flags defined both in tunnel and run command. The one in run command will take precedence.
+   For example cloudflared tunnel --url localhost:3000 run --url localhost:5000 <TUNNEL ID> will proxy requests to localhost:5000.
 `,
 		Flags:              flags,
-		CustomHelpTemplate: commandHelpTemplate(),
+		CustomHelpTemplate: runCommandHelpTemplate,
 	}
 }
 
@@ -337,40 +344,23 @@ func runCommand(c *cli.Context) error {
 		return err
 	}
 
-	if c.NArg() > 1 {
-		return cliutil.UsageError(`"cloudflared tunnel run" accepts only one argument, the ID or name of the tunnel to run.`)
+	if c.NArg() != 1 {
+		return cliutil.UsageError(`"cloudflared tunnel run" requires exactly 1 argument, the ID or name of the tunnel to run.`)
 	}
-	tunnelRef := c.Args().First()
-	if tunnelRef == "" {
-		// see if tunnel id was in the config file
-		tunnelRef = config.GetConfiguration().TunnelID
-		if tunnelRef == "" {
-			return cliutil.UsageError(`"cloudflared tunnel run" requires the ID or name of the tunnel to run as the last command line argument or in the configuration file.`)
-		}
-	}
-
-	return runNamedTunnel(sc, tunnelRef)
-}
-
-func runNamedTunnel(sc *subcommandContext, tunnelRef string) error {
-	tunnelID, err := sc.findID(tunnelRef)
+	tunnelID, err := sc.findID(c.Args().First())
 	if err != nil {
 		return errors.Wrap(err, "error parsing tunnel ID")
 	}
 
-	sc.logger.Infof("Starting tunnel %s", tunnelID.String())
-
 	return sc.run(tunnelID)
 }
 
 func buildCleanupCommand() *cli.Command {
 	return &cli.Command{
-		Name:               "cleanup",
-		Action:             cliutil.ErrorHandler(cleanupCommand),
-		Usage:              "Cleanup tunnel connections",
-		UsageText:          "cloudflared tunnel [tunnel command options] cleanup [subcommand options] TUNNEL",
-		Description:        "Delete connections for tunnels with the given UUIDs or names.",
-		CustomHelpTemplate: commandHelpTemplate(),
+		Name:      "cleanup",
+		Action:    cliutil.ErrorHandler(cleanupCommand),
+		Usage:     "Cleanup tunnel connections",
+		ArgsUsage: "TUNNEL",
 	}
 }
 
@@ -394,17 +384,16 @@ func cleanupCommand(c *cli.Context) error {
 
 func buildRouteCommand() *cli.Command {
 	return &cli.Command{
-		Name:      "route",
-		Action:    cliutil.ErrorHandler(routeCommand),
-		Usage:     "Define what hostname or load balancer can route to this tunnel",
-		UsageText: "cloudflared tunnel [tunnel command options] route [subcommand options] dns|lb TUNNEL HOSTNAME [LB-POOL]",
+		Name:   "route",
+		Action: cliutil.ErrorHandler(routeCommand),
+		Usage:  "Define what hostname or load balancer can route to this tunnel",
 		Description: `The route defines what hostname or load balancer will proxy requests to this tunnel.
 
    To route a hostname by creating a CNAME to tunnel's address:
       cloudflared tunnel route dns <tunnel ID> <hostname>
    To use this tunnel as a load balancer origin, creating pool and load balancer if necessary:
       cloudflared tunnel route lb <tunnel ID> <load balancer name> <load balancer pool>`,
-		CustomHelpTemplate: commandHelpTemplate(),
+		ArgsUsage: "dns|lb TUNNEL HOSTNAME [LB-POOL]",
 	}
 }
 
@@ -512,29 +501,3 @@ func routeCommand(c *cli.Context) error {
 	sc.logger.Infof(res.SuccessSummary())
 	return nil
 }
-
-func commandHelpTemplate() string {
-	var parentFlagsHelp string
-	for _, f := range configureCloudflaredFlags(false) {
-		parentFlagsHelp += fmt.Sprintf(" %s\n\t", f)
-	}
-	for _, f := range configureLoggingFlags(false) {
-		parentFlagsHelp += fmt.Sprintf(" %s\n\t", f)
-	}
-	const template = `NAME:
-	{{.HelpName}} - {{.Usage}}
-	
-USAGE:
-	{{.UsageText}}
- 
-DESCRIPTION:
-	{{.Description}}
- 
-TUNNEL COMMAND OPTIONS:
-	%s
-SUBCOMMAND OPTIONS:
-	{{range .VisibleFlags}}{{.}}
-	{{end}}
-`
-	return fmt.Sprintf(template, parentFlagsHelp)
-}

cmd/cloudflared/ui/launch_ui.go

@@ -3,10 +3,8 @@ package ui
 import (
 	"context"
 	"fmt"
-	"strings"
 	"time"
 
-	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/logger"
 
 	"github.com/gdamore/tcell"
@@ -36,11 +34,11 @@ type TunnelEvent struct {
 }
 
 type uiModel struct {
-	version       string
-	edgeURL       string
-	metricsURL    string
-	localServices []string
-	connections   []connState
+	version     string
+	edgeURL     string
+	metricsURL  string
+	proxyURL    string
+	connections []connState
 }
 
 type palette struct {
@@ -51,17 +49,13 @@ type palette struct {
 	reconnecting string
 }
 
-func NewUIModel(version, hostname, metricsURL string, ing *ingress.Ingress, haConnections int) *uiModel {
-	localServices := make([]string, len(ing.Rules))
-	for i, rule := range ing.Rules {
-		localServices[i] = rule.Service.String()
-	}
+func NewUIModel(version, hostname, metricsURL, proxyURL string, haConnections int) *uiModel {
 	return &uiModel{
-		version:       version,
-		edgeURL:       hostname,
-		metricsURL:    metricsURL,
-		localServices: localServices,
-		connections:   make([]connState, haConnections),
+		version:     version,
+		edgeURL:     hostname,
+		metricsURL:  metricsURL,
+		proxyURL:    proxyURL,
+		connections: make([]connState, haConnections),
 	}
 }
 
@@ -113,8 +107,7 @@ func (data *uiModel) LaunchUI(
 	tunnelHostText := tview.NewTextView().SetText(data.edgeURL)
 
 	grid.AddItem(tunnelHostText, 0, 1, 1, 1, 0, 0, false)
-	status := fmt.Sprintf("[%s]\u2022[%s] Proxying to [%s::b]%s", palette.connected, palette.defaultText, palette.url, strings.Join(data.localServices, ", "))
-	grid.AddItem(NewDynamicColorTextView().SetText(status), 1, 1, 1, 1, 0, 0, false)
+	grid.AddItem(NewDynamicColorTextView().SetText(fmt.Sprintf("[%s]\u2022[%s] Proxying to [%s::b]%s", palette.connected, palette.defaultText, palette.url, data.proxyURL)), 1, 1, 1, 1, 0, 0, false)
 
 	grid.AddItem(connTable, 2, 1, 1, 1, 0, 0, false)
 

cmd/cloudflared/updater/service.go

@@ -1,26 +0,0 @@
-package updater
-
-// Version is the functions needed to perform an update
-type Version interface {
-	Apply() error
-	String() string
-}
-
-// Service is the functions to get check for new updates
-type Service interface {
-	Check() (Version, error)
-}
-
-const (
-	// OSKeyName is the url parameter key to send to the checkin API for the operating system of the local cloudflared (e.g. windows, darwin, linux)
-	OSKeyName = "os"
-
-	// ArchitectureKeyName is the url parameter key to send to the checkin API for the architecture of the local cloudflared (e.g. amd64, x86)
-	ArchitectureKeyName = "arch"
-
-	// BetaKeyName is the url parameter key to send to the checkin API to signal if the update should be a beta version or not
-	BetaKeyName = "beta"
-
-	// VersionKeyName is the url parameter key to send to the checkin API to specific what version to upgrade or downgrade to
-	VersionKeyName = "version"
-)

cmd/cloudflared/updater/update.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
+	"github.com/equinox-io/equinox"
 	"github.com/facebookgo/grace/gracenet"
 	"github.com/pkg/errors"
 )
@@ -24,12 +25,16 @@ const (
 	noUpdateOnWindowsMessage      = "cloudflared will not automatically update on Windows systems."
 	noUpdateManagedPackageMessage = "cloudflared will not automatically update if installed by a package manager."
 	isManagedInstallFile          = ".installedFromPackageManager"
-	UpdateURL                     = "https://update.argotunnel.com"
-	StagingUpdateURL              = "https://staging-update.argotunnel.com"
 )
 
 var (
-	version string
+	publicKey = []byte(`
+-----BEGIN ECDSA PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4OWZocTVZ8Do/L6ScLdkV+9A0IYMHoOf
+dsCmJ/QZ6aw0w9qkkwEpne1Lmo6+0pGexZzFZOH6w5amShn+RXt7qkSid9iWlzGq
+EKx0BZogHSor9Wy5VztdFaAaVbsJiCbO
+-----END ECDSA PUBLIC KEY-----
+`)
 )
 
 // BinaryUpdated implements ExitCoder interface, the app will exit with status code 11
@@ -59,13 +64,6 @@ func (e *statusErr) ExitCode() int {
 	return 10
 }
 
-type updateOptions struct {
-	isBeta    bool
-	isStaging bool
-	isForced  bool
-	version   string
-}
-
 type UpdateOutcome struct {
 	Updated bool
 	Version string
@@ -76,44 +74,29 @@ func (uo *UpdateOutcome) noUpdate() bool {
 	return uo.Error == nil && uo.Updated == false
 }
 
-func Init(v string) {
-	version = v
-}
-
-func checkForUpdateAndApply(options updateOptions) UpdateOutcome {
-	cfdPath, err := os.Executable()
-	if err != nil {
+func checkForUpdateAndApply() UpdateOutcome {
+	var opts equinox.Options
+	if err := opts.SetPublicKeyPEM(publicKey); err != nil {
 		return UpdateOutcome{Error: err}
 	}
 
-	url := UpdateURL
-	if options.isStaging {
-		url = StagingUpdateURL
-	}
-
-	s := NewWorkersService(version, url, cfdPath, Options{IsBeta: options.isBeta,
-		IsForced: options.isForced, RequestedVersion: options.version})
-
-	v, err := s.Check()
-	if err != nil {
-		return UpdateOutcome{Error: err}
-	}
-
-	//already on the latest version
-	if v == nil {
+	resp, err := equinox.Check(appID, opts)
+	switch {
+	case err == equinox.NotAvailableErr:
 		return UpdateOutcome{}
+	case err != nil:
+		return UpdateOutcome{Error: err}
 	}
 
-	err = v.Apply()
+	err = resp.Apply()
 	if err != nil {
 		return UpdateOutcome{Error: err}
 	}
 
-	return UpdateOutcome{Updated: true, Version: v.String()}
+	return UpdateOutcome{Updated: true, Version: resp.ReleaseVersion}
 }
 
-// Update is the handler for the update command from the command line
-func Update(c *cli.Context) error {
+func Update(_ *cli.Context) error {
 	logger, err := logger.New()
 	if err != nil {
 		return errors.Wrap(err, "error setting up logger")
@@ -124,22 +107,7 @@ func Update(c *cli.Context) error {
 		return nil
 	}
 
-	isBeta := c.Bool("beta")
-	if isBeta {
-		logger.Info("cloudflared is set to update to the latest beta version")
-	}
-
-	isStaging := c.Bool("staging")
-	if isStaging {
-		logger.Info("cloudflared is set to update from staging")
-	}
-
-	isForced := c.Bool("force")
-	if isForced {
-		logger.Info("cloudflared is set to upgrade to the latest publish version regardless of the current version")
-	}
-
-	updateOutcome := loggedUpdate(logger, updateOptions{isBeta: isBeta, isStaging: isStaging, isForced: isForced, version: c.String("version")})
+	updateOutcome := loggedUpdate(logger)
 	if updateOutcome.Error != nil {
 		return &statusErr{updateOutcome.Error}
 	}
@@ -153,8 +121,8 @@ func Update(c *cli.Context) error {
 }
 
 // Checks for an update and applies it if one is available
-func loggedUpdate(logger logger.Service, options updateOptions) UpdateOutcome {
-	updateOutcome := checkForUpdateAndApply(options)
+func loggedUpdate(logger logger.Service) UpdateOutcome {
+	updateOutcome := checkForUpdateAndApply()
 	if updateOutcome.Updated {
 		logger.Infof("cloudflared has been updated to version %s", updateOutcome.Version)
 	}
@@ -200,7 +168,7 @@ func (a *AutoUpdater) Run(ctx context.Context) error {
 	ticker := time.NewTicker(a.configurable.freq)
 	for {
 		if a.configurable.enabled {
-			updateOutcome := loggedUpdate(a.logger, updateOptions{})
+			updateOutcome := loggedUpdate(a.logger)
 			if updateOutcome.Updated {
 				os.Args = append(os.Args, "--is-autoupdated=true")
 				if IsSysV() {

cmd/cloudflared/updater/workers_service.go

@@ -1,153 +0,0 @@
-package updater
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"runtime"
-	"strconv"
-	"strings"
-)
-
-// Options are the update options supported by the
-type Options struct {
-	// IsBeta is for beta updates to be installed if available
-	IsBeta bool
-
-	// IsForced is to forcibly download the latest version regardless of the current version
-	IsForced bool
-
-	// RequestedVersion is the specific version to upgrade or downgrade to
-	RequestedVersion string
-}
-
-// VersionResponse is the JSON response from the Workers API endpoint
-type VersionResponse struct {
-	URL          string `json:"url"`
-	Version      string `json:"version"`
-	Checksum     string `json:"checksum"`
-	IsCompressed bool   `json:"compressed"`
-	Error        string `json:"error"`
-}
-
-// WorkersService implements Service.
-// It contains everything needed to check in with the WorkersAPI and download and apply the updates
-type WorkersService struct {
-	currentVersion string
-	url            string
-	targetPath     string
-	opts           Options
-}
-
-// NewWorkersService creates a new updater Service object.
-func NewWorkersService(currentVersion, url, targetPath string, opts Options) Service {
-	return &WorkersService{
-		currentVersion: currentVersion,
-		url:            url,
-		targetPath:     targetPath,
-		opts:           opts,
-	}
-}
-
-// Check does a check in with the Workers API to get a new version update
-func (s *WorkersService) Check() (Version, error) {
-	client := &http.Client{
-		Timeout: clientTimeout,
-	}
-
-	req, err := http.NewRequest(http.MethodGet, s.url, nil)
-	q := req.URL.Query()
-	q.Add(OSKeyName, runtime.GOOS)
-	q.Add(ArchitectureKeyName, runtime.GOARCH)
-
-	if s.opts.IsBeta {
-		q.Add(BetaKeyName, "true")
-	}
-
-	if s.opts.RequestedVersion != "" {
-		q.Add(VersionKeyName, s.opts.RequestedVersion)
-	}
-
-	req.URL.RawQuery = q.Encode()
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var v VersionResponse
-	if err := json.NewDecoder(resp.Body).Decode(&v); err != nil {
-		return nil, err
-	}
-
-	if v.Error != "" {
-		return nil, errors.New(v.Error)
-	}
-
-	if !s.opts.IsForced && !IsNewerVersion(s.currentVersion, v.Version) {
-		return nil, nil
-	}
-
-	return NewWorkersVersion(v.URL, v.Version, v.Checksum, s.targetPath, v.IsCompressed), nil
-}
-
-// IsNewerVersion checks semantic versioning for the latest version
-// cloudflared tagging is more of a date than a semantic version,
-// but the same comparision logic still holds for major.minor.patch
-// e.g. 2020.8.2 is newer than 2020.8.1.
-func IsNewerVersion(current string, check string) bool {
-	if strings.Contains(strings.ToLower(current), "dev") {
-		return false // dev builds shouldn't update
-	}
-
-	cMajor, cMinor, cPatch, err := SemanticParts(current)
-	if err != nil {
-		return false
-	}
-
-	nMajor, nMinor, nPatch, err := SemanticParts(check)
-	if err != nil {
-		return false
-	}
-
-	if nMajor > cMajor {
-		return true
-	}
-
-	if nMajor == cMajor && nMinor > cMinor {
-		return true
-	}
-
-	if nMajor == cMajor && nMinor == cMinor && nPatch > cPatch {
-		return true
-	}
-	return false
-}
-
-// SemanticParts gets the major, minor, and patch version of a semantic version string
-// e.g. 3.1.2 would return 3, 1, 2, nil
-func SemanticParts(version string) (major int, minor int, patch int, err error) {
-	major = 0
-	minor = 0
-	patch = 0
-	parts := strings.Split(version, ".")
-	if len(parts) != 3 {
-		err = errors.New("invalid version")
-		return
-	}
-	major, err = strconv.Atoi(parts[0])
-	if err != nil {
-		return
-	}
-
-	minor, err = strconv.Atoi(parts[1])
-	if err != nil {
-		return
-	}
-
-	patch, err = strconv.Atoi(parts[2])
-	if err != nil {
-		return
-	}
-	return
-}

