Release 2020.7.1

TUN-3161: Upgrade golang.org/x/ deps
AUTH-2850 log config file path
2026-08-07 23:31:56 +00:00 · 2020-07-06 11:47:37 -05:00 · 2020-07-06 16:42:48 +00:00 · 2020-07-06 16:32:57 +00:00 · 2020-07-02 16:51:04 +00:00 · 2020-07-01 14:50:38 -05:00
251 changed files with 21830 additions and 87531 deletions
@@ -2,7 +2,7 @@ images:
  - name: cloudflared
    dockerfile: Dockerfile
    context: .
-    verions:
+    versions:
    - latest
    registries:
    - name: docker.io/cloudflare
@@ -64,7 +64,4 @@ git config user.name "cloudflare-warp-bot"
 git config user.email "warp-bot@cloudflare.com"
 git commit -m "Release Argo Tunnel $VERSION"

-#git push -v origin master
-# don't push to master, push to some testing branch
-git checkout -b deploy-test
-git push -v origin deploy-test
+git push -v origin master
@@ -17,7 +17,9 @@ ifeq ($(EQUINOX_IS_DRAFT), true)
 endif

 LOCAL_ARCH ?= $(shell uname -m)
-ifeq ($(LOCAL_ARCH),x86_64)
+ifneq ($(GOARCH),)
+    TARGET_ARCH ?= $(GOARCH)
+else ifeq ($(LOCAL_ARCH),x86_64)
    TARGET_ARCH ?= amd64
 else ifeq ($(shell echo $(LOCAL_ARCH) | head -c 5),armv8)
    TARGET_ARCH ?= arm64
@@ -69,12 +71,20 @@ test: vet
 test-ssh-server:
 	docker-compose -f ssh_server_tests/docker-compose.yml up

-.PHONY: publish-deb
-publish-deb: cloudflared-deb
+define publish_package
 	for HOST in $(CF_PKG_HOSTS); do \
 		ssh-keyscan -t rsa $$HOST >> ~/.ssh/known_hosts; \
-		scp -4 cloudflared_$(VERSION)_amd64.deb cfsync@$$HOST:/state/cf-pkg/staging/apt/$(FLAVOR)/cloudflared/; \
+		scp -4 cloudflared_$(VERSION)_amd64.deb cfsync@$$HOST:/state/cf-pkg/staging/$(1)/$(FLAVOR)/cloudflared/; \
 	done
+endef
+
+.PHONY: publish-deb
+publish-deb: cloudflared-deb
+	$(call publish_package,apt)
+
+.PHONY: publish-rpm
+publish-rpm: cloudflared-rpm
+	$(call publish_package,yum)

 .PHONY: cloudflared-deb
 cloudflared-deb: cloudflared
@@ -83,6 +93,13 @@ cloudflared-deb: cloudflared
 	fakeroot fpm -C $(PACKAGE_DIR) -s dir -t deb --deb-compression bzip2 \
 		-a $(TARGET_ARCH) -v $(VERSION) -n cloudflared cloudflared=/usr/local/bin/

+.PHONY: cloudflared-rpm
+cloudflared-rpm: cloudflared
+	mkdir -p $(PACKAGE_DIR)
+	cp cloudflared $(PACKAGE_DIR)/cloudflared
+	fakeroot fpm -C $(PACKAGE_DIR) -s dir -t rpm --rpm-compression bzip2 \
+		-a $(TARGET_ARCH) -v $(VERSION) -n cloudflared cloudflared=/usr/local/bin/
+
 .PHONY: cloudflared-darwin-amd64.tgz
 cloudflared-darwin-amd64.tgz: cloudflared
 	tar czf cloudflared-darwin-amd64.tgz cloudflared
@@ -1,3 +1,14 @@
+2020.7.1
+- 2020-07-02 DEVTOOLS-7321: Push GitHub homebrew updates to master
+- 2020-07-06 TUN-3161: Upgrade golang.org/x/ deps
+- 2020-06-30 AUTH-2854: Create cloudflared RPMs
+- 2020-06-26 AUTH-2850 log config file path
+
+2020.7.0
+- 2020-06-30 TUN-3140: Add timestamps to terminal log entries
+- 2020-06-30 AUTH-2860: Fix builds
+- 2020-06-25 TUN-3007: Implement named tunnel connection registration and unregistration.
+
 2020.6.6
 - 2020-06-23 AUTH-2685: Adds script to create release
 - 2020-06-25 AUTH-2652: Update cloudflare repo
@@ -29,6 +29,7 @@ stretch: &stretch
      - build-essential
      - fakeroot
      - rubygem-fpm
+      - openssh-client
    post-cache:
      - export GOOS=linux
      - export GOARCH=amd64
@@ -169,6 +170,20 @@ jessie: *stretch

 buster: *stretch

+centos-7:
+  publish-rpm:
+    build_dir: *build_dir
+    builddeps:
+      - https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
+    post-cache:
+      - sudo yum install -y fakeroot
+      - wget https://golang.org/dl/go1.12.9.linux-amd64.tar.gz -P /tmp/
+      - sudo tar -C /usr/local -xzf /tmp/go1.12.9.linux-amd64.tar.gz
+      - export PATH=$PATH:/usr/local/go/bin
+      - export GOOS=linux
+      - export GOARCH=amd64
+      - make publish-rpm
+
 # cfsetup compose
 default-stack: test_dbconnect
 test_dbconnect:
@@ -106,7 +106,7 @@ func ssh(c *cli.Context) error {
 	wsConn := carrier.NewWSConnection(logger, false)

 	if c.NArg() > 0 || c.IsSet(sshURLFlag) {
-		localForwarder, err := config.ValidateUrl(c)
+		localForwarder, err := config.ValidateUrl(c, true)
 		if err != nil {
 			logger.Errorf("Error validating origin URL: %s", err)
 			return errors.Wrap(err, "error validating origin URL")
@@ -6,11 +6,12 @@ import (
 	"path/filepath"
 	"runtime"