cmd/cloudflared/updater/workers_service_test.go

@@ -1,273 +0,0 @@
-package updater
-
-import (
-	"archive/tar"
-	"bytes"
-	"compress/gzip"
-	"crypto/sha256"
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"runtime"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func respondWithJSON(w http.ResponseWriter, v interface{}, status int) {
-	data, _ := json.Marshal(v)
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	w.Write(data)
-}
-
-func respondWithData(w http.ResponseWriter, b []byte, status int) {
-	w.Header().Set("Content-Type", "application/octet-stream")
-	w.WriteHeader(status)
-	w.Write(b)
-}
-
-func updateHandler(w http.ResponseWriter, r *http.Request) {
-	version := "2020.08.05"
-	host := fmt.Sprintf("http://%s", r.Host)
-	url := host + "/download"
-
-	query := r.URL.Query()
-
-	if query.Get(BetaKeyName) == "true" {
-		version = "2020.08.06"
-		url = host + "/beta"
-	}
-
-	requestedVersion := query.Get(VersionKeyName)
-	if requestedVersion != "" {
-		version = requestedVersion
-		url = fmt.Sprintf("%s?version=%s", url, requestedVersion)
-	}
-
-	if query.Get(ArchitectureKeyName) != runtime.GOARCH || query.Get(OSKeyName) != runtime.GOOS {
-		respondWithJSON(w, VersionResponse{Error: "unsupported os and architecture"}, http.StatusBadRequest)
-		return
-	}
-
-	h := sha256.New()
-	fmt.Fprint(h, version)
-	checksum := fmt.Sprintf("%x", h.Sum(nil))
-
-	v := VersionResponse{URL: url, Version: version, Checksum: checksum}
-	respondWithJSON(w, v, http.StatusOK)
-}
-
-func gzipUpdateHandler(w http.ResponseWriter, r *http.Request) {
-	log.Println("got a request!")
-	version := "2020.09.02"
-	h := sha256.New()
-	fmt.Fprint(h, version)
-	checksum := fmt.Sprintf("%x", h.Sum(nil))
-
-	url := fmt.Sprintf("http://%s/gzip-download.tgz", r.Host)
-	v := VersionResponse{URL: url, Version: version, Checksum: checksum}
-	respondWithJSON(w, v, http.StatusOK)
-}
-
-func compressedDownloadHandler(w http.ResponseWriter, r *http.Request) {
-	version := "2020.09.02"
-	buf := new(bytes.Buffer)
-
-	gw := gzip.NewWriter(buf)
-	tw := tar.NewWriter(gw)
-
-	header := &tar.Header{
-		Size: int64(len(version)),
-		Name: "download",
-	}
-	tw.WriteHeader(header)
-	tw.Write([]byte(version))
-
-	tw.Close()
-	gw.Close()
-
-	respondWithData(w, buf.Bytes(), http.StatusOK)
-}
-
-func downloadHandler(w http.ResponseWriter, r *http.Request) {
-	version := "2020.08.05"
-	requestedVersion := r.URL.Query().Get(VersionKeyName)
-	if requestedVersion != "" {
-		version = requestedVersion
-	}
-	respondWithData(w, []byte(version), http.StatusOK)
-}
-
-func betaHandler(w http.ResponseWriter, r *http.Request) {
-	respondWithData(w, []byte("2020.08.06"), http.StatusOK)
-}
-
-func failureHandler(w http.ResponseWriter, r *http.Request) {
-	respondWithJSON(w, VersionResponse{Error: "unsupported os and architecture"}, http.StatusBadRequest)
-}
-
-func createServer() *httptest.Server {
-	mux := http.NewServeMux()
-	mux.HandleFunc("/updater", updateHandler)
-	mux.HandleFunc("/download", downloadHandler)
-	mux.HandleFunc("/beta", betaHandler)
-	mux.HandleFunc("/fail", failureHandler)
-	mux.HandleFunc("/compressed", gzipUpdateHandler)
-	mux.HandleFunc("/gzip-download.tgz", compressedDownloadHandler)
-	return httptest.NewServer(mux)
-}
-
-func createTestFile(t *testing.T, path string) {
-	f, err := os.Create("tmpfile")
-	require.NoError(t, err)
-	fmt.Fprint(f, "2020.08.04")
-	f.Close()
-}
-
-func TestUpdateService(t *testing.T) {
-	ts := createServer()
-	defer ts.Close()
-
-	testFilePath := "tmpfile"
-	createTestFile(t, testFilePath)
-	defer os.Remove(testFilePath)
-	log.Println("server url: ", ts.URL)
-
-	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{})
-	v, err := s.Check()
-	require.NoError(t, err)
-	require.Equal(t, v.String(), "2020.08.05")
-
-	require.NoError(t, v.Apply())
-	dat, err := ioutil.ReadFile(testFilePath)
-	require.NoError(t, err)
-
-	require.Equal(t, string(dat), "2020.08.05")
-}
-
-func TestBetaUpdateService(t *testing.T) {
-	ts := createServer()
-	defer ts.Close()
-
-	testFilePath := "tmpfile"
-	createTestFile(t, testFilePath)
-	defer os.Remove(testFilePath)
-
-	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{IsBeta: true})
-	v, err := s.Check()
-	require.NoError(t, err)
-	require.Equal(t, v.String(), "2020.08.06")
-
-	require.NoError(t, v.Apply())
-	dat, err := ioutil.ReadFile(testFilePath)
-	require.NoError(t, err)
-
-	require.Equal(t, string(dat), "2020.08.06")
-}
-
-func TestFailUpdateService(t *testing.T) {
-	ts := createServer()
-	defer ts.Close()
-
-	testFilePath := "tmpfile"
-	createTestFile(t, testFilePath)
-	defer os.Remove(testFilePath)
-
-	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/fail", ts.URL), testFilePath, Options{})
-	v, err := s.Check()
-	require.Error(t, err)
-	require.Nil(t, v)
-}
-
-func TestNoUpdateService(t *testing.T) {
-	ts := createServer()
-	defer ts.Close()
-
-	testFilePath := "tmpfile"
-	createTestFile(t, testFilePath)
-	defer os.Remove(testFilePath)
-
-	s := NewWorkersService("2020.8.5", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{})
-	v, err := s.Check()
-	require.NoError(t, err)
-	require.Nil(t, v)
-}
-
-func TestForcedUpdateService(t *testing.T) {
-	ts := createServer()
-	defer ts.Close()
-
-	testFilePath := "tmpfile"
-	createTestFile(t, testFilePath)
-	defer os.Remove(testFilePath)
-
-	s := NewWorkersService("2020.8.5", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{IsForced: true})
-	v, err := s.Check()
-	require.NoError(t, err)
-	require.Equal(t, v.String(), "2020.08.05")
-
-	require.NoError(t, v.Apply())
-	dat, err := ioutil.ReadFile(testFilePath)
-	require.NoError(t, err)
-
-	require.Equal(t, string(dat), "2020.08.05")
-}
-
-func TestUpdateSpecificVersionService(t *testing.T) {
-	ts := createServer()
-	defer ts.Close()
-
-	testFilePath := "tmpfile"
-	createTestFile(t, testFilePath)
-	defer os.Remove(testFilePath)
-	reqVersion := "2020.9.1"
-
-	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{RequestedVersion: reqVersion})
-	v, err := s.Check()
-	require.NoError(t, err)
-	require.Equal(t, reqVersion, v.String())
-
-	require.NoError(t, v.Apply())
-	dat, err := ioutil.ReadFile(testFilePath)
-	require.NoError(t, err)
-
-	require.Equal(t, reqVersion, string(dat))
-}
-
-func TestCompressedUpdateService(t *testing.T) {
-	ts := createServer()
-	defer ts.Close()
-
-	testFilePath := "tmpfile"
-	createTestFile(t, testFilePath)
-	defer os.Remove(testFilePath)
-
-	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/compressed", ts.URL), testFilePath, Options{})
-	v, err := s.Check()
-	require.NoError(t, err)
-	require.Equal(t, "2020.09.02", v.String())
-
-	require.NoError(t, v.Apply())
-	dat, err := ioutil.ReadFile(testFilePath)
-	require.NoError(t, err)
-
-	require.Equal(t, "2020.09.02", string(dat))
-}
-
-func TestVersionParsing(t *testing.T) {
-	require.False(t, IsNewerVersion("2020.8.2", "2020.8.2"))
-	require.True(t, IsNewerVersion("2020.8.2", "2020.8.3"))
-	require.True(t, IsNewerVersion("2020.8.2", "2021.1.2"))
-	require.True(t, IsNewerVersion("2020.8.2", "2020.9.1"))
-	require.True(t, IsNewerVersion("2020.8.2", "2020.12.45"))
-	require.False(t, IsNewerVersion("2020.8.2", "2020.6.3"))
-	require.False(t, IsNewerVersion("DEV", "2020.8.5"))
-	require.False(t, IsNewerVersion("2020.8.2", "asdlkfjasdf"))
-	require.True(t, IsNewerVersion("3.0.1", "4.2.1"))
-}

cmd/cloudflared/updater/workers_update.go

@@ -1,230 +0,0 @@
-package updater
-
-import (
-	"archive/tar"
-	"compress/gzip"
-	"crypto/sha256"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"text/template"
-	"time"
-)
-
-const (
-	clientTimeout = time.Second * 60
-	// stop the service
-	// rename cloudflared.exe to cloudflared.exe.old
-	// rename cloudflared.exe.new to cloudflared.exe
-	// delete cloudflared.exe.old
-	// start the service
-	// delete the batch file
-	windowsUpdateCommandTemplate = `@echo off
-sc stop cloudflared >nul 2>&1
-rename "{{.TargetPath}}" {{.OldName}}
-rename "{{.NewPath}}" {{.BinaryName}}
-del "{{.OldPath}}"
-sc start cloudflared >nul 2>&1
-del {{.BatchName}}`
-	batchFileName = "cfd_update.bat"
-)
-
-// Prepare some data to insert into the template.
-type batchData struct {
-	TargetPath string
-	OldName    string
-	NewPath    string
-	OldPath    string
-	BinaryName string
-	BatchName  string
-}
-
-// WorkersVersion implements the Version interface.
-// It contains everything needed to preform a version upgrade
-type WorkersVersion struct {
-	downloadURL  string
-	checksum     string
-	version      string
-	targetPath   string
-	isCompressed bool
-}
-
-// NewWorkersVersion creates a new Version object. This is normally created by a WorkersService JSON checkin response
-// url is where to download the file
-// version is the version of this update
-// checksum is the expected checksum of the downloaded file
-// target path is where the file should be replace. Normally this the running cloudflared's path
-func NewWorkersVersion(url, version, checksum, targetPath string, isCompressed bool) Version {
-	return &WorkersVersion{downloadURL: url, version: version, checksum: checksum, targetPath: targetPath, isCompressed: isCompressed}
-}
-
-// Apply does the actual verification and update logic.
-// This includes signature and checksum validation,
-// replacing the binary, etc
-func (v *WorkersVersion) Apply() error {
-	newFilePath := fmt.Sprintf("%s.new", v.targetPath)
-	os.Remove(newFilePath) //remove any failed updates before download
-
-	// download the file
-	if err := download(v.downloadURL, newFilePath, v.isCompressed); err != nil {
-		return err
-	}
-
-	// check that the file is what is expected
-	if err := isValidChecksum(v.checksum, newFilePath); err != nil {
-		return err
-	}
-
-	oldFilePath := fmt.Sprintf("%s.old", v.targetPath)
-	// Windows requires more effort to self update, especially when it is running as a service:
-	// you have to stop the service (if running as one) in order to move/rename the binary
-	// but now the binary isn't running though, so an external process
-	// has to move the old binary out and the new one in then start the service
-	// the easiest way to do this is with a batch file (or with a DLL, but that gets ugly for a cross compiled binary like cloudflared)
-	// a batch file isn't ideal, but it is the simplest path forward for the constraints Windows creates
-	if runtime.GOOS == "windows" {
-		if err := writeBatchFile(v.targetPath, newFilePath, oldFilePath); err != nil {
-			return err
-		}
-		rootDir := filepath.Dir(v.targetPath)
-		batchPath := filepath.Join(rootDir, batchFileName)
-		return runWindowsBatch(batchPath)
-	}
-
-	// now move the current file out, move the new file in and delete the old file
-	if err := os.Rename(v.targetPath, oldFilePath); err != nil {
-		return err
-	}
-
-	if err := os.Rename(newFilePath, v.targetPath); err != nil {
-		//attempt rollback
-		os.Rename(oldFilePath, v.targetPath)
-		return err
-	}
-	os.Remove(oldFilePath)
-
-	return nil
-}
-
-// String returns the version number of this update/release (e.g. 2020.08.05)
-func (v *WorkersVersion) String() string {
-	return v.version
-}
-
-// download the file from the link in the json
-func download(url, filepath string, isCompressed bool) error {
-	client := &http.Client{
-		Timeout: clientTimeout,
-	}
-	resp, err := client.Get(url)
-
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	var r io.Reader
-	r = resp.Body
-
-	// compressed macos binary, need to decompress
-	if isCompressed || isCompressedFile(url) {
-		// first the gzip reader
-		gr, err := gzip.NewReader(resp.Body)
-		if err != nil {
-			return err
-		}
-		defer gr.Close()
-
-		// now the tar
-		tr := tar.NewReader(gr)
-
-		// advance the reader pass the header, which will be the single binary file
-		tr.Next()
-
-		r = tr
-	}
-
-	out, err := os.OpenFile(filepath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
-	if err != nil {
-		return err
-	}
-	defer out.Close()
-
-	_, err = io.Copy(out, r)
-	return err
-}
-
-// isCompressedFile is a really simple file extension check to see if this is a macos tar and gzipped
-func isCompressedFile(urlstring string) bool {
-	if strings.HasSuffix(urlstring, ".tgz") {
-		return true
-	}
-
-	u, err := url.Parse(urlstring)
-	if err != nil {
-		return false
-	}
-	return strings.HasSuffix(u.Path, ".tgz")
-}
-
-// checks if the checksum in the json response matches the checksum of the file download
-func isValidChecksum(checksum, filePath string) error {
-	f, err := os.Open(filePath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	h := sha256.New()
-	if _, err := io.Copy(h, f); err != nil {
-		return err
-	}
-
-	hash := fmt.Sprintf("%x", h.Sum(nil))
-
-	if checksum != hash {
-		return errors.New("checksum validation failed")
-	}
-	return nil
-}
-
-// writeBatchFile writes a batch file out to disk
-// see the dicussion on why it has to be done this way
-func writeBatchFile(targetPath string, newPath string, oldPath string) error {
-	os.Remove(batchFileName) //remove any failed updates before download
-	f, err := os.Create(batchFileName)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	cfdName := filepath.Base(targetPath)
-	oldName := filepath.Base(oldPath)
-
-	data := batchData{
-		TargetPath: targetPath,
-		OldName:    oldName,
-		NewPath:    newPath,
-		OldPath:    oldPath,
-		BinaryName: cfdName,
-		BatchName:  batchFileName,
-	}
-
-	t, err := template.New("batch").Parse(windowsUpdateCommandTemplate)
-	if err != nil {
-		return err
-	}
-	return t.Execute(f, data)
-}
-
-// run each OS command for windows
-func runWindowsBatch(batchFile string) error {
-	cmd := exec.Command("cmd", "/c", batchFile)
-	return cmd.Start()
-}

connection/rpc.go

@@ -2,40 +2,48 @@ package connection
 
 import (
 	"context"
-	"io"
+	"fmt"
+	"time"
 
 	rpc "zombiezen.com/go/capnproto2/rpc"
 
+	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 
-// NewTunnelRPCClient creates and returns a new RPC client, which will communicate
+// NewRPCClient creates and returns a new RPC client, which will communicate
 // using a stream on the given muxer
-func NewTunnelRPCClient(
+func NewRPCClient(
 	ctx context.Context,
-	stream io.ReadWriteCloser,
+	muxer *h2mux.Muxer,
 	logger logger.Service,
+	openStreamTimeout time.Duration,
 ) (client tunnelpogs.TunnelServer_PogsClient, err error) {
+	openStreamCtx, openStreamCancel := context.WithTimeout(ctx, openStreamTimeout)
+	defer openStreamCancel()
+	stream, err := muxer.OpenRPCStream(openStreamCtx)
+	if err != nil {
+		return
+	}
+
+	if !isRPCStreamResponse(stream.Headers) {
+		stream.Close()
+		err = fmt.Errorf("rpc: bad response headers: %v", stream.Headers)
+		return
+	}
+
 	conn := rpc.NewConn(
 		tunnelrpc.NewTransportLogger(logger, rpc.StreamTransport(stream)),
 		tunnelrpc.ConnLog(logger),
 	)
-	registrationClient := tunnelpogs.RegistrationServer_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn}
-	client = tunnelpogs.TunnelServer_PogsClient{RegistrationServer_PogsClient: registrationClient, Client: conn.Bootstrap(ctx), Conn: conn}
+	client = tunnelpogs.TunnelServer_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn}
 	return client, nil
 }
 
-func NewRegistrationRPCClient(
-	ctx context.Context,
-	stream io.ReadWriteCloser,
-	logger logger.Service,
-) (client tunnelpogs.RegistrationServer_PogsClient, err error) {
-	conn := rpc.NewConn(
-		tunnelrpc.NewTransportLogger(logger, rpc.StreamTransport(stream)),
-		tunnelrpc.ConnLog(logger),
-	)
-	client = tunnelpogs.RegistrationServer_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn}
-	return client, nil
+func isRPCStreamResponse(headers []h2mux.Header) bool {
+	return len(headers) == 1 &&
+		headers[0].Name == ":status" &&
+		headers[0].Value == "200"
 }

dev.Dockerfile

@@ -1,9 +1,4 @@
-FROM golang:1.15.3 as builder
-ENV GO111MODULE=on \
-    CGO_ENABLED=0
+FROM golang:1.12 as builder
 WORKDIR /go/src/github.com/cloudflare/cloudflared/
 RUN apt-get update
 COPY . .
-# compile cloudflared
-RUN make cloudflared
-RUN cp /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/

edgediscovery/allregions/discovery.go

@@ -121,15 +121,15 @@ func resolveSRVToTCP(srv *net.SRV) ([]*net.TCPAddr, error) {
 }
 
 // ResolveAddrs resolves TCP address given a list of addresses. Address can be a hostname, however, it will return at most one
-// of the hostname's IP addresses.
-func ResolveAddrs(addrs []string, logger logger.Service) (resolved []*net.TCPAddr) {
+// of the hostname's IP addresses
+func ResolveAddrs(addrs []string) ([]*net.TCPAddr, error) {
+	var tcpAddrs []*net.TCPAddr
 	for _, addr := range addrs {
 		tcpAddr, err := net.ResolveTCPAddr("tcp", addr)
 		if err != nil {
-			logger.Errorf("Failed to resolve %s, err: %v", addr, err)
-		} else {
-			resolved = append(resolved, tcpAddr)
+			return nil, err
 		}
+		tcpAddrs = append(tcpAddrs, tcpAddr)
 	}
-	return
+	return tcpAddrs, nil
 }

edgediscovery/allregions/regions.go

@@ -35,12 +35,12 @@ func ResolveEdge(logger logger.Service) (*Regions, error) {
 
 // StaticEdge creates a list of edge addresses from the list of hostnames.
 // Mainly used for testing connectivity.
-func StaticEdge(hostnames []string, logger logger.Service) (*Regions, error) {
-	resolved := ResolveAddrs(hostnames, logger)
-	if len(resolved) == 0 {
-		return nil, fmt.Errorf("failed to resolve any edge address")
+func StaticEdge(hostnames []string) (*Regions, error) {
+	addrs, err := ResolveAddrs(hostnames)
+	if err != nil {
+		return nil, err
 	}
-	return NewNoResolve(resolved), nil
+	return NewNoResolve(addrs), nil
 }
 
 // NewNoResolve doesn't resolve the edge. Instead it just uses the given addresses.

edgediscovery/edgediscovery.go

@@ -41,7 +41,7 @@ func ResolveEdge(l logger.Service) (*Edge, error) {
 
 // StaticEdge creates a list of edge addresses from the list of hostnames. Mainly used for testing connectivity.
 func StaticEdge(l logger.Service, hostnames []string) (*Edge, error) {
-	regions, err := allregions.StaticEdge(hostnames, l)
+	regions, err := allregions.StaticEdge(hostnames)
 	if err != nil {
 		return new(Edge), err
 	}

github_message.py

@@ -97,11 +97,10 @@ def main():
 
         msg = release.body
 
-        for filepath in glob.glob("artifacts/*"):
-            pkg_hash = get_sha256(filepath)
+        for filename in glob.glob(".artifacts/*.*"):
+            pkg_hash = get_sha256(filename)
             # add the sha256 of the new artifact to the release message body
-            name = os.path.basename(filepath)
-            msg = update_or_add_message(msg, name, pkg_hash)
+            msg = update_or_add_message(msg, filename, pkg_hash)
 
         if args.dry_run:
             logging.info("Skipping asset upload because of dry-run")

github_release.py

@@ -9,7 +9,6 @@ import os
 import shutil
 import hashlib
 import requests
-import tarfile
 
 from github import Github, GithubException, UnknownObjectException
 
@@ -176,21 +175,8 @@ def main():
 
         release.upload_asset(args.path, name=args.name)
 
-        # check and extract if the file is a tar and gzipped file (as is the case with the macos builds)
-        binary_path = args.path
-        if binary_path.endswith("tgz"):
-            try:
-                shutil.rmtree('cfd') 
-            except OSError as e:
-                pass
-            zipfile = tarfile.open(binary_path, "r:gz")
-            zipfile.extractall('cfd') # specify which folder to extract to
-            zipfile.close()
-
-            binary_path = os.path.join(os.getcwd(), 'cfd', 'cloudflared') 
-
         # send the sha256 (the checksum) to workers kv
-        pkg_hash = get_sha256(binary_path)
+        pkg_hash = get_sha256(args.path)
         send_hash(pkg_hash, args.name, args.release_version, args.kv_account_id, args.namespace_id, args.kv_api_token)
 
         # create the artifacts directory if it doesn't exist 
@@ -200,10 +186,9 @@ def main():
 
         # copy the binary to the path
         copy_path = os.path.join(artifact_path, args.name)
-        try:
-            shutil.copy(args.path, copy_path)
-        except shutil.SameFileError:
-            pass # the macOS release copy fails with being the same file (already in the artifacts directory). Catching to ignore.
+        shutil.copy(args.path, copy_path)
+
+
 
     except Exception as e:
         logging.exception(e)

h2mux/error.go

@@ -19,7 +19,6 @@ var (
 	ErrUnexpectedFrameType = MuxerProtocolError{"2001 unexpected frame type", http2.ErrCodeProtocol}
 	ErrUnknownStream       = MuxerProtocolError{"2002 unknown stream", http2.ErrCodeProtocol}
 	ErrInvalidStream       = MuxerProtocolError{"2003 invalid stream", http2.ErrCodeProtocol}
-	ErrNotRPCStream        = MuxerProtocolError{"2004 not RPC stream", http2.ErrCodeProtocol}
 
 	ErrStreamHeadersSent               = MuxerApplicationError{"3000 headers already sent"}
 	ErrStreamRequestConnectionClosed   = MuxerApplicationError{"3001 connection closed while opening stream"}

h2mux/h2mux.go

@@ -22,7 +22,7 @@ const (
 	defaultTimeout           time.Duration = 5 * time.Second
 	defaultRetries           uint64        = 5
 	defaultWriteBufferMaxLen int           = 1024 * 1024 // 1mb
-	writeBufferInitialSize   int           = 16 * 1024   // 16KB
+	writeBufferInitialSize   int           = 16 * 1024 // 16KB
 
 	SettingMuxerMagic http2.SettingID = 0x42db
 	MuxerMagicOrigin  uint32          = 0xa2e43c8b
@@ -441,17 +441,11 @@ func (m *Muxer) OpenStream(ctx context.Context, headers []Header, body io.Reader
 func (m *Muxer) OpenRPCStream(ctx context.Context) (*MuxedStream, error) {
 	stream := m.NewStream(RPCHeaders())
 	if err := m.MakeMuxedStreamRequest(ctx, NewMuxedStreamRequest(stream, nil)); err != nil {
-		stream.Close()
 		return nil, err
 	}
 	if err := m.AwaitResponseHeaders(ctx, stream); err != nil {
-		stream.Close()
 		return nil, err
 	}
-	if !IsRPCStreamResponse(stream) {
-		stream.Close()
-		return nil, ErrNotRPCStream
-	}
 	return stream, nil
 }
 
@@ -505,10 +499,3 @@ func (m *Muxer) abort() {
 func (m *Muxer) TimerRetries() uint64 {
 	return m.muxWriter.idleTimer.RetryCount()
 }
-
-func IsRPCStreamResponse(stream *MuxedStream) bool {
-	headers := stream.Headers
-	return len(headers) == 1 &&
-		headers[0].Name == ":status" &&
-		headers[0].Value == "200"
-}

hello/hello.go

@@ -150,15 +150,8 @@ func uptimeHandler(startTime time.Time) http.HandlerFunc {
 // This handler will echo message
 func websocketHandler(logger logger.Service, upgrader websocket.Upgrader) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// This addresses the issue of r.Host includes port but origin header doesn't
-		host, _, err := net.SplitHostPort(r.Host)
-		if err == nil {
-			r.Host = host
-		}
-
 		conn, err := upgrader.Upgrade(w, r, nil)
 		if err != nil {
-			logger.Errorf("failed to upgrade to websocket connection, error: %s", err)
 			return
 		}
 		defer conn.Close()

ingress/ingress.go

@@ -1,231 +0,0 @@
-package ingress
-
-import (
-	"fmt"
-	"net"
-	"net/url"
-	"regexp"
-	"strconv"
-	"strings"
-	"sync"
-
-	"github.com/pkg/errors"
-	"github.com/urfave/cli/v2"
-
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
-	"github.com/cloudflare/cloudflared/logger"
-)
-
-var (
-	ErrNoIngressRules             = errors.New("No ingress rules were specified in the config file")
-	errLastRuleNotCatchAll        = errors.New("The last ingress rule must match all hostnames (i.e. it must be missing, or must be \"*\")")
-	errBadWildcard                = errors.New("Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"")
-	errHostnameContainsPort       = errors.New("Hostname cannot contain port")
-	ErrURLIncompatibleWithIngress = errors.New("You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules")
-)
-
-// FindMatchingRule returns the index of the Ingress Rule which matches the given
-// hostname and path. This function assumes the last rule matches everything,
-// which is the case if the rules were instantiated via the ingress#Validate method
-func (ing Ingress) FindMatchingRule(hostname, path string) (*Rule, int) {
-	// The hostname might contain port. We only want to compare the host part with the rule
-	host, _, err := net.SplitHostPort(hostname)
-	if err == nil {
-		hostname = host
-	}
-	for i, rule := range ing.Rules {
-		if rule.Matches(hostname, path) {
-			return &rule, i
-		}
-	}
-	i := len(ing.Rules) - 1
-	return &ing.Rules[i], i
-}
-
-func matchHost(ruleHost, reqHost string) bool {
-	if ruleHost == reqHost {
-		return true
-	}
-
-	// Validate hostnames that use wildcards at the start
-	if strings.HasPrefix(ruleHost, "*.") {
-		toMatch := strings.TrimPrefix(ruleHost, "*.")
-		return strings.HasSuffix(reqHost, toMatch)
-	}
-	return false
-}
-
-// Ingress maps eyeball requests to origins.
-type Ingress struct {
-	Rules    []Rule
-	defaults OriginRequestConfig
-}
-
-// NewSingleOrigin constructs an Ingress set with only one rule, constructed from
-// legacy CLI parameters like --url or --no-chunked-encoding.
-func NewSingleOrigin(c *cli.Context, compatibilityMode bool, logger logger.Service) (Ingress, error) {
-
-	service, err := parseSingleOriginService(c, compatibilityMode)
-	if err != nil {
-		return Ingress{}, err
-	}
-
-	// Construct an Ingress with the single rule.
-	ing := Ingress{
-		Rules: []Rule{
-			{
-				Service: service,
-			},
-		},
-		defaults: originRequestFromSingeRule(c),
-	}
-	return ing, err
-}
-
-// Get a single origin service from the CLI/config.
-func parseSingleOriginService(c *cli.Context, compatibilityMode bool) (OriginService, error) {
-	if c.IsSet("hello-world") {
-		return new(helloWorld), nil
-	}
-	if c.IsSet("url") {
-		originURLStr, err := config.ValidateUrl(c, compatibilityMode)
-		if err != nil {
-			return nil, errors.Wrap(err, "Error validating origin URL")
-		}
-		originURL, err := url.Parse(originURLStr)
-		if err != nil {
-			return nil, errors.Wrap(err, "couldn't parse origin URL")
-		}
-		return &localService{URL: originURL, RootURL: originURL}, nil
-	}
-	if c.IsSet("unix-socket") {
-		path, err := config.ValidateUnixSocket(c)
-		if err != nil {
-			return nil, errors.Wrap(err, "Error validating --unix-socket")
-		}
-		return &unixSocketPath{path: path}, nil
-	}
-	return nil, errors.New("You must either set ingress rules in your config file, or use --url or use --unix-socket")
-}
-
-// IsEmpty checks if there are any ingress rules.
-func (ing Ingress) IsEmpty() bool {
-	return len(ing.Rules) == 0
-}
-
-// StartOrigins will start any origin services managed by cloudflared, e.g. proxy servers or Hello World.
-func (ing Ingress) StartOrigins(wg *sync.WaitGroup, log logger.Service, shutdownC <-chan struct{}, errC chan error) {
-	for _, rule := range ing.Rules {
-		if err := rule.Service.start(wg, log, shutdownC, errC, rule.Config); err != nil {
-			log.Errorf("Error starting local service %s: %s", rule.Service, err)
-		}
-	}
-}
-
-// CatchAll returns the catch-all rule (i.e. the last rule)
-func (ing Ingress) CatchAll() *Rule {
-	return &ing.Rules[len(ing.Rules)-1]
-}
-
-func validate(ingress []config.UnvalidatedIngressRule, defaults OriginRequestConfig) (Ingress, error) {
-	rules := make([]Rule, len(ingress))
-	for i, r := range ingress {
-		var service OriginService
-
-		if prefix := "unix:"; strings.HasPrefix(r.Service, prefix) {
-			// No validation necessary for unix socket filepath services
-			path := strings.TrimPrefix(r.Service, prefix)
-			service = &unixSocketPath{path: path}
-		} else if prefix := "http_status:"; strings.HasPrefix(r.Service, prefix) {
-			status, err := strconv.Atoi(strings.TrimPrefix(r.Service, prefix))
-			if err != nil {
-				return Ingress{}, errors.Wrap(err, "invalid HTTP status")
-			}
-			srv := newStatusCode(status)
-			service = &srv
-		} else if r.Service == "hello_world" || r.Service == "hello-world" || r.Service == "helloworld" {
-			service = new(helloWorld)
-		} else {
-			// Validate URL services
-			u, err := url.Parse(r.Service)
-			if err != nil {
-				return Ingress{}, err
-			}
-
-			if u.Scheme == "" || u.Hostname() == "" {
-				return Ingress{}, fmt.Errorf("The service %s must have a scheme and a hostname", r.Service)
-			}
-
-			if u.Path != "" {
-				return Ingress{}, fmt.Errorf("%s is an invalid address, ingress rules don't support proxying to a different path on the origin service. The path will be the same as the eyeball request's path", r.Service)
-			}
-			serviceURL := localService{URL: u}
-			service = &serviceURL
-		}
-
-		if err := validateHostname(r, i, len(ingress)); err != nil {
-			return Ingress{}, err
-		}
-
-		var pathRegex *regexp.Regexp
-		if r.Path != "" {
-			var err error
-			pathRegex, err = regexp.Compile(r.Path)
-			if err != nil {
-				return Ingress{}, errors.Wrapf(err, "Rule #%d has an invalid regex", i+1)
-			}
-		}
-
-		rules[i] = Rule{
-			Hostname: r.Hostname,
-			Service:  service,
-			Path:     pathRegex,
-			Config:   setConfig(defaults, r.OriginRequest),
-		}
-	}
-	return Ingress{Rules: rules, defaults: defaults}, nil
-}
-
-func validateHostname(r config.UnvalidatedIngressRule, ruleIndex, totalRules int) error {
-	// Ensure that the hostname doesn't contain port
-	_, _, err := net.SplitHostPort(r.Hostname)
-	if err == nil {
-		return errHostnameContainsPort
-	}
-	// Ensure that there are no wildcards anywhere except the first character
-	// of the hostname.
-	if strings.LastIndex(r.Hostname, "*") > 0 {
-		return errBadWildcard
-	}
-
-	// The last rule should catch all hostnames.
-	isCatchAllRule := (r.Hostname == "" || r.Hostname == "*") && r.Path == ""
-	isLastRule := ruleIndex == totalRules-1
-	if isLastRule && !isCatchAllRule {
-		return errLastRuleNotCatchAll
-	}
-	// ONLY the last rule should catch all hostnames.
-	if !isLastRule && isCatchAllRule {
-		return errRuleShouldNotBeCatchAll{index: ruleIndex, hostname: r.Hostname}
-	}
-	return nil
-}
-
-type errRuleShouldNotBeCatchAll struct {
-	index    int
-	hostname string
-}
-
-func (e errRuleShouldNotBeCatchAll) Error() string {
-	return fmt.Sprintf("Rule #%d is matching the hostname '%s', but "+
-		"this will match every hostname, meaning the rules which follow it "+
-		"will never be triggered.", e.index+1, e.hostname)
-}
-
-// ParseIngress parses ingress rules, but does not send HTTP requests to the origins.
-func ParseIngress(conf *config.Configuration) (Ingress, error) {
-	if len(conf.Ingress) == 0 {
-		return Ingress{}, ErrNoIngressRules
-	}
-	return validate(conf.Ingress, originRequestFromYAML(conf.OriginRequest))
-}