-	"github.com/cloudflare/cloudflared/validation"
 	homedir "github.com/mitchellh/go-homedir"
 	"gopkg.in/urfave/cli.v2"
 	"gopkg.in/urfave/cli.v2/altsrc"
 	"gopkg.in/yaml.v2"
+
+	"github.com/cloudflare/cloudflared/validation"
 )

 var (
@@ -176,9 +177,9 @@ func ValidateUnixSocket(c *cli.Context) (string, error) {

 // ValidateUrl will validate url flag correctness. It can be either from --url or argument
 // Notice ValidateUnixSocket, it will enforce --unix-socket is not used with --url or argument
-func ValidateUrl(c *cli.Context) (string, error) {
+func ValidateUrl(c *cli.Context, allowFromArgs bool) (string, error) {
 	var url = c.String("url")
-	if c.NArg() > 0 {
+	if allowFromArgs && c.NArg() > 0 {
 		if c.IsSet("url") {
 			return "", errors.New("Specified origin urls using both --url and argument. Decide which one you want, I can only support one.")
 		}
@@ -188,6 +188,7 @@ func handleServiceMode(shutdownC chan struct{}) error {
 		logger.Errorf("Cannot setup config file for monitoring: %s", err)
 		return err
 	}
+	logger.Infof("monitoring config file at: %s", configPath)

 	serviceCallback := func(t string, name string, err error) {
 		if err != nil {
@@ -359,7 +359,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 			defer wg.Done()
 			hello.StartHelloWorldServer(logger, helloListener, shutdownC)
 		}()
-		c.Set("url", "https://"+helloListener.Addr().String())
+		forceSetFlag(c, "url", "https://"+helloListener.Addr().String())
 	}

 	if c.IsSet(sshServerFlag) {
@@ -409,7 +409,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 				close(shutdownC)
 			}
 		}()
-		c.Set("url", "ssh://"+localServerAddress)
+		forceSetFlag(c, "url", "ssh://"+localServerAddress)
 	}

 	url := c.String("url")
@@ -453,7 +453,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 			}
 			errC <- websocket.StartProxyServer(logger, listener, staticHost, shutdownC, streamHandler)
 		}()
-		c.Set("url", "http://"+listener.Addr().String())
+		forceSetFlag(c, "url", "http://"+listener.Addr().String())
 	}

 	transportLogger, err := createLogger(c, true)
@@ -461,7 +461,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 		return errors.Wrap(err, "error setting up transport logger")
 	}

-	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, version, logger, transportLogger)
+	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, version, logger, transportLogger, namedTunnel)
 	if err != nil {
 		return err
 	}
@@ -475,12 +475,21 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		errC <- origin.StartTunnelDaemon(ctx, tunnelConfig, connectedSignal, cloudflaredID, reconnectCh, namedTunnel)
+		errC <- origin.StartTunnelDaemon(ctx, tunnelConfig, connectedSignal, cloudflaredID, reconnectCh)
 	}()

 	return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, c.Duration("grace-period"), logger)
 }

+// forceSetFlag attempts to set the given flag value in the closest context that has it defined
+func forceSetFlag(c *cli.Context, name, value string) {
+	for _, ctx := range c.Lineage() {
+		if err := ctx.Set(name, value); err == nil {
+			break
+		}
+	}
+}
+
 func Before(c *cli.Context) error {
 	logger, err := createLogger(c, false)
 	if err != nil {
@@ -969,13 +978,6 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_USE_RECONNECT_TOKEN"},
 			Hidden:  true,
 		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "use-quick-reconnects",
-			Usage:   "Test reestablishing connections with the new 'connection digest' flow.",
-			Value:   true,
-			EnvVars: []string{"TUNNEL_USE_QUICK_RECONNECTS"},
-			Hidden:  true,
-		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
 			Name:    "dial-edge-timeout",
 			Usage:   "Maximum wait time to set up a connection with the edge",
@@ -158,7 +158,10 @@ func prepareTunnelConfig(
 	version string,
 	logger logger.Service,
 	transportLogger logger.Service,
+	namedTunnel *origin.NamedTunnelConfig,
 ) (*origin.TunnelConfig, error) {
+	compatibilityMode := namedTunnel == nil
+
 	hostname, err := validation.ValidateHostname(c.String("hostname"))
 	if err != nil {
 		logger.Errorf("Invalid hostname: %s", err)
@@ -181,7 +184,7 @@ func prepareTunnelConfig(

 	tags = append(tags, tunnelpogs.Tag{Name: "ID", Value: clientID})

-	originURL, err := config.ValidateUrl(c)
+	originURL, err := config.ValidateUrl(c, compatibilityMode)
 	if err != nil {
 		logger.Errorf("Error validating origin URL: %s", err)
 		return nil, errors.Wrap(err, "Error validating origin URL")
@@ -254,38 +257,52 @@ func prepareTunnelConfig(
 		return nil, errors.Wrap(err, "unable to create TLS config to connect with edge")
 	}

+	if namedTunnel != nil {
+		clientUUID, err := uuid.NewRandom()
+		if err != nil {
+			return nil, errors.Wrap(err, "can't generate clientUUID")
+		}
+		namedTunnel.Client = tunnelpogs.ClientInfo{
+			ClientID: clientUUID[:],
+			Features: []string{origin.FeatureSerializedHeaders},
+			Version:  version,
+			Arch:     fmt.Sprintf("%s_%s", buildInfo.GoOS, buildInfo.GoArch),
+		}
+	}
+
 	return &origin.TunnelConfig{
-		BuildInfo:            buildInfo,
-		ClientID:             clientID,
-		ClientTlsConfig:      httpTransport.TLSClientConfig,
-		CompressionQuality:   c.Uint64("compression-quality"),
-		EdgeAddrs:            c.StringSlice("edge"),
-		GracePeriod:          c.Duration("grace-period"),
-		HAConnections:        c.Int("ha-connections"),
-		HTTPTransport:        httpTransport,
-		HeartbeatInterval:    c.Duration("heartbeat-interval"),
-		Hostname:             hostname,
-		HTTPHostHeader:       c.String("http-host-header"),
-		IncidentLookup:       origin.NewIncidentLookup(),
-		IsAutoupdated:        c.Bool("is-autoupdated"),
-		IsFreeTunnel:         isFreeTunnel,
-		LBPool:               c.String("lb-pool"),
-		Logger:               logger,
-		TransportLogger:      transportLogger,
-		MaxHeartbeats:        c.Uint64("heartbeat-count"),
-		Metrics:              tunnelMetrics,
-		MetricsUpdateFreq:    c.Duration("metrics-update-freq"),
-		NoChunkedEncoding:    c.Bool("no-chunked-encoding"),
-		OriginCert:           originCert,
-		OriginUrl:            originURL,
-		ReportedVersion:      version,
-		Retries:              c.Uint("retries"),
-		RunFromTerminal:      isRunningFromTerminal(),
-		Tags:                 tags,
-		TlsConfig:            toEdgeTLSConfig,
-		UseDeclarativeTunnel: c.Bool("use-declarative-tunnels"),
-		UseReconnectToken:    c.Bool("use-reconnect-token"),
-		UseQuickReconnects:   c.Bool("use-quick-reconnects"),
+		BuildInfo:          buildInfo,
+		ClientID:           clientID,
+		ClientTlsConfig:    httpTransport.TLSClientConfig,
+		CompressionQuality: c.Uint64("compression-quality"),
+		EdgeAddrs:          c.StringSlice("edge"),
+		GracePeriod:        c.Duration("grace-period"),
+		HAConnections:      c.Int("ha-connections"),
+		HTTPTransport:      httpTransport,
+		HeartbeatInterval:  c.Duration("heartbeat-interval"),
+		Hostname:           hostname,
+		HTTPHostHeader:     c.String("http-host-header"),
+		IncidentLookup:     origin.NewIncidentLookup(),
+		IsAutoupdated:      c.Bool("is-autoupdated"),
+		IsFreeTunnel:       isFreeTunnel,
+		LBPool:             c.String("lb-pool"),
+		Logger:             logger,
+		TransportLogger:    transportLogger,
+		MaxHeartbeats:      c.Uint64("heartbeat-count"),
+		Metrics:            tunnelMetrics,
+		MetricsUpdateFreq:  c.Duration("metrics-update-freq"),
+		NoChunkedEncoding:  c.Bool("no-chunked-encoding"),
+		OriginCert:         originCert,
+		OriginUrl:          originURL,
+		ReportedVersion:    version,
+		Retries:            c.Uint("retries"),
+		RunFromTerminal:    isRunningFromTerminal(),
+		Tags:               tags,
+		TlsConfig:          toEdgeTLSConfig,
+		NamedTunnel:        namedTunnel,
+		ReplaceExisting:    c.Bool("force"),
+		// turn off use of reconnect token and auth refresh when using named tunnels
+		UseReconnectToken:  compatibilityMode && c.Bool("use-reconnect-token"),
 	}, nil
 }

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"

+	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"gopkg.in/urfave/cli.v2"
 	"gopkg.in/yaml.v2"
@@ -34,7 +35,7 @@ var (
 		Aliases: []string{"o"},
 		Usage:   "Render output using given `FORMAT`. Valid options are 'json' or 'yaml'",
 	}
-	forceFlag = &cli.StringFlag{
+	forceFlag = &cli.BoolFlag{
 		Name:    "force",
 		Aliases: []string{"f"},
 		Usage: "By default, if a tunnel is currently being run from a cloudflared, you can't " +
@@ -148,9 +149,12 @@ func readTunnelCredentials(tunnelID, originCertPath string) (*pogs.TunnelAuth, e
 	if err != nil {
 		return nil, errors.Wrapf(err, "couldn't read tunnel credentials from %v", filePath)
 	}
-	auth := pogs.TunnelAuth{}
-	err = json.Unmarshal(body, &auth)
-	return &auth, errors.Wrap(err, "couldn't parse tunnel credentials from JSON")
+
+	var auth pogs.TunnelAuth
+	if err = json.Unmarshal(body, &auth); err != nil {
+		return nil, err
+	}
+	return &auth, nil
 }