ingress/ingress_test.go

@@ -1,332 +0,0 @@
-package ingress
-
-import (
-	"fmt"
-	"net/url"
-	"regexp"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v2"
-
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
-)
-
-func TestParseUnixSocket(t *testing.T) {
-	rawYAML := `
-ingress:
-- service: unix:/tmp/echo.sock
-`
-	ing, err := ParseIngress(MustReadIngress(rawYAML))
-	require.NoError(t, err)
-	_, ok := ing.Rules[0].Service.(*unixSocketPath)
-	require.True(t, ok)
-}
-
-func Test_parseIngress(t *testing.T) {
-	localhost8000 := MustParseURL(t, "https://localhost:8000")
-	localhost8001 := MustParseURL(t, "https://localhost:8001")
-	fourOhFour := newStatusCode(404)
-	defaultConfig := setConfig(originRequestFromYAML(config.OriginRequestConfig{}), config.OriginRequestConfig{})
-	require.Equal(t, defaultKeepAliveConnections, defaultConfig.KeepAliveConnections)
-	type args struct {
-		rawYAML string
-	}
-	tests := []struct {
-		name    string
-		args    args
-		want    []Rule
-		wantErr bool
-	}{
-		{
-			name:    "Empty file",
-			args:    args{rawYAML: ""},
-			wantErr: true,
-		},
-		{
-			name: "Multiple rules",
-			args: args{rawYAML: `
-ingress:
- - hostname: tunnel1.example.com
-   service: https://localhost:8000
- - hostname: "*"
-   service: https://localhost:8001
-`},
-			want: []Rule{
-				{
-					Hostname: "tunnel1.example.com",
-					Service:  &localService{URL: localhost8000},
-					Config:   defaultConfig,
-				},
-				{
-					Hostname: "*",
-					Service:  &localService{URL: localhost8001},
-					Config:   defaultConfig,
-				},
-			},
-		},
-		{
-			name: "Extra keys",
-			args: args{rawYAML: `
-ingress:
- - hostname: "*"
-   service: https://localhost:8000
-extraKey: extraValue
-`},
-			want: []Rule{
-				{
-					Hostname: "*",
-					Service:  &localService{URL: localhost8000},
-					Config:   defaultConfig,
-				},
-			},
-		},
-		{
-			name: "Hostname can be omitted",
-			args: args{rawYAML: `
-ingress:
- - service: https://localhost:8000
-`},
-			want: []Rule{
-				{
-					Service: &localService{URL: localhost8000},
-					Config:  defaultConfig,
-				},
-			},
-		},
-		{
-			name: "Invalid service",
-			args: args{rawYAML: `
-ingress:
- - hostname: "*"
-   service: https://local host:8000
-`},
-			wantErr: true,
-		},
-		{
-			name: "Last rule isn't catchall",
-			args: args{rawYAML: `
-ingress:
- - hostname: example.com
-   service: https://localhost:8000
-`},
-			wantErr: true,
-		},
-		{
-			name: "First rule is catchall",
-			args: args{rawYAML: `
-ingress:
- - service: https://localhost:8000
- - hostname: example.com
-   service: https://localhost:8000
-`},
-			wantErr: true,
-		},
-		{
-			name: "Catch-all rule can't have a path",
-			args: args{rawYAML: `
-ingress:
- - service: https://localhost:8001
-   path: /subpath1/(.*)/subpath2
-`},
-			wantErr: true,
-		},
-		{
-			name: "Invalid regex",
-			args: args{rawYAML: `
-ingress:
- - hostname: example.com
-   service: https://localhost:8000
-   path: "*/subpath2"
- - service: https://localhost:8001
-`},
-			wantErr: true,
-		},
-		{
-			name: "Service must have a scheme",
-			args: args{rawYAML: `
-ingress:
- - service: localhost:8000
-`},
-			wantErr: true,
-		},
-		{
-			name: "Wildcard not at start",
-			args: args{rawYAML: `
-ingress:
- - hostname: "test.*.example.com"
-   service: https://localhost:8000
-`},
-			wantErr: true,
-		},
-		{
-			name: "Service can't have a path",
-			args: args{rawYAML: `
-ingress:
- - service: https://localhost:8000/static/
-`},
-			wantErr: true,
-		},
-		{
-			name: "Invalid HTTP status",
-			args: args{rawYAML: `
-ingress:
- - service: http_status:asdf
-`},
-			wantErr: true,
-		},
-		{
-			name: "Valid HTTP status",
-			args: args{rawYAML: `
-ingress:
- - service: http_status:404
-`},
-			want: []Rule{
-				{
-					Hostname: "",
-					Service:  &fourOhFour,
-					Config:   defaultConfig,
-				},
-			},
-		},
-		{
-			name: "Valid hello world service",
-			args: args{rawYAML: `
-ingress:
- - service: hello_world
-`},
-			want: []Rule{
-				{
-					Hostname: "",
-					Service:  new(helloWorld),
-					Config:   defaultConfig,
-				},
-			},
-		},
-		{
-			name: "Hostname contains port",
-			args: args{rawYAML: `
-ingress:
- - hostname: "test.example.com:443"
-   service: https://localhost:8000
- - hostname: "*"
-   service: https://localhost:8001
-`},
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := ParseIngress(MustReadIngress(tt.args.rawYAML))
-			if (err != nil) != tt.wantErr {
-				t.Errorf("ParseIngress() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			require.Equal(t, tt.want, got.Rules)
-		})
-	}
-}
-
-func TestFindMatchingRule(t *testing.T) {
-	ingress := Ingress{
-		Rules: []Rule{
-			{
-				Hostname: "tunnel-a.example.com",
-				Path:     nil,
-			},
-			{
-				Hostname: "tunnel-b.example.com",
-				Path:     mustParsePath(t, "/health"),
-			},
-			{
-				Hostname: "*",
-			},
-		},
-	}
-
-	tests := []struct {
-		host          string
-		path          string
-		wantRuleIndex int
-	}{
-		{
-			host:          "tunnel-a.example.com",
-			path:          "/",
-			wantRuleIndex: 0,
-		},
-		{
-			host:          "tunnel-a.example.com",
-			path:          "/pages/about",
-			wantRuleIndex: 0,
-		},
-		{
-			host:          "tunnel-a.example.com:443",
-			path:          "/pages/about",
-			wantRuleIndex: 0,
-		},
-		{
-			host:          "tunnel-b.example.com",
-			path:          "/health",
-			wantRuleIndex: 1,
-		},
-		{
-			host:          "tunnel-b.example.com",
-			path:          "/index.html",
-			wantRuleIndex: 2,
-		},
-		{
-			host:          "tunnel-c.example.com",
-			path:          "/",
-			wantRuleIndex: 2,
-		},
-	}
-
-	for i, test := range tests {
-		_, ruleIndex := ingress.FindMatchingRule(test.host, test.path)
-		assert.Equal(t, test.wantRuleIndex, ruleIndex, fmt.Sprintf("Expect host=%s, path=%s to match rule %d, got %d", test.host, test.path, test.wantRuleIndex, i))
-	}
-}
-
-func mustParsePath(t *testing.T, path string) *regexp.Regexp {
-	regexp, err := regexp.Compile(path)
-	assert.NoError(t, err)
-	return regexp
-}
-
-func MustParseURL(t *testing.T, rawURL string) *url.URL {
-	u, err := url.Parse(rawURL)
-	require.NoError(t, err)
-	return u
-}
-
-func BenchmarkFindMatch(b *testing.B) {
-	rulesYAML := `
-ingress:
- - hostname: tunnel1.example.com
-   service: https://localhost:8000
- - hostname: tunnel2.example.com
-   service: https://localhost:8001
- - hostname: "*"
-   service: https://localhost:8002
-`
-
-	ing, err := ParseIngress(MustReadIngress(rulesYAML))
-	if err != nil {
-		b.Error(err)
-	}
-	for n := 0; n < b.N; n++ {
-		ing.FindMatchingRule("tunnel1.example.com", "")
-		ing.FindMatchingRule("tunnel2.example.com", "")
-		ing.FindMatchingRule("tunnel3.example.com", "")
-	}
-}
-
-func MustReadIngress(s string) *config.Configuration {
-	var conf config.Configuration
-	err := yaml.Unmarshal([]byte(s), &conf)
-	if err != nil {
-		panic(err)
-	}
-	return &conf
-}

ingress/origin_request_config.go

@@ -1,331 +0,0 @@
-package ingress
-
-import (
-	"time"
-
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
-	"github.com/cloudflare/cloudflared/tlsconfig"
-	"github.com/urfave/cli/v2"
-)
-
-const (
-	defaultConnectTimeout       = 30 * time.Second
-	defaultTLSTimeout           = 10 * time.Second
-	defaultTCPKeepAlive         = 30 * time.Second
-	defaultKeepAliveConnections = 100
-	defaultKeepAliveTimeout     = 90 * time.Second
-	defaultProxyAddress         = "127.0.0.1"
-
-	SSHServerFlag                 = "ssh-server"
-	Socks5Flag                    = "socks5"
-	ProxyConnectTimeoutFlag       = "proxy-connect-timeout"
-	ProxyTLSTimeoutFlag           = "proxy-tls-timeout"
-	ProxyTCPKeepAlive             = "proxy-tcp-keepalive"
-	ProxyNoHappyEyeballsFlag      = "proxy-no-happy-eyeballs"
-	ProxyKeepAliveConnectionsFlag = "proxy-keepalive-connections"
-	ProxyKeepAliveTimeoutFlag     = "proxy-keepalive-timeout"
-	HTTPHostHeaderFlag            = "http-host-header"
-	OriginServerNameFlag          = "origin-server-name"
-	NoTLSVerifyFlag               = "no-tls-verify"
-	NoChunkedEncodingFlag         = "no-chunked-encoding"
-	ProxyAddressFlag              = "proxy-address"
-	ProxyPortFlag                 = "proxy-port"
-)
-
-const (
-	socksProxy = "socks"
-)
-
-func originRequestFromSingeRule(c *cli.Context) OriginRequestConfig {
-	var connectTimeout time.Duration = defaultConnectTimeout
-	var tlsTimeout time.Duration = defaultTLSTimeout
-	var tcpKeepAlive time.Duration = defaultTCPKeepAlive
-	var noHappyEyeballs bool
-	var keepAliveConnections int = defaultKeepAliveConnections
-	var keepAliveTimeout time.Duration = defaultKeepAliveTimeout
-	var httpHostHeader string
-	var originServerName string
-	var caPool string
-	var noTLSVerify bool
-	var disableChunkedEncoding bool
-	var bastionMode bool
-	var proxyAddress string
-	var proxyPort uint
-	var proxyType string
-	if flag := ProxyConnectTimeoutFlag; c.IsSet(flag) {
-		connectTimeout = c.Duration(flag)
-	}
-	if flag := ProxyTLSTimeoutFlag; c.IsSet(flag) {
-		tlsTimeout = c.Duration(flag)
-	}
-	if flag := ProxyTCPKeepAlive; c.IsSet(flag) {
-		tcpKeepAlive = c.Duration(flag)
-	}
-	if flag := ProxyNoHappyEyeballsFlag; c.IsSet(flag) {
-		noHappyEyeballs = c.Bool(flag)
-	}
-	if flag := ProxyKeepAliveConnectionsFlag; c.IsSet(flag) {
-		keepAliveConnections = c.Int(flag)
-	}
-	if flag := ProxyKeepAliveTimeoutFlag; c.IsSet(flag) {
-		keepAliveTimeout = c.Duration(flag)
-	}
-	if flag := HTTPHostHeaderFlag; c.IsSet(flag) {
-		httpHostHeader = c.String(flag)
-	}
-	if flag := OriginServerNameFlag; c.IsSet(flag) {
-		originServerName = c.String(flag)
-	}
-	if flag := tlsconfig.OriginCAPoolFlag; c.IsSet(flag) {
-		caPool = c.String(flag)
-	}
-	if flag := NoTLSVerifyFlag; c.IsSet(flag) {
-		noTLSVerify = c.Bool(flag)
-	}
-	if flag := NoChunkedEncodingFlag; c.IsSet(flag) {
-		disableChunkedEncoding = c.Bool(flag)
-	}
-	if flag := config.BastionFlag; c.IsSet(flag) {
-		bastionMode = c.Bool(flag)
-	}
-	if flag := ProxyAddressFlag; c.IsSet(flag) {
-		proxyAddress = c.String(flag)
-	}
-	if flag := ProxyPortFlag; c.IsSet(flag) {
-		proxyPort = c.Uint(flag)
-	}
-	if c.IsSet(Socks5Flag) {
-		proxyType = socksProxy
-	}
-	return OriginRequestConfig{
-		ConnectTimeout:         connectTimeout,
-		TLSTimeout:             tlsTimeout,
-		TCPKeepAlive:           tcpKeepAlive,
-		NoHappyEyeballs:        noHappyEyeballs,
-		KeepAliveConnections:   keepAliveConnections,
-		KeepAliveTimeout:       keepAliveTimeout,
-		HTTPHostHeader:         httpHostHeader,
-		OriginServerName:       originServerName,
-		CAPool:                 caPool,
-		NoTLSVerify:            noTLSVerify,
-		DisableChunkedEncoding: disableChunkedEncoding,
-		BastionMode:            bastionMode,
-		ProxyAddress:           proxyAddress,
-		ProxyPort:              proxyPort,
-		ProxyType:              proxyType,
-	}
-}
-
-func originRequestFromYAML(y config.OriginRequestConfig) OriginRequestConfig {
-	out := OriginRequestConfig{
-		ConnectTimeout:       defaultConnectTimeout,
-		TLSTimeout:           defaultTLSTimeout,
-		TCPKeepAlive:         defaultTCPKeepAlive,
-		KeepAliveConnections: defaultKeepAliveConnections,
-		KeepAliveTimeout:     defaultKeepAliveTimeout,
-		ProxyAddress:         defaultProxyAddress,
-	}
-	if y.ConnectTimeout != nil {
-		out.ConnectTimeout = *y.ConnectTimeout
-	}
-	if y.TLSTimeout != nil {
-		out.TLSTimeout = *y.TLSTimeout
-	}
-	if y.TCPKeepAlive != nil {
-		out.TCPKeepAlive = *y.TCPKeepAlive
-	}
-	if y.NoHappyEyeballs != nil {
-		out.NoHappyEyeballs = *y.NoHappyEyeballs
-	}
-	if y.KeepAliveConnections != nil {
-		out.KeepAliveConnections = *y.KeepAliveConnections
-	}
-	if y.KeepAliveTimeout != nil {
-		out.KeepAliveTimeout = *y.KeepAliveTimeout
-	}
-	if y.HTTPHostHeader != nil {
-		out.HTTPHostHeader = *y.HTTPHostHeader
-	}
-	if y.OriginServerName != nil {
-		out.OriginServerName = *y.OriginServerName
-	}
-	if y.CAPool != nil {
-		out.CAPool = *y.CAPool
-	}
-	if y.NoTLSVerify != nil {
-		out.NoTLSVerify = *y.NoTLSVerify
-	}
-	if y.DisableChunkedEncoding != nil {
-		out.DisableChunkedEncoding = *y.DisableChunkedEncoding
-	}
-	if y.BastionMode != nil {
-		out.BastionMode = *y.BastionMode
-	}
-	if y.ProxyAddress != nil {
-		out.ProxyAddress = *y.ProxyAddress
-	}
-	if y.ProxyPort != nil {
-		out.ProxyPort = *y.ProxyPort
-	}
-	if y.ProxyType != nil {
-		out.ProxyType = *y.ProxyType
-	}
-	return out
-}
-
-// OriginRequestConfig configures how Cloudflared sends requests to origin
-// services.
-// Note: To specify a time.Duration in go-yaml, use e.g. "3s" or "24h".
-type OriginRequestConfig struct {
-	// HTTP proxy timeout for establishing a new connection
-	ConnectTimeout time.Duration `yaml:"connectTimeout"`
-	// HTTP proxy timeout for completing a TLS handshake
-	TLSTimeout time.Duration `yaml:"tlsTimeout"`
-	// HTTP proxy TCP keepalive duration
-	TCPKeepAlive time.Duration `yaml:"tcpKeepAlive"`
-	// HTTP proxy should disable "happy eyeballs" for IPv4/v6 fallback
-	NoHappyEyeballs bool `yaml:"noHappyEyeballs"`
-	// HTTP proxy maximum keepalive connection pool size
-	KeepAliveConnections int `yaml:"keepAliveConnections"`
-	// HTTP proxy timeout for closing an idle connection
-	KeepAliveTimeout time.Duration `yaml:"keepAliveTimeout"`
-	// Sets the HTTP Host header for the local webserver.
-	HTTPHostHeader string `yaml:"httpHostHeader"`
-	// Hostname on the origin server certificate.
-	OriginServerName string `yaml:"originServerName"`
-	// Path to the CA for the certificate of your origin.
-	// This option should be used only if your certificate is not signed by Cloudflare.
-	CAPool string `yaml:"caPool"`
-	// Disables TLS verification of the certificate presented by your origin.
-	// Will allow any certificate from the origin to be accepted.
-	// Note: The connection from your machine to Cloudflare's Edge is still encrypted.
-	NoTLSVerify bool `yaml:"noTLSVerify"`
-	// Disables chunked transfer encoding.
-	// Useful if you are running a WSGI server.
-	DisableChunkedEncoding bool `yaml:"disableChunkedEncoding"`
-	// Runs as jump host
-	BastionMode bool `yaml:"bastionMode"`
-	// Listen address for the proxy.
-	ProxyAddress string `yaml:"proxyAddress"`
-	// Listen port for the proxy.
-	ProxyPort uint `yaml:"proxyPort"`
-	// What sort of proxy should be started
-	ProxyType string `yaml:"proxyType"`
-}
-
-func (defaults *OriginRequestConfig) setConnectTimeout(overrides config.OriginRequestConfig) {
-	if val := overrides.ConnectTimeout; val != nil {
-		defaults.ConnectTimeout = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setTLSTimeout(overrides config.OriginRequestConfig) {
-	if val := overrides.TLSTimeout; val != nil {
-		defaults.TLSTimeout = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setNoHappyEyeballs(overrides config.OriginRequestConfig) {
-	if val := overrides.NoHappyEyeballs; val != nil {
-		defaults.NoHappyEyeballs = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setKeepAliveConnections(overrides config.OriginRequestConfig) {
-	if val := overrides.KeepAliveConnections; val != nil {
-		defaults.KeepAliveConnections = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setKeepAliveTimeout(overrides config.OriginRequestConfig) {
-	if val := overrides.KeepAliveTimeout; val != nil {
-		defaults.KeepAliveTimeout = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setTCPKeepAlive(overrides config.OriginRequestConfig) {
-	if val := overrides.TCPKeepAlive; val != nil {
-		defaults.TCPKeepAlive = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setHTTPHostHeader(overrides config.OriginRequestConfig) {
-	if val := overrides.HTTPHostHeader; val != nil {
-		defaults.HTTPHostHeader = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setOriginServerName(overrides config.OriginRequestConfig) {
-	if val := overrides.OriginServerName; val != nil {
-		defaults.OriginServerName = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setCAPool(overrides config.OriginRequestConfig) {
-	if val := overrides.CAPool; val != nil {
-		defaults.CAPool = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setNoTLSVerify(overrides config.OriginRequestConfig) {
-	if val := overrides.NoTLSVerify; val != nil {
-		defaults.NoTLSVerify = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setDisableChunkedEncoding(overrides config.OriginRequestConfig) {
-	if val := overrides.DisableChunkedEncoding; val != nil {
-		defaults.DisableChunkedEncoding = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setBastionMode(overrides config.OriginRequestConfig) {
-	if val := overrides.BastionMode; val != nil {
-		defaults.BastionMode = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setProxyPort(overrides config.OriginRequestConfig) {
-	if val := overrides.ProxyPort; val != nil {
-		defaults.ProxyPort = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setProxyAddress(overrides config.OriginRequestConfig) {
-	if val := overrides.ProxyAddress; val != nil {
-		defaults.ProxyAddress = *val
-	}
-}
-
-func (defaults *OriginRequestConfig) setProxyType(overrides config.OriginRequestConfig) {
-	if val := overrides.ProxyType; val != nil {
-		defaults.ProxyType = *val
-	}
-}
-
-// SetConfig gets config for the requests that cloudflared sends to origins.
-// Each field has a setter method which sets a value for the field by trying to find:
-//   1. The user config for this rule
-//   2. The user config for the overall ingress config
-//   3. Defaults chosen by the cloudflared team
-//   4. Golang zero values for that type
-// If an earlier option isn't set, it will try the next option down.
-func setConfig(defaults OriginRequestConfig, overrides config.OriginRequestConfig) OriginRequestConfig {
-	cfg := defaults
-	cfg.setConnectTimeout(overrides)
-	cfg.setTLSTimeout(overrides)
-	cfg.setNoHappyEyeballs(overrides)
-	cfg.setKeepAliveConnections(overrides)
-	cfg.setKeepAliveTimeout(overrides)
-	cfg.setTCPKeepAlive(overrides)
-	cfg.setHTTPHostHeader(overrides)
-	cfg.setOriginServerName(overrides)
-	cfg.setCAPool(overrides)
-	cfg.setNoTLSVerify(overrides)
-	cfg.setDisableChunkedEncoding(overrides)
-	cfg.setBastionMode(overrides)
-	cfg.setProxyPort(overrides)
-	cfg.setProxyAddress(overrides)
-	cfg.setProxyType(overrides)
-	return cfg
-}