 func buildListCommand() *cli.Command {
@@ -325,6 +329,10 @@ func runTunnel(c *cli.Context) error {
 		return cliutil.UsageError(`"cloudflared tunnel run" requires exactly 1 argument, the ID of the tunnel to run.`)
 	}
 	id := c.Args().First()
+	tunnelID, err := uuid.Parse(id)
+	if err != nil {
+		return errors.Wrap(err, "error parsing tunnel ID")
+	}

 	logger, err := logger.New()
 	if err != nil {
@@ -340,5 +348,5 @@ func runTunnel(c *cli.Context) error {
 		return err
 	}
 	logger.Debugf("Read credentials for %v", credentials.AccountTag)
-	return StartServer(c, version, shutdownC, graceShutdownC, &origin.NamedTunnelConfig{Auth: *credentials, ID: id})
+	return StartServer(c, version, shutdownC, graceShutdownC, &origin.NamedTunnelConfig{Auth: *credentials, ID: tunnelID})
 }
@@ -57,11 +57,11 @@ require (
 	github.com/stretchr/testify v1.3.0
 	github.com/tinylib/msgp v1.1.0 // indirect
 	github.com/xo/dburl v0.0.0-20191005012637-293c3298d6c0
-	golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9
-	golang.org/x/net v0.0.0-20191014212845-da9a3fd4c582
+	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
+	golang.org/x/net v0.0.0-20200625001655-4c5254603344
 	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 // indirect
 	golang.org/x/sync v0.0.0-20190423024810-112230192c58
-	golang.org/x/sys v0.0.0-20191020212454-3e7259c5e7c2
+	golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae
 	google.golang.org/appengine v1.5.0 // indirect
 	google.golang.org/genproto v0.0.0-20191007204434-a023cd5227bd // indirect
 	google.golang.org/grpc v1.24.0 // indirect
@@ -206,6 +206,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 h1:vEg9joUBmeBcK9iSJftGNf3coIG4HqZElCPehJsfAYM=
 golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -224,6 +226,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191014212845-da9a3fd4c582 h1:p9xBe/w/OzkeYVKm234g55gMdD1nSIooTir5kV11kfA=
 golang.org/x/net v0.0.0-20191014212845-da9a3fd4c582/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344 h1:vGXIOMxbNfDTk/aXCmfdLgkrSV+Z2tcbze+pEc3v5W4=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be h1:vEDujvNQGv4jgYKudGeI/+DAX4Jffq6hpD55MmoEvKs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
@@ -245,6 +249,9 @@ golang.org/x/sys v0.0.0-20191008105621-543471e840be h1:QAcqgptGM8IQBC9K/RC4o+O9Y
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191020212454-3e7259c5e7c2 h1:nq114VpM8lsSlP+lyUbANecYHYiFcSNFtqcBlxRV+gA=
 golang.org/x/sys v0.0.0-20191020212454-3e7259c5e7c2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae h1:Ih9Yo4hSPImZOpfGuA4bR/ORKTAbhZo2AbWNRCnevdo=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
@@ -114,10 +114,12 @@ func New(opts ...Option) (Service, error) {
 	}

 	if !config.terminalOutputDisabled {
+		terminalFormatter := NewTerminalFormatter(time.RFC3339)
+
 		if len(config.supportedTerminalLevels) == 0 {
-			l.Add(os.Stderr, NewTerminalFormatter(""), InfoLevel, ErrorLevel, FatalLevel)
+			l.Add(os.Stderr, terminalFormatter, InfoLevel, ErrorLevel, FatalLevel)
 		} else {
-			l.Add(os.Stderr, NewTerminalFormatter(""), config.supportedTerminalLevels...)
+			l.Add(os.Stderr, terminalFormatter, config.supportedTerminalLevels...)
 		}
 	}
 	return l, nil
@@ -76,17 +76,18 @@ func NewTerminalFormatter(format string) Formatter {
 // Timestamp returns the log level with a matching color to the log type
 func (f *TerminalFormatter) Timestamp(l Level, d time.Time) string {
 	t := ""
+	dateStr := "[" + d.Format(f.format) + "] " 
 	switch l {
 	case InfoLevel:
-		t = f.output("[INFO] ", skittles.Cyan)
+		t = f.output("INFO", skittles.Cyan)
 	case ErrorLevel:
-		t = f.output("[ERROR] ", skittles.Red)
+		t = f.output("ERROR", skittles.Red)
 	case DebugLevel:
-		t = f.output("[DEBUG] ", skittles.Yellow)
+		t = f.output("DEBUG", skittles.Yellow)
 	case FatalLevel:
-		t = f.output("[FATAL] ", skittles.Red)
+		t = f.output("FATAL", skittles.Red)
 	}
-	return t
+	return t + dateStr
 }

 // Content just writes the log line straight to the sources
@@ -68,8 +68,6 @@ type Supervisor struct {
 	connDigest     map[uint8][]byte

 	bufferPool *buffer.Pool
-
-	namedTunnel *NamedTunnelConfig
 }

 type resolveResult struct {
@@ -82,7 +80,7 @@ type tunnelError struct {
 	err   error
 }