ingress/origin_request_config_test.go

@@ -1,184 +0,0 @@
-package ingress
-
-import (
-	"testing"
-	"time"
-
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v2"
-)
-
-// Ensure that the nullable config from `config` package and the
-// non-nullable config from `ingress` package have the same number of
-// fields.
-// This test ensures that programmers didn't add a new field to
-// one struct and forget to add it to the other ;)
-func TestCorrespondingFields(t *testing.T) {
-	require.Equal(
-		t,
-		CountFields(t, config.OriginRequestConfig{}),
-		CountFields(t, OriginRequestConfig{}),
-	)
-}
-
-func CountFields(t *testing.T, val interface{}) int {
-	b, err := yaml.Marshal(val)
-	require.NoError(t, err)
-	m := make(map[string]interface{}, 0)
-	err = yaml.Unmarshal(b, &m)
-	require.NoError(t, err)
-	return len(m)
-}
-
-func TestOriginRequestConfigOverrides(t *testing.T) {
-	rulesYAML := `
-originRequest:
-  connectTimeout: 1m
-  tlsTimeout: 1s
-  noHappyEyeballs: true
-  tcpKeepAlive: 1s
-  keepAliveConnections: 1
-  keepAliveTimeout: 1s
-  httpHostHeader: abc
-  originServerName: a1
-  caPool: /tmp/path0
-  noTLSVerify: true
-  disableChunkedEncoding: true
-  bastionMode: True
-  proxyAddress: 127.1.2.3
-  proxyPort: 100
-  proxyType: socks5
-ingress:
-- hostname: tun.example.com
-  service: https://localhost:8000
-- hostname: "*"
-  service: https://localhost:8001
-  originRequest:
-    connectTimeout: 2m
-    tlsTimeout: 2s
-    noHappyEyeballs: false
-    tcpKeepAlive: 2s
-    keepAliveConnections: 2
-    keepAliveTimeout: 2s
-    httpHostHeader: def
-    originServerName: b2
-    caPool: /tmp/path1
-    noTLSVerify: false
-    disableChunkedEncoding: false
-    bastionMode: false
-    proxyAddress: interface
-    proxyPort: 200
-    proxyType: ""
-`
-	ing, err := ParseIngress(MustReadIngress(rulesYAML))
-	if err != nil {
-		t.Error(err)
-	}
-
-	// Rule 0 didn't override anything, so it inherits the user-specified
-	// root-level configuration.
-	actual0 := ing.Rules[0].Config
-	expected0 := OriginRequestConfig{
-		ConnectTimeout:         1 * time.Minute,
-		TLSTimeout:             1 * time.Second,
-		NoHappyEyeballs:        true,
-		TCPKeepAlive:           1 * time.Second,
-		KeepAliveConnections:   1,
-		KeepAliveTimeout:       1 * time.Second,
-		HTTPHostHeader:         "abc",
-		OriginServerName:       "a1",
-		CAPool:                 "/tmp/path0",
-		NoTLSVerify:            true,
-		DisableChunkedEncoding: true,
-		BastionMode:            true,
-		ProxyAddress:           "127.1.2.3",
-		ProxyPort:              uint(100),
-		ProxyType:              "socks5",
-	}
-	require.Equal(t, expected0, actual0)
-
-	// Rule 1 overrode all the root-level config.
-	actual1 := ing.Rules[1].Config
-	expected1 := OriginRequestConfig{
-		ConnectTimeout:         2 * time.Minute,
-		TLSTimeout:             2 * time.Second,
-		NoHappyEyeballs:        false,
-		TCPKeepAlive:           2 * time.Second,
-		KeepAliveConnections:   2,
-		KeepAliveTimeout:       2 * time.Second,
-		HTTPHostHeader:         "def",
-		OriginServerName:       "b2",
-		CAPool:                 "/tmp/path1",
-		NoTLSVerify:            false,
-		DisableChunkedEncoding: false,
-		BastionMode:            false,
-		ProxyAddress:           "interface",
-		ProxyPort:              uint(200),
-		ProxyType:              "",
-	}
-	require.Equal(t, expected1, actual1)
-}
-
-func TestOriginRequestConfigDefaults(t *testing.T) {
-	rulesYAML := `
-ingress:
-- hostname: tun.example.com
-  service: https://localhost:8000
-- hostname: "*"
-  service: https://localhost:8001
-  originRequest:
-    connectTimeout: 2m
-    tlsTimeout: 2s
-    noHappyEyeballs: false
-    tcpKeepAlive: 2s
-    keepAliveConnections: 2
-    keepAliveTimeout: 2s
-    httpHostHeader: def
-    originServerName: b2
-    caPool: /tmp/path1
-    noTLSVerify: false
-    disableChunkedEncoding: false
-    bastionMode: false
-    proxyAddress: interface
-    proxyPort: 200
-    proxyType: ""
-`
-	ing, err := ParseIngress(MustReadIngress(rulesYAML))
-	if err != nil {
-		t.Error(err)
-	}
-
-	// Rule 0 didn't override anything, so it inherits the cloudflared defaults
-	actual0 := ing.Rules[0].Config
-	expected0 := OriginRequestConfig{
-		ConnectTimeout:       defaultConnectTimeout,
-		TLSTimeout:           defaultTLSTimeout,
-		TCPKeepAlive:         defaultTCPKeepAlive,
-		KeepAliveConnections: defaultKeepAliveConnections,
-		KeepAliveTimeout:     defaultKeepAliveTimeout,
-		ProxyAddress:         defaultProxyAddress,
-	}
-	require.Equal(t, expected0, actual0)
-
-	// Rule 1 overrode all defaults.
-	actual1 := ing.Rules[1].Config
-	expected1 := OriginRequestConfig{
-		ConnectTimeout:         2 * time.Minute,
-		TLSTimeout:             2 * time.Second,
-		NoHappyEyeballs:        false,
-		TCPKeepAlive:           2 * time.Second,
-		KeepAliveConnections:   2,
-		KeepAliveTimeout:       2 * time.Second,
-		HTTPHostHeader:         "def",
-		OriginServerName:       "b2",
-		CAPool:                 "/tmp/path1",
-		NoTLSVerify:            false,
-		DisableChunkedEncoding: false,
-		BastionMode:            false,
-		ProxyAddress:           "interface",
-		ProxyPort:              uint(200),
-		ProxyType:              "",
-	}
-	require.Equal(t, expected1, actual1)
-}