-func NewSupervisor(config *TunnelConfig, cloudflaredUUID uuid.UUID, namedTunnel *NamedTunnelConfig) (*Supervisor, error) {
+func NewSupervisor(config *TunnelConfig, cloudflaredUUID uuid.UUID) (*Supervisor, error) {
 	var (
 		edgeIPs *edgediscovery.Edge
 		err     error
@@ -95,6 +93,7 @@ func NewSupervisor(config *TunnelConfig, cloudflaredUUID uuid.UUID, namedTunnel
 	if err != nil {
 		return nil, err
 	}
+
 	return &Supervisor{
 		cloudflaredUUID:   cloudflaredUUID,
 		config:            config,
@@ -104,7 +103,6 @@ func NewSupervisor(config *TunnelConfig, cloudflaredUUID uuid.UUID, namedTunnel
 		logger:            config.Logger,
 		connDigest:        make(map[uint8][]byte),
 		bufferPool:        buffer.NewPool(512 * 1024),
-		namedTunnel:       namedTunnel,
 	}, nil
 }

@@ -229,17 +227,17 @@ func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal *sign
 		addr *net.TCPAddr
 		err  error
 	)
-	const thisConnID = 0
+	const firstConnIndex = 0
 	defer func() {
-		s.tunnelErrors <- tunnelError{index: thisConnID, addr: addr, err: err}
+		s.tunnelErrors <- tunnelError{index: firstConnIndex, addr: addr, err: err}
 	}()

-	addr, err = s.edgeIPs.GetAddr(thisConnID)
+	addr, err = s.edgeIPs.GetAddr(firstConnIndex)
 	if err != nil {
 		return
 	}

-	err = ServeTunnelLoop(ctx, s, s.config, addr, thisConnID, connectedSignal, s.cloudflaredUUID, s.bufferPool, reconnectCh)
+	err = ServeTunnelLoop(ctx, s, s.config, addr, firstConnIndex, connectedSignal, s.cloudflaredUUID, s.bufferPool, reconnectCh)
 	// If the first tunnel disconnects, keep restarting it.
 	edgeErrors := 0
 	for s.unusedIPs() {
@@ -257,12 +255,12 @@ func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal *sign
 			return
 		}
 		if edgeErrors >= 2 {
-			addr, err = s.edgeIPs.GetDifferentAddr(thisConnID)
+			addr, err = s.edgeIPs.GetDifferentAddr(firstConnIndex)
 			if err != nil {
 				return
 			}
 		}
-		err = ServeTunnelLoop(ctx, s, s.config, addr, thisConnID, connectedSignal, s.cloudflaredUUID, s.bufferPool, reconnectCh)
+		err = ServeTunnelLoop(ctx, s, s.config, addr, firstConnIndex, connectedSignal, s.cloudflaredUUID, s.bufferPool, reconnectCh)
 	}
 }

@@ -48,7 +48,7 @@ func TestRefreshAuthBackoff(t *testing.T) {
 		return time.After(d)
 	}

-	s, err := NewSupervisor(testConfig(logger), uuid.New(), nil)
+	s, err := NewSupervisor(testConfig(logger), uuid.New())
 	if !assert.NoError(t, err) {
 		t.FailNow()
 	}
@@ -92,7 +92,7 @@ func TestRefreshAuthSuccess(t *testing.T) {
 		return time.After(d)
 	}

-	s, err := NewSupervisor(testConfig(logger), uuid.New(), nil)
+	s, err := NewSupervisor(testConfig(logger), uuid.New())
 	if !assert.NoError(t, err) {
 		t.FailNow()
 	}
@@ -120,7 +120,7 @@ func TestRefreshAuthUnknown(t *testing.T) {
 		return time.After(d)
 	}

-	s, err := NewSupervisor(testConfig(logger), uuid.New(), nil)
+	s, err := NewSupervisor(testConfig(logger), uuid.New())
 	if !assert.NoError(t, err) {
 		t.FailNow()
 	}
@@ -142,7 +142,7 @@ func TestRefreshAuthUnknown(t *testing.T) {
 func TestRefreshAuthFail(t *testing.T) {
 	logger := logger.NewOutputWriter(logger.NewMockWriteManager())

-	s, err := NewSupervisor(testConfig(logger), uuid.New(), nil)
+	s, err := NewSupervisor(testConfig(logger), uuid.New())
 	if !assert.NoError(t, err) {
 		t.FailNow()
 	}
@@ -48,47 +48,46 @@ type registerRPCName string
 const (
 	register  registerRPCName = "register"
 	reconnect registerRPCName = "reconnect"
-	unknown   registerRPCName = "unknown"
 )

 type TunnelConfig struct {
-	BuildInfo            *buildinfo.BuildInfo
-	ClientID             string
-	ClientTlsConfig      *tls.Config
-	CloseConnOnce        *sync.Once // Used to close connectedSignal no more than once
-	CompressionQuality   uint64
-	EdgeAddrs            []string
-	GracePeriod          time.Duration
-	HAConnections        int
-	HTTPTransport        http.RoundTripper
-	HeartbeatInterval    time.Duration
-	Hostname             string
-	HTTPHostHeader       string
-	IncidentLookup       IncidentLookup
-	IsAutoupdated        bool
-	IsFreeTunnel         bool
-	LBPool               string
-	Logger               logger.Service
-	TransportLogger      logger.Service
-	MaxHeartbeats        uint64
-	Metrics              *TunnelMetrics
-	MetricsUpdateFreq    time.Duration
-	NoChunkedEncoding    bool
-	OriginCert           []byte
-	ReportedVersion      string
-	Retries              uint
-	RunFromTerminal      bool
-	Tags                 []tunnelpogs.Tag
-	TlsConfig            *tls.Config
-	UseDeclarativeTunnel bool
-	WSGI                 bool
+	BuildInfo          *buildinfo.BuildInfo
+	ClientID           string
+	ClientTlsConfig    *tls.Config
+	CloseConnOnce      *sync.Once // Used to close connectedSignal no more than once
+	CompressionQuality uint64
+	EdgeAddrs          []string
+	GracePeriod        time.Duration
+	HAConnections      int
+	HTTPTransport      http.RoundTripper
+	HeartbeatInterval  time.Duration
+	Hostname           string
+	HTTPHostHeader     string
+	IncidentLookup     IncidentLookup
+	IsAutoupdated      bool
+	IsFreeTunnel       bool
+	LBPool             string
+	Logger             logger.Service
+	TransportLogger    logger.Service
+	MaxHeartbeats      uint64
+	Metrics            *TunnelMetrics
+	MetricsUpdateFreq  time.Duration
+	NoChunkedEncoding  bool
+	OriginCert         []byte
+	ReportedVersion    string
+	Retries            uint
+	RunFromTerminal    bool
+	Tags               []tunnelpogs.Tag
+	TlsConfig          *tls.Config
+	WSGI               bool
 	// OriginUrl may not be used if a user specifies a unix socket.
 	OriginUrl string

 	// feature-flag to use new edge reconnect tokens
 	UseReconnectToken bool
-	// feature-flag for using ConnectionDigest
-	UseQuickReconnects bool
+
+	NamedTunnel     *NamedTunnelConfig
+	ReplaceExisting bool
 }

 // ReconnectTunnelCredentialManager is invoked by functions in this file to
@@ -103,6 +102,8 @@ type ReconnectTunnelCredentialManager interface {

 type dupConnRegisterTunnelError struct{}

+var errDuplicationConnection = &dupConnRegisterTunnelError{}
+
 func (e dupConnRegisterTunnelError) Error() string {
 	return "already connected to this server"
 }
@@ -171,21 +172,35 @@ func (c *TunnelConfig) RegistrationOptions(connectionID uint8, OriginLocalIP str
 	}
 }

-func (c *TunnelConfig) SupportedFeatures() []string {
-	basic := []string{FeatureSerializedHeaders}
-	if c.UseQuickReconnects {
-		basic = append(basic, FeatureQuickReconnects)
+func (c *TunnelConfig) ConnectionOptions(originLocalAddr string) *tunnelpogs.ConnectionOptions {
+	// attempt to parse out origin IP, but don't fail since it's informational field
+	host, _, _ := net.SplitHostPort(originLocalAddr)
+	originIP := net.ParseIP(host)
+
+	return &tunnelpogs.ConnectionOptions{
+		Client:             c.NamedTunnel.Client,
+		OriginLocalIP:      originIP,
+		ReplaceExisting:    c.ReplaceExisting,
+		CompressionQuality: uint8(c.CompressionQuality),
 	}
-	return basic
+}
+
+func (c *TunnelConfig) SupportedFeatures() []string {
+	features := []string{FeatureSerializedHeaders}
+	if c.NamedTunnel == nil {
+		features = append(features, FeatureQuickReconnects)
+	}
+	return features
 }

 type NamedTunnelConfig struct {
-	Auth pogs.TunnelAuth
-	ID   string
+	Auth   pogs.TunnelAuth
+	ID     uuid.UUID
+	Client pogs.ClientInfo
 }

-func StartTunnelDaemon(ctx context.Context, config *TunnelConfig, connectedSignal *signal.Signal, cloudflaredID uuid.UUID, reconnectCh chan ReconnectSignal, namedTunnel *NamedTunnelConfig) error {
-	s, err := NewSupervisor(config, cloudflaredID, namedTunnel)
+func StartTunnelDaemon(ctx context.Context, config *TunnelConfig, connectedSignal *signal.Signal, cloudflaredID uuid.UUID, reconnectCh chan ReconnectSignal) error {
+	s, err := NewSupervisor(config, cloudflaredID)
 	if err != nil {
 		return err
 	}
@@ -196,7 +211,7 @@ func ServeTunnelLoop(ctx context.Context,
 	credentialManager ReconnectTunnelCredentialManager,
 	config *TunnelConfig,
 	addr *net.TCPAddr,
-	connectionID uint8,
+	connectionIndex uint8,
 	connectedSignal *signal.Signal,
 	cloudflaredUUID uuid.UUID,
 	bufferPool *buffer.Pool,
@@ -219,7 +234,7 @@ func ServeTunnelLoop(ctx context.Context,
 			credentialManager,
 			config,
 			config.Logger,
-			addr, connectionID,
+			addr, connectionIndex,
 			connectedFuse,
 			&backoff,
 			cloudflaredUUID,
@@ -228,7 +243,7 @@ func ServeTunnelLoop(ctx context.Context,
 		)
 		if recoverable {
 			if duration, ok := backoff.GetBackoffDuration(ctx); ok {
-				config.Logger.Infof("Retrying in %s seconds: connectionID: %d", duration, connectionID)
+				config.Logger.Infof("Retrying connection %d in %s seconds", connectionIndex, duration)
 				backoff.Backoff(ctx)
 				continue
 			}
@@ -243,7 +258,7 @@ func ServeTunnel(
 	config *TunnelConfig,
 	logger logger.Service,
 	addr *net.TCPAddr,
-	connectionID uint8,
+	connectionIndex uint8,
 	connectedFuse *h2mux.BooleanFuse,
 	backoff *BackoffHandler,
 	cloudflaredUUID uuid.UUID,
@@ -262,22 +277,18 @@ func ServeTunnel(
 		}
 	}()