ingress/origin_service.go

@@ -1,320 +0,0 @@
-package ingress
-
-import (
-	"context"
-	"crypto/tls"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"strconv"
-	"sync"
-	"time"
-
-	"github.com/cloudflare/cloudflared/hello"
-	"github.com/cloudflare/cloudflared/logger"
-	"github.com/cloudflare/cloudflared/socks"
-	"github.com/cloudflare/cloudflared/tlsconfig"
-	"github.com/cloudflare/cloudflared/websocket"
-	gws "github.com/gorilla/websocket"
-	"github.com/pkg/errors"
-)
-
-// OriginService is something a tunnel can proxy traffic to.
-type OriginService interface {
-	// RoundTrip is how cloudflared proxies eyeball requests to the actual origin services
-	http.RoundTripper
-	String() string
-	// Start the origin service if it's managed by cloudflared, e.g. proxy servers or Hello World.
-	// If it's not managed by cloudflared, this is a no-op because the user is responsible for
-	// starting the origin service.
-	start(wg *sync.WaitGroup, log logger.Service, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error
-}
-
-// unixSocketPath is an OriginService representing a unix socket (which accepts HTTP)
-type unixSocketPath struct {
-	path      string
-	transport *http.Transport
-}
-
-func (o *unixSocketPath) String() string {
-	return "unix socket: " + o.path
-}
-
-func (o *unixSocketPath) start(wg *sync.WaitGroup, log logger.Service, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
-	transport, err := newHTTPTransport(o, cfg)
-	if err != nil {
-		return err
-	}
-	o.transport = transport
-	return nil
-}
-
-func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) {
-	return o.transport.RoundTrip(req)
-}
-
-func (o *unixSocketPath) Dial(reqURL *url.URL, headers http.Header) (*gws.Conn, *http.Response, error) {
-	d := &gws.Dialer{
-		NetDial:         o.transport.Dial,
-		NetDialContext:  o.transport.DialContext,
-		TLSClientConfig: o.transport.TLSClientConfig,
-	}
-	reqURL.Scheme = websocket.ChangeRequestScheme(reqURL)
-	return d.Dial(reqURL.String(), headers)
-}
-
-// localService is an OriginService listening on a TCP/IP address the user's origin can route to.
-type localService struct {
-	// The URL for the user's origin service
-	RootURL *url.URL
-	// The URL that cloudflared should send requests to.
-	// If this origin requires starting a proxy, this is the proxy's address,
-	// and that proxy points to RootURL. Otherwise, this is equal to RootURL.
-	URL       *url.URL
-	transport *http.Transport
-}
-
-func (o *localService) Dial(reqURL *url.URL, headers http.Header) (*gws.Conn, *http.Response, error) {
-	d := &gws.Dialer{TLSClientConfig: o.transport.TLSClientConfig}
-	// Rewrite the request URL so that it goes to the origin service.
-	reqURL.Host = o.URL.Host
-	reqURL.Scheme = websocket.ChangeRequestScheme(o.URL)
-	return d.Dial(reqURL.String(), headers)
-}
-
-func (o *localService) address() string {
-	return o.URL.String()
-}
-
-func (o *localService) start(wg *sync.WaitGroup, log logger.Service, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
-	transport, err := newHTTPTransport(o, cfg)
-	if err != nil {
-		return err
-	}
-	o.transport = transport
-
-	// Start a proxy if one is needed
-	staticHost := o.staticHost()
-	if originRequiresProxy(staticHost, cfg) {
-		if err := o.startProxy(staticHost, wg, log, shutdownC, errC, cfg); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (o *localService) startProxy(staticHost string, wg *sync.WaitGroup, log logger.Service, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
-
-	// Start a listener for the proxy
-	proxyAddress := net.JoinHostPort(cfg.ProxyAddress, strconv.Itoa(int(cfg.ProxyPort)))
-	listener, err := net.Listen("tcp", proxyAddress)
-	if err != nil {
-		log.Errorf("Cannot start Websocket Proxy Server: %s", err)
-		return errors.Wrap(err, "Cannot start Websocket Proxy Server")
-	}
-
-	// Start the proxy itself
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		streamHandler := websocket.DefaultStreamHandler
-		// This origin's config specifies what type of proxy to start.
-		switch cfg.ProxyType {
-		case socksProxy:
-			log.Info("SOCKS5 server started")
-			streamHandler = func(wsConn *websocket.Conn, remoteConn net.Conn, _ http.Header) {
-				dialer := socks.NewConnDialer(remoteConn)
-				requestHandler := socks.NewRequestHandler(dialer)
-				socksServer := socks.NewConnectionHandler(requestHandler)
-
-				socksServer.Serve(wsConn)
-			}
-		case "":
-			log.Debug("Not starting any websocket proxy")
-		default:
-			log.Errorf("%s isn't a valid proxy (valid options are {%s})", cfg.ProxyType, socksProxy)
-		}
-
-		errC <- websocket.StartProxyServer(log, listener, staticHost, shutdownC, streamHandler)
-	}()
-
-	// Modify this origin, so that it no longer points at the origin service directly.
-	// Instead, it points at the proxy to the origin service.
-	newURL, err := url.Parse("http://" + listener.Addr().String())
-	if err != nil {
-		return err
-	}
-	o.URL = newURL
-	return nil
-}
-
-func (o *localService) String() string {
-	return o.address()
-}
-
-func (o *localService) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Rewrite the request URL so that it goes to the origin service.
-	req.URL.Host = o.URL.Host
-	req.URL.Scheme = o.URL.Scheme
-	return o.transport.RoundTrip(req)
-}
-
-func (o *localService) staticHost() string {
-
-	addPortIfMissing := func(uri *url.URL, port int) string {
-		if uri.Port() != "" {
-			return uri.Host
-		}
-		return fmt.Sprintf("%s:%d", uri.Hostname(), port)
-	}
-
-	switch o.URL.Scheme {
-	case "ssh":
-		return addPortIfMissing(o.URL, 22)
-	case "rdp":
-		return addPortIfMissing(o.URL, 3389)
-	case "smb":
-		return addPortIfMissing(o.URL, 445)
-	case "tcp":
-		return addPortIfMissing(o.URL, 7864) // just a random port since there isn't a default in this case
-	}
-	return ""
-
-}
-
-// HelloWorld is an OriginService for the built-in Hello World server.
-// Users only use this for testing and experimenting with cloudflared.
-type helloWorld struct {
-	server    net.Listener
-	transport *http.Transport
-}
-
-func (o *helloWorld) String() string {
-	return "Hello World test origin"
-}
-
-// Start starts a HelloWorld server and stores its address in the Service receiver.
-func (o *helloWorld) start(wg *sync.WaitGroup, log logger.Service, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
-	transport, err := newHTTPTransport(o, cfg)
-	if err != nil {
-		return err
-	}
-	o.transport = transport
-	helloListener, err := hello.CreateTLSListener("127.0.0.1:")
-	if err != nil {
-		return errors.Wrap(err, "Cannot start Hello World Server")
-	}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		_ = hello.StartHelloWorldServer(log, helloListener, shutdownC)
-	}()
-	o.server = helloListener
-	return nil
-}
-
-func (o *helloWorld) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Rewrite the request URL so that it goes to the Hello World server.
-	req.URL.Host = o.server.Addr().String()
-	req.URL.Scheme = "https"
-	return o.transport.RoundTrip(req)
-}
-
-func (o *helloWorld) Dial(reqURL *url.URL, headers http.Header) (*gws.Conn, *http.Response, error) {
-	d := &gws.Dialer{
-		TLSClientConfig: o.transport.TLSClientConfig,
-	}
-	reqURL.Host = o.server.Addr().String()
-	reqURL.Scheme = "wss"
-	return d.Dial(reqURL.String(), headers)
-}
-
-func originRequiresProxy(staticHost string, cfg OriginRequestConfig) bool {
-	return staticHost != "" || cfg.BastionMode
-}
-
-// statusCode is an OriginService that just responds with a given HTTP status.
-// Typical use-case is "user wants the catch-all rule to just respond 404".
-type statusCode struct {
-	resp *http.Response
-}
-
-func newStatusCode(status int) statusCode {
-	resp := &http.Response{
-		StatusCode: status,
-		Status:     http.StatusText(status),
-		Body:       new(NopReadCloser),
-	}
-	return statusCode{resp: resp}
-}
-
-func (o *statusCode) String() string {
-	return fmt.Sprintf("HTTP %d", o.resp.StatusCode)
-}
-
-func (o *statusCode) start(wg *sync.WaitGroup, log logger.Service, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
-	return nil
-}
-
-func (o *statusCode) RoundTrip(_ *http.Request) (*http.Response, error) {
-	return o.resp, nil
-}
-
-type NopReadCloser struct{}
-
-// Read always returns EOF to signal end of input
-func (nrc *NopReadCloser) Read(buf []byte) (int, error) {
-	return 0, io.EOF
-}
-
-func (nrc *NopReadCloser) Close() error {
-	return nil
-}
-
-func newHTTPTransport(service OriginService, cfg OriginRequestConfig) (*http.Transport, error) {
-	originCertPool, err := tlsconfig.LoadOriginCA(cfg.CAPool, nil)
-	if err != nil {
-		return nil, errors.Wrap(err, "Error loading cert pool")
-	}
-
-	httpTransport := http.Transport{
-		Proxy:                 http.ProxyFromEnvironment,
-		MaxIdleConns:          cfg.KeepAliveConnections,
-		MaxIdleConnsPerHost:   cfg.KeepAliveConnections,
-		IdleConnTimeout:       cfg.KeepAliveTimeout,
-		TLSHandshakeTimeout:   cfg.TLSTimeout,
-		ExpectContinueTimeout: 1 * time.Second,
-		TLSClientConfig:       &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: cfg.NoTLSVerify},
-	}
-	if _, isHelloWorld := service.(*helloWorld); !isHelloWorld && cfg.OriginServerName != "" {
-		httpTransport.TLSClientConfig.ServerName = cfg.OriginServerName
-	}
-
-	dialer := &net.Dialer{
-		Timeout:   cfg.ConnectTimeout,
-		KeepAlive: cfg.TCPKeepAlive,
-	}
-	if cfg.NoHappyEyeballs {
-		dialer.FallbackDelay = -1 // As of Golang 1.12, a negative delay disables "happy eyeballs"
-	}
-
-	// DialContext depends on which kind of origin is being used.
-	dialContext := dialer.DialContext
-	switch service := service.(type) {
-
-	// If this origin is a unix socket, enforce network type "unix".
-	case *unixSocketPath:
-		httpTransport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
-			return dialContext(ctx, "unix", service.path)
-		}
-
-	// Otherwise, use the regular network config.
-	default:
-		httpTransport.DialContext = dialContext
-	}
-
-	return &httpTransport, nil
-}

ingress/rule.go

@@ -1,50 +0,0 @@
-package ingress
-
-import (
-	"regexp"
-	"strings"
-)
-
-// Rule routes traffic from a hostname/path on the public internet to the
-// service running on the given URL.
-type Rule struct {
-	// Requests for this hostname will be proxied to this rule's service.
-	Hostname string
-
-	// Path is an optional regex that can specify path-driven ingress rules.
-	Path *regexp.Regexp
-
-	// A (probably local) address. Requests for a hostname which matches this
-	// rule's hostname pattern will be proxied to the service running on this
-	// address.
-	Service OriginService
-
-	// Configure the request cloudflared sends to this specific origin.
-	Config OriginRequestConfig
-}
-
-// MultiLineString is for outputting rules in a human-friendly way when Cloudflared
-// is used as a CLI tool (not as a daemon).
-func (r Rule) MultiLineString() string {
-	var out strings.Builder
-	if r.Hostname != "" {
-		out.WriteString("\thostname: ")
-		out.WriteString(r.Hostname)
-		out.WriteRune('\n')
-	}
-	if r.Path != nil {
-		out.WriteString("\tpath: ")
-		out.WriteString(r.Path.String())
-		out.WriteRune('\n')
-	}
-	out.WriteString("\tservice: ")
-	out.WriteString(r.Service.String())
-	return out.String()
-}
-
-// Matches checks if the rule matches a given hostname/path combination.
-func (r *Rule) Matches(hostname, path string) bool {
-	hostMatch := r.Hostname == "" || r.Hostname == "*" || matchHost(r.Hostname, hostname)
-	pathMatch := r.Path == nil || r.Path.MatchString(path)
-	return hostMatch && pathMatch
-}

ingress/rule_test.go

@@ -1,146 +0,0 @@
-package ingress
-
-import (
-	"io"
-	"net/http/httptest"
-	"net/url"
-	"regexp"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func Test_rule_matches(t *testing.T) {
-	type fields struct {
-		Hostname string
-		Path     *regexp.Regexp
-		Service  OriginService
-	}
-	type args struct {
-		requestURL *url.URL
-	}
-	tests := []struct {
-		name   string
-		fields fields
-		args   args
-		want   bool
-	}{
-		{
-			name: "Just hostname, pass",
-			fields: fields{
-				Hostname: "example.com",
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://example.com"),
-			},
-			want: true,
-		},
-		{
-			name: "Entire hostname is wildcard, should match everything",
-			fields: fields{
-				Hostname: "*",
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://example.com"),
-			},
-			want: true,
-		},
-		{
-			name: "Just hostname, fail",
-			fields: fields{
-				Hostname: "example.com",
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://foo.bar"),
-			},
-			want: false,
-		},
-		{
-			name: "Just wildcard hostname, pass",
-			fields: fields{
-				Hostname: "*.example.com",
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://adam.example.com"),
-			},
-			want: true,
-		},
-		{
-			name: "Just wildcard hostname, fail",
-			fields: fields{
-				Hostname: "*.example.com",
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://tunnel.com"),
-			},
-			want: false,
-		},
-		{
-			name: "Just wildcard outside of subdomain in hostname, fail",
-			fields: fields{
-				Hostname: "*example.com",
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://www.example.com"),
-			},
-			want: false,
-		},
-		{
-			name: "Wildcard over multiple subdomains",
-			fields: fields{
-				Hostname: "*.example.com",
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://adam.chalmers.example.com"),
-			},
-			want: true,
-		},
-		{
-			name: "Hostname and path",
-			fields: fields{
-				Hostname: "*.example.com",
-				Path:     regexp.MustCompile("/static/.*\\.html"),
-			},
-			args: args{
-				requestURL: MustParseURL(t, "https://www.example.com/static/index.html"),
-			},
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			r := Rule{
-				Hostname: tt.fields.Hostname,
-				Path:     tt.fields.Path,
-				Service:  tt.fields.Service,
-			}
-			u := tt.args.requestURL
-			if got := r.Matches(u.Hostname(), u.Path); got != tt.want {
-				t.Errorf("rule.matches() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestStaticHTTPStatus(t *testing.T) {
-	o := newStatusCode(404)
-	buf := make([]byte, 100)
-
-	sendReq := func() {
-		resp, err := o.RoundTrip(nil)
-		require.NoError(t, err)
-		_, err = resp.Body.Read(buf)
-		require.Equal(t, io.EOF, err)
-		require.NoError(t, resp.Body.Close())
-		require.Equal(t, 404, resp.StatusCode)
-
-		resp, err = o.RoundTrip(nil)
-		require.NoError(t, err)
-		w := httptest.NewRecorder()
-		n, err := io.Copy(w, resp.Body)
-		require.NoError(t, err)
-		require.Equal(t, int64(0), n)
-	}
-	sendReq()
-	sendReq()
-}

origin/reconnect.go

@@ -7,6 +7,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -163,17 +164,18 @@ func ReconnectTunnel(
 	}
 
 	config.TransportLogger.Debug("initiating RPC stream to reconnect")
-	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, reconnect)
+	tunnelServer, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
 	if err != nil {
-		return err
+		// RPC stream open error
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, reconnect)
 	}
-	defer rpcClient.Close()
+	defer tunnelServer.Close()
 	// Request server info without blocking tunnel registration; must use capnp library directly.
-	serverInfoPromise := tunnelrpc.TunnelServer{Client: rpcClient.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
+	serverInfoPromise := tunnelrpc.TunnelServer{Client: tunnelServer.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
 		return nil
 	})
 	LogServerInfo(serverInfoPromise.Result(), connectionID, config.Metrics, logger, config.TunnelEventChan)
-	registration := rpcClient.ReconnectTunnel(
+	registration := tunnelServer.ReconnectTunnel(
 		ctx,
 		token,
 		eventDigest,

origin/supervisor.go

@@ -323,16 +323,16 @@ func (s *Supervisor) authenticate(ctx context.Context, numPreviousAttempts int)
 		<-muxer.Shutdown()
 	}()
 
-	rpcClient, err := newTunnelRPCClient(ctx, muxer, s.config, authenticate)
+	tunnelServer, err := connection.NewRPCClient(ctx, muxer, s.logger, openStreamTimeout)
 	if err != nil {
 		return nil, err
 	}
-	defer rpcClient.Close()
+	defer tunnelServer.Close()
 
 	const arbitraryConnectionID = uint8(0)
 	registrationOptions := s.config.RegistrationOptions(arbitraryConnectionID, edgeConn.LocalAddr().String(), s.cloudflaredUUID)
 	registrationOptions.NumPreviousAttempts = uint8(numPreviousAttempts)
-	authResponse, err := rpcClient.Authenticate(
+	authResponse, err := tunnelServer.Authenticate(
 		ctx,
 		s.config.OriginCert,
 		s.config.Hostname,

origin/tunnel.go

@@ -24,12 +24,12 @@ import (
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/ui"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/h2mux"
-	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
+	"github.com/cloudflare/cloudflared/validation"
 	"github.com/cloudflare/cloudflared/websocket"
 )
 
@@ -44,25 +44,26 @@ const (
 	FeatureQuickReconnects   = "quick_reconnects"
 )
 
-type rpcName string
+type registerRPCName string
 
 const (
-	register     rpcName = "register"
-	reconnect    rpcName = "reconnect"
-	unregister   rpcName = "unregister"
-	authenticate rpcName = " authenticate"
+	register  registerRPCName = "register"
+	reconnect registerRPCName = "reconnect"
 )
 
 type TunnelConfig struct {
 	BuildInfo          *buildinfo.BuildInfo
 	ClientID           string
+	ClientTlsConfig    *tls.Config
 	CloseConnOnce      *sync.Once // Used to close connectedSignal no more than once
 	CompressionQuality uint64
 	EdgeAddrs          []string
 	GracePeriod        time.Duration
 	HAConnections      int
+	HTTPTransport      http.RoundTripper
 	HeartbeatInterval  time.Duration
 	Hostname           string
+	HTTPHostHeader     string
 	IncidentLookup     IncidentLookup
 	IsAutoupdated      bool
 	IsFreeTunnel       bool
@@ -72,6 +73,7 @@ type TunnelConfig struct {
 	MaxHeartbeats      uint64
 	Metrics            *TunnelMetrics
 	MetricsUpdateFreq  time.Duration
+	NoChunkedEncoding  bool
 	OriginCert         []byte
 	ReportedVersion    string
 	Retries            uint
@@ -79,6 +81,8 @@ type TunnelConfig struct {
 	Tags               []tunnelpogs.Tag
 	TlsConfig          *tls.Config
 	WSGI               bool
+	// OriginUrl may not be used if a user specifies a unix socket.
+	OriginUrl string
 
 	// feature-flag to use new edge reconnect tokens
 	UseReconnectToken bool
@@ -86,7 +90,6 @@ type TunnelConfig struct {
 	NamedTunnel     *NamedTunnelConfig
 	ReplaceExisting bool
 	TunnelEventChan chan<- ui.TunnelEvent
-	IngressRules    ingress.Ingress
 }
 
 type dupConnRegisterTunnelError struct{}
@@ -118,7 +121,7 @@ type clientRegisterTunnelError struct {
 	cause error
 }
 