-	connectionTag := uint8ToString(connectionID)
-
-	// additional tags to send other than hostname which is set in cloudflared main package
-	tags := make(map[string]string)
-	tags["ha"] = connectionTag
+	connectionTag := uint8ToString(connectionIndex)

 	// Returns error from parsing the origin URL or handshake errors
-	handler, originLocalIP, err := NewTunnelHandler(ctx, config, addr, connectionID, bufferPool)
+	handler, originLocalAddr, err := NewTunnelHandler(ctx, config, addr, connectionIndex, bufferPool)
 	if err != nil {
 		switch err.(type) {
 		case connection.DialError:
-			logger.Errorf("Unable to dial edge: %s connectionID: %d", err, connectionID)
+			logger.Errorf("Connection %d unable to dial edge: %s", connectionIndex, err)
 		case h2mux.MuxerHandshakeError:
-			logger.Errorf("Handshake failed with edge server: %s connectionID: %d", err, connectionID)
+			logger.Errorf("Connection %d handshake with edge server failed: %s", connectionIndex, err)
 		default:
-			logger.Errorf("Tunnel creation failure: %s connectionID: %d", err, connectionID)
+			logger.Errorf("Connection %d failed: %s", connectionIndex, err)
 			return err, false
 		}
 		return err, true
@@ -293,20 +304,21 @@ func ServeTunnel(
 			}
 		}()

+		if config.NamedTunnel != nil {
+			return RegisterConnection(ctx, handler.muxer, config, connectionIndex, originLocalAddr)
+		}
+
 		if config.UseReconnectToken && connectedFuse.Value() {
 			token, tokenErr := credentialManager.ReconnectToken()
 			eventDigest, eventDigestErr := credentialManager.EventDigest()
 			// if we have both credentials, we can reconnect
 			if tokenErr == nil && eventDigestErr == nil {
 				var connDigest []byte
-
-				// check if we can use Quick Reconnects
-				if config.UseQuickReconnects {
-					if digest, connDigestErr := credentialManager.ConnDigest(connectionID); connDigestErr == nil {
-						connDigest = digest
-					}
+				if digest, connDigestErr := credentialManager.ConnDigest(connectionIndex); connDigestErr == nil {
+					connDigest = digest
 				}
-				return ReconnectTunnel(serveCtx, token, eventDigest, connDigest, handler.muxer, config, logger, connectionID, originLocalIP, cloudflaredUUID, credentialManager)
+
+				return ReconnectTunnel(serveCtx, token, eventDigest, connDigest, handler.muxer, config, logger, connectionIndex, originLocalAddr, cloudflaredUUID, credentialManager)
 			}
 			// log errors and proceed to RegisterTunnel
 			if tokenErr != nil {
@@ -316,7 +328,7 @@ func ServeTunnel(
 				logger.Errorf("Couldn't get event digest: %s", eventDigestErr)
 			}
 		}
-		return RegisterTunnel(serveCtx, credentialManager, handler.muxer, config, logger, connectionID, originLocalIP, cloudflaredUUID)
+		return RegisterTunnel(serveCtx, credentialManager, handler.muxer, config, logger, connectionIndex, originLocalAddr, cloudflaredUUID)
 	})

 	errGroup.Go(func() error {
@@ -325,12 +337,15 @@ func ServeTunnel(
 			select {
 			case <-serveCtx.Done():
 				// UnregisterTunnel blocks until the RPC call returns
-				var err error
 				if connectedFuse.Value() {
-					err = UnregisterTunnel(handler.muxer, config.GracePeriod, config.TransportLogger)
+					if config.NamedTunnel != nil {
+						_ = UnregisterConnection(ctx, handler.muxer, config)
+					} else {
+						_ = UnregisterTunnel(handler.muxer, config.GracePeriod, config.TransportLogger)
+					}
 				}
 				handler.muxer.Shutdown()
-				return err
+				return nil
 			case <-updateMetricsTickC:
 				handler.UpdateMetrics(connectionTag)
 			}
@@ -361,8 +376,6 @@ func ServeTunnel(

 	err = errGroup.Wait()
 	if err != nil {
-		_ = newClientRegisterTunnelError(err, config.Metrics.regFail, unknown)
-
 		switch castedErr := err.(type) {
 		case dupConnRegisterTunnelError:
 			logger.Info("Already connected to this server, selecting a different one")
@@ -382,7 +395,7 @@ func ServeTunnel(
 			logger.Info("Muxer shutdown")
 			return err, true
 		case *ReconnectSignal:
-			logger.Infof("Restarting due to reconnect signal in %d seconds", castedErr.Delay)
+			logger.Infof("Restarting connection %d due to reconnect signal in %d seconds", connectionIndex, castedErr.Delay)
 			castedErr.DelayBeforeReconnect()
 			return err, true
 		default:
@@ -393,6 +406,74 @@ func ServeTunnel(
 	return nil, true
 }