-func newRPCError(cause error, counter *prometheus.CounterVec, name rpcName) clientRegisterTunnelError {
+func newClientRegisterTunnelError(cause error, counter *prometheus.CounterVec, name registerRPCName) clientRegisterTunnelError {
 	counter.WithLabelValues(cause.Error(), string(name)).Inc()
 	return clientRegisterTunnelError{cause: cause}
 }
@@ -334,7 +337,7 @@ func ServeTunnel(
 					if config.NamedTunnel != nil {
 						_ = UnregisterConnection(ctx, handler.muxer, config)
 					} else {
-						_ = UnregisterTunnel(handler.muxer, config)
+						_ = UnregisterTunnel(handler.muxer, config.GracePeriod, config.TransportLogger)
 					}
 				}
 				handler.muxer.Shutdown()
@@ -414,13 +417,14 @@ func RegisterConnection(
 	const registerConnection = "registerConnection"
 
 	config.TransportLogger.Debug("initiating RPC stream for RegisterConnection")
-	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, registerConnection)
+	rpc, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
 	if err != nil {
-		return err
+		// RPC stream open error
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, registerConnection)
 	}
-	defer rpcClient.Close()
+	defer rpc.Close()
 
-	conn, err := rpcClient.RegisterConnection(
+	conn, err := rpc.RegisterConnection(
 		ctx,
 		config.NamedTunnel.Auth,
 		config.NamedTunnel.ID,
@@ -466,14 +470,14 @@ func UnregisterConnection(
 	config *TunnelConfig,
 ) error {
 	config.TransportLogger.Debug("initiating RPC stream for UnregisterConnection")
-	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, register)
+	rpc, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
 	if err != nil {
 		// RPC stream open error
-		return err
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, register)
 	}
-	defer rpcClient.Close()
+	defer rpc.Close()
 
-	return rpcClient.UnregisterConnection(ctx)
+	return rpc.UnregisterConnection(ctx)
 }
 
 func RegisterTunnel(
@@ -490,18 +494,18 @@ func RegisterTunnel(
 	if config.TunnelEventChan != nil {
 		config.TunnelEventChan <- ui.TunnelEvent{EventType: ui.RegisteringTunnel}
 	}
-
-	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, register)
+	tunnelServer, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
 	if err != nil {
-		return err
+		// RPC stream open error
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, register)
 	}
-	defer rpcClient.Close()
+	defer tunnelServer.Close()
 	// Request server info without blocking tunnel registration; must use capnp library directly.
-	serverInfoPromise := tunnelrpc.TunnelServer{Client: rpcClient.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
+	serverInfoPromise := tunnelrpc.TunnelServer{Client: tunnelServer.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
 		return nil
 	})
 	LogServerInfo(serverInfoPromise.Result(), connectionID, config.Metrics, logger, config.TunnelEventChan)
-	registration := rpcClient.RegisterTunnel(
+	registration := tunnelServer.RegisterTunnel(
 		ctx,
 		config.OriginCert,
 		config.Hostname,
@@ -525,7 +529,7 @@ func processRegistrationSuccess(
 	logger logger.Service,
 	connectionID uint8,
 	registration *tunnelpogs.TunnelRegistration,
-	name rpcName,
+	name registerRPCName,
 	credentialManager *reconnectCredentialManager,
 ) error {
 	for _, logLine := range registration.LogLines {
@@ -559,7 +563,7 @@ func processRegistrationSuccess(
 	return nil
 }
 
-func processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, metrics *TunnelMetrics, name rpcName) error {
+func processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, metrics *TunnelMetrics, name registerRPCName) error {
 	if err.Error() == DuplicateConnectionError {
 		metrics.regFail.WithLabelValues("dup_edge_conn", string(name)).Inc()
 		return errDuplicationConnection
@@ -571,18 +575,18 @@ func processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, metrics
 	}
 }
 
-func UnregisterTunnel(muxer *h2mux.Muxer, config *TunnelConfig) error {
-	config.TransportLogger.Debug("initiating RPC stream to unregister")
+func UnregisterTunnel(muxer *h2mux.Muxer, gracePeriod time.Duration, logger logger.Service) error {
+	logger.Debug("initiating RPC stream to unregister")
 	ctx := context.Background()
-	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, unregister)
+	tunnelServer, err := connection.NewRPCClient(ctx, muxer, logger, openStreamTimeout)
 	if err != nil {
 		// RPC stream open error
 		return err
 	}
-	defer rpcClient.Close()
+	defer tunnelServer.Close()
 
 	// gracePeriod is encoded in int64 using capnproto
-	return rpcClient.UnregisterTunnel(ctx, config.GracePeriod.Nanoseconds())
+	return tunnelServer.UnregisterTunnel(ctx, gracePeriod.Nanoseconds())
 }
 
 func LogServerInfo(
@@ -611,13 +615,17 @@ func LogServerInfo(
 }
 
 type TunnelHandler struct {
-	ingressRules ingress.Ingress
-	muxer        *h2mux.Muxer
-	tags         []tunnelpogs.Tag
-	metrics      *TunnelMetrics
+	originUrl      string
+	httpHostHeader string
+	muxer          *h2mux.Muxer
+	httpClient     http.RoundTripper
+	tlsConfig      *tls.Config
+	tags           []tunnelpogs.Tag
+	metrics        *TunnelMetrics
 	// connectionID is only used by metrics, and prometheus requires labels to be string
-	connectionID string
-	logger       logger.Service
+	connectionID      string
+	logger            logger.Service
+	noChunkedEncoding bool
 
 	bufferPool *buffer.Pool
 }
@@ -629,14 +637,24 @@ func NewTunnelHandler(ctx context.Context,
 	connectionID uint8,
 	bufferPool *buffer.Pool,
 ) (*TunnelHandler, string, error) {
-
+	originURL, err := validation.ValidateUrl(config.OriginUrl)
+	if err != nil {
+		return nil, "", fmt.Errorf("unable to parse origin URL %#v", originURL)
+	}
 	h := &TunnelHandler{
-		ingressRules: config.IngressRules,
-		tags:         config.Tags,
-		metrics:      config.Metrics,
-		connectionID: uint8ToString(connectionID),
-		logger:       config.Logger,
-		bufferPool:   bufferPool,
+		originUrl:         originURL,
+		httpHostHeader:    config.HTTPHostHeader,
+		httpClient:        config.HTTPTransport,
+		tlsConfig:         config.ClientTlsConfig,
+		tags:              config.Tags,
+		metrics:           config.Metrics,
+		connectionID:      uint8ToString(connectionID),
+		logger:            config.Logger,
+		noChunkedEncoding: config.NoChunkedEncoding,
+		bufferPool:        bufferPool,
+	}
+	if h.httpClient == nil {
+		h.httpClient = http.DefaultTransport
 	}
 
 	edgeConn, err := connection.DialEdge(ctx, dialTimeout, config.TlsConfig, addr)
@@ -662,7 +680,7 @@ func (h *TunnelHandler) ServeStream(stream *h2mux.MuxedStream) error {
 	h.metrics.incrementRequests(h.connectionID)
 	defer h.metrics.decrementConcurrentRequests(h.connectionID)
 
-	req, rule, reqErr := h.createRequest(stream)
+	req, reqErr := h.createRequest(stream)
 	if reqErr != nil {
 		h.writeErrorResponse(stream, reqErr)
 		return reqErr
@@ -675,9 +693,9 @@ func (h *TunnelHandler) ServeStream(stream *h2mux.MuxedStream) error {
 	var resp *http.Response
 	var respErr error
 	if websocket.IsWebSocketUpgrade(req) {
-		resp, respErr = h.serveWebsocket(stream, req, rule)
+		resp, respErr = h.serveWebsocket(stream, req)
 	} else {
-		resp, respErr = h.serveHTTP(stream, req, rule)
+		resp, respErr = h.serveHTTP(stream, req)
 	}
 	if respErr != nil {
 		h.writeErrorResponse(stream, respErr)
@@ -687,32 +705,26 @@ func (h *TunnelHandler) ServeStream(stream *h2mux.MuxedStream) error {
 	return nil
 }
 
-func (h *TunnelHandler) createRequest(stream *h2mux.MuxedStream) (*http.Request, *ingress.Rule, error) {
-	req, err := http.NewRequest("GET", "http://localhost:8080", h2mux.MuxedStreamReader{MuxedStream: stream})
+func (h *TunnelHandler) createRequest(stream *h2mux.MuxedStream) (*http.Request, error) {
+	req, err := http.NewRequest("GET", h.originUrl, h2mux.MuxedStreamReader{MuxedStream: stream})
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "Unexpected error from http.NewRequest")
+		return nil, errors.Wrap(err, "Unexpected error from http.NewRequest")
 	}
 	err = h2mux.H2RequestHeadersToH1Request(stream.Headers, req)
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "invalid request received")
+		return nil, errors.Wrap(err, "invalid request received")
 	}
 	h.AppendTagHeaders(req)
-	// For incoming requests, the Host header is promoted to the Request.Host field and removed from the Header map.
-	rule, _ := h.ingressRules.FindMatchingRule(req.Host, req.URL.Path)
-	return req, rule, nil
+	return req, nil
 }
 
-func (h *TunnelHandler) serveWebsocket(stream *h2mux.MuxedStream, req *http.Request, rule *ingress.Rule) (*http.Response, error) {
-	if hostHeader := rule.Config.HTTPHostHeader; hostHeader != "" {
-		req.Header.Set("Host", hostHeader)
-		req.Host = hostHeader
+func (h *TunnelHandler) serveWebsocket(stream *h2mux.MuxedStream, req *http.Request) (*http.Response, error) {
+	if h.httpHostHeader != "" {
+		req.Header.Set("Host", h.httpHostHeader)
+		req.Host = h.httpHostHeader
 	}
 
-	dialler, ok := rule.Service.(websocket.Dialler)
-	if !ok {
-		return nil, fmt.Errorf("Websockets aren't supported by the origin service '%s'", rule.Service)
-	}
-	conn, response, err := websocket.ClientConnect(req, dialler)
+	conn, response, err := websocket.ClientConnect(req, h.tlsConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -728,9 +740,9 @@ func (h *TunnelHandler) serveWebsocket(stream *h2mux.MuxedStream, req *http.Requ
 	return response, nil
 }
 
-func (h *TunnelHandler) serveHTTP(stream *h2mux.MuxedStream, req *http.Request, rule *ingress.Rule) (*http.Response, error) {
+func (h *TunnelHandler) serveHTTP(stream *h2mux.MuxedStream, req *http.Request) (*http.Response, error) {
 	// Support for WSGI Servers by switching transfer encoding from chunked to gzip/deflate
-	if rule.Config.DisableChunkedEncoding {
+	if h.noChunkedEncoding {
 		req.TransferEncoding = []string{"gzip", "deflate"}
 		cLength, err := strconv.Atoi(req.Header.Get("Content-Length"))
 		if err == nil {
@@ -741,12 +753,12 @@ func (h *TunnelHandler) serveHTTP(stream *h2mux.MuxedStream, req *http.Request,
 	// Request origin to keep connection alive to improve performance
 	req.Header.Set("Connection", "keep-alive")
 
-	if hostHeader := rule.Config.HTTPHostHeader; hostHeader != "" {
-		req.Header.Set("Host", hostHeader)
-		req.Host = hostHeader
+	if h.httpHostHeader != "" {
+		req.Header.Set("Host", h.httpHostHeader)
+		req.Host = h.httpHostHeader
 	}
 
-	response, err := rule.Service.RoundTrip(req)
+	response, err := h.httpClient.RoundTrip(req)
 	if err != nil {
 		return nil, errors.Wrap(err, "Error proxying request to origin")
 	}
@@ -897,18 +909,3 @@ func findCfRayHeader(h1 *http.Request) string {
 func isLBProbeRequest(req *http.Request) bool {
 	return strings.HasPrefix(req.UserAgent(), lbProbeUserAgentPrefix)
 }
-
-func newTunnelRPCClient(ctx context.Context, muxer *h2mux.Muxer, config *TunnelConfig, rpcName rpcName) (tunnelpogs.TunnelServer_PogsClient, error) {
-	openStreamCtx, openStreamCancel := context.WithTimeout(ctx, openStreamTimeout)
-	defer openStreamCancel()
-	stream, err := muxer.OpenRPCStream(openStreamCtx)
-	if err != nil {
-		return tunnelpogs.TunnelServer_PogsClient{}, err
-	}
-	rpcClient, err := connection.NewTunnelRPCClient(ctx, stream, config.TransportLogger)
-	if err != nil {
-		// RPC stream open error
-		return tunnelpogs.TunnelServer_PogsClient{}, newRPCError(err, config.Metrics.rpcFail, rpcName)
-	}
-	return rpcClient, nil
-}

tlsconfig/certreloader.go

@@ -65,9 +65,10 @@ func (cr *CertReloader) LoadCert() error {
 	return nil
 }
 
-func LoadOriginCA(originCAPoolFilename string, logger logger.Service) (*x509.CertPool, error) {
+func LoadOriginCA(c *cli.Context, logger logger.Service) (*x509.CertPool, error) {
 	var originCustomCAPool []byte
 
+	originCAPoolFilename := c.String(OriginCAPoolFlag)
 	if originCAPoolFilename != "" {
 		var err error
 		originCustomCAPool, err = ioutil.ReadFile(originCAPoolFilename)

tunneldns/tunnel.go

@@ -27,48 +27,6 @@ type Listener struct {
 	logger logger.Service
 }
 
-func Command(hidden bool) *cli.Command {
-	return &cli.Command{
-		Name:   "proxy-dns",
-		Action: cliutil.ErrorHandler(Run),
-		Usage:  "Run a DNS over HTTPS proxy server.",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "metrics",
-				Value:   "localhost:",
-				Usage:   "Listen address for metrics reporting.",
-				EnvVars: []string{"TUNNEL_METRICS"},
-			},
-			&cli.StringFlag{
-				Name:    "address",
-				Usage:   "Listen address for the DNS over HTTPS proxy server.",
-				Value:   "localhost",
-				EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
-			},
-			&cli.IntFlag{
-				Name:    "port",
-				Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-				Value:   53,
-				EnvVars: []string{"TUNNEL_DNS_PORT"},
-			},
-			&cli.StringSliceFlag{
-				Name:    "upstream",
-				Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-				Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-				EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
-			},
-			&cli.StringSliceFlag{
-				Name:    "bootstrap",
-				Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
-				Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
-				EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
-			},
-		},
-		ArgsUsage: " ", // can't be the empty string or we get the default output
-		Hidden:    hidden,
-	}
-}
-
 // Run implements a foreground runner
 func Run(c *cli.Context) error {
 	logDirectory, logLevel := config.FindLogSettings()

tunnelrpc/pogs/connectionrpc.go

@@ -7,9 +7,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	capnp "zombiezen.com/go/capnproto2"
 	"zombiezen.com/go/capnproto2/pogs"
-	"zombiezen.com/go/capnproto2/rpc"
 	"zombiezen.com/go/capnproto2/server"
 
 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -20,156 +18,6 @@ type RegistrationServer interface {
 	UnregisterConnection(ctx context.Context)
 }
 
-type RegistrationServer_PogsImpl struct {
-	impl RegistrationServer
-}
-
-func RegistrationServer_ServerToClient(s RegistrationServer) tunnelrpc.RegistrationServer {
-	return tunnelrpc.RegistrationServer_ServerToClient(RegistrationServer_PogsImpl{s})
-}
-
-func (i RegistrationServer_PogsImpl) RegisterConnection(p tunnelrpc.RegistrationServer_registerConnection) error {
-	server.Ack(p.Options)
-
-	auth, err := p.Params.Auth()
-	if err != nil {
-		return err
-	}
-	var pogsAuth TunnelAuth
-	err = pogsAuth.UnmarshalCapnproto(auth)
-	if err != nil {
-		return err
-	}
-	uuidBytes, err := p.Params.TunnelId()
-	if err != nil {
-		return err
-	}
-	tunnelID, err := uuid.FromBytes(uuidBytes)
-	if err != nil {
-		return err
-	}
-	connIndex := p.Params.ConnIndex()
-	options, err := p.Params.Options()
-	if err != nil {
-		return err
-	}
-	var pogsOptions ConnectionOptions
-	err = pogsOptions.UnmarshalCapnproto(options)
-	if err != nil {
-		return err
-	}
-
-	connDetails, callError := i.impl.RegisterConnection(p.Ctx, pogsAuth, tunnelID, connIndex, &pogsOptions)
-
-	resp, err := p.Results.NewResult()
-	if err != nil {
-		return err
-	}
-
-	if callError != nil {
-		if connError, err := resp.Result().NewError(); err != nil {
-			return err
-		} else {
-			return MarshalError(connError, callError)
-		}
-	}
-
-	if details, err := resp.Result().NewConnectionDetails(); err != nil {
-		return err
-	} else {
-		return connDetails.MarshalCapnproto(details)
-	}
-}
-
-func (i RegistrationServer_PogsImpl) UnregisterConnection(p tunnelrpc.RegistrationServer_unregisterConnection) error {
-	server.Ack(p.Options)
-
-	i.impl.UnregisterConnection(p.Ctx)
-	return nil
-}
-
-type RegistrationServer_PogsClient struct {
-	Client capnp.Client
-	Conn   *rpc.Conn
-}
-
-func (c RegistrationServer_PogsClient) RegisterConnection(ctx context.Context, auth TunnelAuth, tunnelID uuid.UUID, connIndex byte, options *ConnectionOptions) (*ConnectionDetails, error) {
-	client := tunnelrpc.TunnelServer{Client: c.Client}
-	promise := client.RegisterConnection(ctx, func(p tunnelrpc.RegistrationServer_registerConnection_Params) error {
-		tunnelAuth, err := p.NewAuth()
-		if err != nil {
-			return err
-		}
-		if err = auth.MarshalCapnproto(tunnelAuth); err != nil {
-			return err
-		}
-		err = p.SetAuth(tunnelAuth)
-		if err != nil {
-			return err
-		}
-		err = p.SetTunnelId(tunnelID[:])
-		if err != nil {
-			return err
-		}
-		p.SetConnIndex(connIndex)
-		connectionOptions, err := p.NewOptions()
-		if err != nil {
-			return err
-		}
-		err = options.MarshalCapnproto(connectionOptions)
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-	response, err := promise.Result().Struct()
-	if err != nil {
-		return nil, wrapRPCError(err)
-	}
-	result := response.Result()
-	switch result.Which() {
-	case tunnelrpc.ConnectionResponse_result_Which_error:
-		resultError, err := result.Error()
-		if err != nil {
-			return nil, wrapRPCError(err)
-		}
-		cause, err := resultError.Cause()
-		if err != nil {
-			return nil, wrapRPCError(err)
-		}
-		err = errors.New(cause)
-		if resultError.ShouldRetry() {
-			err = RetryErrorAfter(err, time.Duration(resultError.RetryAfter()))
-		}
-		return nil, err
-
-	case tunnelrpc.ConnectionResponse_result_Which_connectionDetails:
-		connDetails, err := result.ConnectionDetails()
-		if err != nil {
-			return nil, wrapRPCError(err)
-		}
-		details := new(ConnectionDetails)
-		if err = details.UnmarshalCapnproto(connDetails); err != nil {
-			return nil, wrapRPCError(err)
-		}
-		return details, nil
-	}
-
-	return nil, newRPCError("unknown result which %d", result.Which())
-}
-
-func (c RegistrationServer_PogsClient) UnregisterConnection(ctx context.Context) error {
-	client := tunnelrpc.TunnelServer{Client: c.Client}
-	promise := client.UnregisterConnection(ctx, func(p tunnelrpc.RegistrationServer_unregisterConnection_Params) error {
-		return nil
-	})
-	_, err := promise.Struct()
-	if err != nil {
-		return wrapRPCError(err)
-	}
-	return nil
-}
-
 type ClientInfo struct {
 	ClientID []byte `capnp:"clientId"` // must be a slice for capnp compatibility
 	Features []string
@@ -250,3 +98,140 @@ func MarshalError(s tunnelrpc.ConnectionError, err error) error {
 
 	return nil
 }
+
+func (i TunnelServer_PogsImpl) RegisterConnection(p tunnelrpc.RegistrationServer_registerConnection) error {
+	server.Ack(p.Options)
+
+	auth, err := p.Params.Auth()
+	if err != nil {
+		return err
+	}
+	var pogsAuth TunnelAuth
+	err = pogsAuth.UnmarshalCapnproto(auth)
+	if err != nil {
+		return err
+	}
+	uuidBytes, err := p.Params.TunnelId()
+	if err != nil {
+		return err
+	}
+	tunnelID, err := uuid.FromBytes(uuidBytes)
+	if err != nil {
+		return err
+	}
+	connIndex := p.Params.ConnIndex()
+	options, err := p.Params.Options()
+	if err != nil {
+		return err
+	}
+	var pogsOptions ConnectionOptions
+	err = pogsOptions.UnmarshalCapnproto(options)
+	if err != nil {
+		return err
+	}
+
+	connDetails, callError := i.impl.RegisterConnection(p.Ctx, pogsAuth, tunnelID, connIndex, &pogsOptions)
+
+	resp, err := p.Results.NewResult()
+	if err != nil {
+		return err
+	}
+
+	if callError != nil {
+		if connError, err := resp.Result().NewError(); err != nil {
+			return err
+		} else {
+			return MarshalError(connError, callError)
+		}
+	}
+
+	if details, err := resp.Result().NewConnectionDetails(); err != nil {
+		return err
+	} else {
+		return connDetails.MarshalCapnproto(details)
+	}
+}
+
+func (i TunnelServer_PogsImpl) UnregisterConnection(p tunnelrpc.RegistrationServer_unregisterConnection) error {
+	server.Ack(p.Options)
+
+	i.impl.UnregisterConnection(p.Ctx)
+	return nil
+}
+
+func (c TunnelServer_PogsClient) RegisterConnection(ctx context.Context, auth TunnelAuth, tunnelID uuid.UUID, connIndex byte, options *ConnectionOptions) (*ConnectionDetails, error) {
+	client := tunnelrpc.TunnelServer{Client: c.Client}
+	promise := client.RegisterConnection(ctx, func(p tunnelrpc.RegistrationServer_registerConnection_Params) error {
+		tunnelAuth, err := p.NewAuth()
+		if err != nil {
+			return err
+		}
+		if err = auth.MarshalCapnproto(tunnelAuth); err != nil {
+			return err
+		}
+		err = p.SetAuth(tunnelAuth)
+		if err != nil {
+			return err
+		}
+		err = p.SetTunnelId(tunnelID[:])
+		if err != nil {
+			return err
+		}
+		p.SetConnIndex(connIndex)
+		connectionOptions, err := p.NewOptions()
+		if err != nil {
+			return err
+		}
+		err = options.MarshalCapnproto(connectionOptions)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	response, err := promise.Result().Struct()
+	if err != nil {
+		return nil, wrapRPCError(err)
+	}
+	result := response.Result()
+	switch result.Which() {
+	case tunnelrpc.ConnectionResponse_result_Which_error:
+		resultError, err := result.Error()
+		if err != nil {
+			return nil, wrapRPCError(err)
+		}
+		cause, err := resultError.Cause()
+		if err != nil {
+			return nil, wrapRPCError(err)
+		}
+		err = errors.New(cause)
+		if resultError.ShouldRetry() {
+			err = RetryErrorAfter(err, time.Duration(resultError.RetryAfter()))
+		}
+		return nil, err
+
+	case tunnelrpc.ConnectionResponse_result_Which_connectionDetails:
+		connDetails, err := result.ConnectionDetails()
+		if err != nil {
+			return nil, wrapRPCError(err)
+		}
+		details := new(ConnectionDetails)
+		if err = details.UnmarshalCapnproto(connDetails); err != nil {
+			return nil, wrapRPCError(err)
+		}
+		return details, nil
+	}
+
+	return nil, newRPCError("unknown result which %d", result.Which())
+}
+
+func (c TunnelServer_PogsClient) UnregisterConnection(ctx context.Context) error {
+	client := tunnelrpc.TunnelServer{Client: c.Client}
+	promise := client.UnregisterConnection(ctx, func(p tunnelrpc.RegistrationServer_unregisterConnection_Params) error {
+		return nil
+	})
+	_, err := promise.Struct()
+	if err != nil {
+		return wrapRPCError(err)
+	}
+	return nil
+}

tunnelrpc/pogs/connectionrpc_test.go

@@ -62,10 +62,6 @@ func TestConnectionRegistrationRPC(t *testing.T) {
 	clientConn := rpc.NewConn(t2)
 	defer clientConn.Close()
 	client := TunnelServer_PogsClient{
-		RegistrationServer_PogsClient: RegistrationServer_PogsClient{
-			Client: clientConn.Bootstrap(ctx),
-			Conn:   clientConn,
-		},
 		Client: clientConn.Bootstrap(ctx),
 		Conn:   clientConn,
 	}

tunnelrpc/pogs/tunnelrpc.go

@@ -210,11 +210,10 @@ type TunnelServer interface {
 }
 
 func TunnelServer_ServerToClient(s TunnelServer) tunnelrpc.TunnelServer {
-	return tunnelrpc.TunnelServer_ServerToClient(TunnelServer_PogsImpl{RegistrationServer_PogsImpl{s}, s})
+	return tunnelrpc.TunnelServer_ServerToClient(TunnelServer_PogsImpl{s})
 }
 
 type TunnelServer_PogsImpl struct {
-	RegistrationServer_PogsImpl
 	impl TunnelServer
 }
 
@@ -269,7 +268,6 @@ func (i TunnelServer_PogsImpl) ObsoleteDeclarativeTunnelConnect(p tunnelrpc.Tunn
 }
 
 type TunnelServer_PogsClient struct {
-	RegistrationServer_PogsClient
 	Client capnp.Client
 	Conn   *rpc.Conn
 }

tunnelstore/client.go

@@ -376,12 +376,16 @@ func (r *RESTClient) sendRequest(method string, url url.URL, body interface{}) (
 func parseResponse(reader io.Reader, data interface{}) error {
 	// Schema for Tunnelstore responses in the v1 API.
 	// Roughly, it's a wrapper around a particular result that adds failures/errors/etc
-	var result response
+	var result struct {
+		Result  json.RawMessage `json:"result"`
+		Success bool            `json:"success"`
+		Errors  []string        `json:"errors"`
+	}
 	// First, parse the wrapper and check the API call succeeded
 	if err := json.NewDecoder(reader).Decode(&result); err != nil {
 		return errors.Wrap(err, "failed to decode response")
 	}
-	if err := result.checkErrors(); err != nil {
+	if err := checkErrors(result.Errors); err != nil {
 		return err
 	}
 	if !result.Success {
@@ -398,43 +402,24 @@ func unmarshalTunnel(reader io.Reader) (*Tunnel, error) {
 	return &tunnel, err
 }
 
-type response struct {
-	Success  bool            `json:"success,omitempty"`
-	Errors   []apiErr        `json:"errors,omitempty"`
-	Messages []string        `json:"messages,omitempty"`
-	Result   json.RawMessage `json:"result,omitempty"`
-}
-
-func (r *response) checkErrors() error {
-	if len(r.Errors) == 0 {
+func checkErrors(errs []string) error {
+	if len(errs) == 0 {
 		return nil
 	}
-	if len(r.Errors) == 1 {
-		return r.Errors[0]
+	if len(errs) == 1 {
+		return fmt.Errorf("API error: %s", errs[0])
 	}
-	var messages string
-	for _, e := range r.Errors {
-		messages += fmt.Sprintf("%s; ", e)
-	}
-	return fmt.Errorf("API errors: %s", messages)
-}
-
-type apiErr struct {
-	Code    json.Number `json:"code,omitempty"`
-	Message string      `json:"message,omitempty"`
-}
-
-func (e apiErr) Error() string {
-	return fmt.Sprintf("code: %v, reason: %s", e.Code, e.Message)
+	allErrs := strings.Join(errs, "; ")
+	return fmt.Errorf("API errors: %s", allErrs)
 }
 
 func (r *RESTClient) statusCodeToError(op string, resp *http.Response) error {
 	if resp.Header.Get("Content-Type") == "application/json" {
-		var errorsResp response
-		if json.NewDecoder(resp.Body).Decode(&errorsResp) == nil {
-			if err := errorsResp.checkErrors(); err != nil {
-				return errors.Errorf("Failed to %s: %s", op, err)
-			}
+		var errorsResp struct {
+			Error string `json:"error"`
+		}
+		if json.NewDecoder(resp.Body).Decode(&errorsResp) == nil && errorsResp.Error != "" {
+			return errors.Errorf("Failed to %s: %s", op, errorsResp.Error)
 		}
 	}
 

tunnelstore/client_test.go

@@ -30,8 +30,8 @@ func TestDNSRouteUnmarshalResult(t *testing.T) {
 	badJSON := []string{
 		`abc`,
 		`{"success": false, "result": {"cname": "new"}}`,
-		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"cname": "new"}}`,
-		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}, {"code": 1004, "message":"Cannot use tunnel as origin for non-proxied load balancer"}], "result": {"cname": "new"}}`,
+		`{"errors": ["foo"], "result": {"cname": "new"}}`,
+		`{"errors": ["foo", "bar"], "result": {"cname": "new"}}`,
 		`{"result": {"cname": "new"}}`,
 		`{"result": {"cname": "new"}}`,
 	}
@@ -60,8 +60,8 @@ func TestLBRouteUnmarshalResult(t *testing.T) {
 	badJSON := []string{
 		`abc`,
 		`{"success": false, "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
-		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
-		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}, {"code": 1004, "message":"Cannot use tunnel as origin for non-proxied load balancer"}], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
+		`{"errors": ["foo"], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
+		`{"errors": ["foo", "bar"], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 		`{"result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 	}
 
@@ -127,7 +127,7 @@ func Test_parseListTunnels(t *testing.T) {
 		},
 		{
 			name:    "errors are present",
-			args:    args{body: `{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": []}`},
+			args:    args{body: `{"errors": ["foo"], "result": []}`},
 			wantErr: true,
 		},
 		{
@@ -197,7 +197,7 @@ func TestUnmarshalTunnelErr(t *testing.T) {
 		`abc`,
 		`{"success": true, "result": abc}`,
 		`{"success": false, "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
-		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
+		`{"errors": ["foo"], "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
 	}
 
 	for i, test := range tests {

websocket/websocket.go

@@ -11,7 +11,6 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"net/url"
 	"time"
 
 	"github.com/cloudflare/cloudflared/h2mux"
@@ -70,31 +69,15 @@ func IsWebSocketUpgrade(req *http.Request) bool {
 	return websocket.IsWebSocketUpgrade(req)
 }
 
-// Dialler is something that can proxy websocket requests.
-type Dialler interface {
-	Dial(url *url.URL, headers http.Header) (*websocket.Conn, *http.Response, error)
-}
-
-type defaultDialler struct {
-	tlsConfig *tls.Config
-}
-
-func (dd *defaultDialler) Dial(url *url.URL, header http.Header) (*websocket.Conn, *http.Response, error) {
-	d := &websocket.Dialer{TLSClientConfig: dd.tlsConfig}
-	return d.Dial(url.String(), header)
-}
-
 // ClientConnect creates a WebSocket client connection for provided request. Caller is responsible for closing
 // the connection. The response body may not contain the entire response and does
 // not need to be closed by the application.
-func ClientConnect(req *http.Request, dialler Dialler) (*websocket.Conn, *http.Response, error) {
-	req.URL.Scheme = ChangeRequestScheme(req.URL)
+func ClientConnect(req *http.Request, tlsClientConfig *tls.Config) (*websocket.Conn, *http.Response, error) {
+	req.URL.Scheme = changeRequestScheme(req)
 	wsHeaders := websocketHeaders(req)
 
-	if dialler == nil {
-		dialler = new(defaultDialler)
-	}
-	conn, response, err := dialler.Dial(req.URL, wsHeaders)
+	d := &websocket.Dialer{TLSClientConfig: tlsClientConfig}
+	conn, response, err := d.Dial(req.URL.String(), wsHeaders)
 	if err != nil {
 		return nil, response, err
 	}
@@ -253,18 +236,16 @@ func generateAcceptKey(req *http.Request) string {
 	return sha1Base64(req.Header.Get("Sec-WebSocket-Key") + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11")
 }
 
-// ChangeRequestScheme is needed as the gorilla websocket library requires the ws scheme.
+// changeRequestScheme is needed as the gorilla websocket library requires the ws scheme.
 // (even though it changes it back to http/https, but ¯\_(ツ)_/¯.)
-func ChangeRequestScheme(reqURL *url.URL) string {
-	switch reqURL.Scheme {
+func changeRequestScheme(req *http.Request) string {
+	switch req.URL.Scheme {
 	case "https":
 		return "wss"
 	case "http":
 		return "ws"
-	case "":
-		return "ws"
 	default:
-		return reqURL.Scheme
+		return req.URL.Scheme
 	}
 }
 

websocket/websocket_test.go

@@ -77,8 +77,7 @@ func TestServe(t *testing.T) {
 
 	tlsConfig := websocketClientTLSConfig(t)
 	assert.NotNil(t, tlsConfig)
-	d := defaultDialler{tlsConfig: tlsConfig}
-	conn, resp, err := ClientConnect(req, &d)
+	conn, resp, err := ClientConnect(req, tlsConfig)
 	assert.NoError(t, err)
 	assert.Equal(t, testSecWebsocketAccept, resp.Header.Get("Sec-WebSocket-Accept"))