+func RegisterConnection(
+	ctx context.Context,
+	muxer *h2mux.Muxer,
+	config *TunnelConfig,
+	connectionIndex uint8,
+	originLocalAddr string,
+) error {
+	const registerConnection = "registerConnection"
+
+	config.TransportLogger.Debug("initiating RPC stream for RegisterConnection")
+	rpc, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
+	if err != nil {
+		// RPC stream open error
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, registerConnection)
+	}
+	defer rpc.Close()
+
+	conn, err := rpc.RegisterConnection(
+		ctx,
+		config.NamedTunnel.Auth,
+		config.NamedTunnel.ID,
+		connectionIndex,
+		config.ConnectionOptions(originLocalAddr),
+	)
+	if err != nil {
+		if err.Error() == DuplicateConnectionError {
+			config.Metrics.regFail.WithLabelValues("dup_edge_conn", registerConnection).Inc()
+			return errDuplicationConnection
+		}
+		config.Metrics.regFail.WithLabelValues("server_error", registerConnection).Inc()
+		return serverRegistrationErrorFromRPC(err)
+	}
+
+	config.Metrics.regSuccess.WithLabelValues(registerConnection).Inc()
+	config.Logger.Infof("Connection %d registered with %s using ID %s", connectionIndex, conn.Location, conn.UUID)
+
+	return nil
+}
+
+func serverRegistrationErrorFromRPC(err error) *serverRegisterTunnelError {
+	if retryable, ok := err.(*tunnelpogs.RetryableError); ok {
+		return &serverRegisterTunnelError{
+			cause:     retryable.Unwrap(),
+			permanent: false,
+		}
+	}
+	return &serverRegisterTunnelError{
+		cause:     err,
+		permanent: true,
+	}
+}
+
+func UnregisterConnection(
+	ctx context.Context,
+	muxer *h2mux.Muxer,
+	config *TunnelConfig,
+) error {
+	config.TransportLogger.Debug("initiating RPC stream for UnregisterConnection")
+	rpc, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
+	if err != nil {
+		// RPC stream open error
+		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, register)
+	}
+	defer rpc.Close()
+
+	return rpc.UnregisterConnection(ctx)
+}
+
 func RegisterTunnel(
 	ctx context.Context,
 	credentialManager ReconnectTunnelCredentialManager,
@@ -437,7 +518,7 @@ func ReconnectTunnel(
 	config *TunnelConfig,
 	logger logger.Service,
 	connectionID uint8,
-	originLocalIP string,
+	originLocalAddr string,
 	uuid uuid.UUID,
 	credentialManager ReconnectTunnelCredentialManager,
 ) error {
@@ -459,7 +540,7 @@ func ReconnectTunnel(
 		eventDigest,
 		connDigest,
 		config.Hostname,
-		config.RegistrationOptions(connectionID, originLocalIP, uuid),
+		config.RegistrationOptions(connectionID, originLocalAddr, uuid),
 	)
 	if registrationErr := registration.DeserializeError(); registrationErr != nil {
 		// ReconnectTunnel RPC failure
@@ -508,11 +589,11 @@ func processRegistrationSuccess(
 func processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, metrics *TunnelMetrics, name registerRPCName) error {
 	if err.Error() == DuplicateConnectionError {
 		metrics.regFail.WithLabelValues("dup_edge_conn", string(name)).Inc()
-		return dupConnRegisterTunnelError{}
+		return errDuplicationConnection
 	}
 	metrics.regFail.WithLabelValues("server_error", string(name)).Inc()
 	return serverRegisterTunnelError{
-		cause:     fmt.Errorf("Server error: %s", err.Error()),
+		cause:     err,
 		permanent: err.IsPermanent(),
 	}
 }
@@ -223,7 +223,7 @@ func (c TunnelServer_PogsClient) RegisterConnection(ctx context.Context, auth Tu
 	return nil, newRPCError("unknown result which %d", result.Which())
 }

-func (c TunnelServer_PogsClient) Unregister(ctx context.Context) error {
+func (c TunnelServer_PogsClient) UnregisterConnection(ctx context.Context) error {
 	client := tunnelrpc.TunnelServer{Client: c.Client}
 	promise := client.UnregisterConnection(ctx, func(p tunnelrpc.RegistrationServer_unregisterConnection_Params) error {
 		return nil
@@ -36,7 +36,7 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {

 	// during the authentication phase the client first attempts the "none" method
 	// then any untried methods suggested by the server.
-	tried := make(map[string]bool)
+	var tried []string
 	var lastMethods []string

 	sessionID := c.transport.getSessionID()
@@ -49,7 +49,9 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 			// success
 			return nil
 		} else if ok == authFailure {
-			tried[auth.method()] = true
+			if m := auth.method(); !contains(tried, m) {
+				tried = append(tried, m)
+			}
 		}
 		if methods == nil {
 			methods = lastMethods
@@ -61,7 +63,7 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 	findNext:
 		for _, a := range config.Auth {
 			candidateMethod := a.method()
-			if tried[candidateMethod] {
+			if contains(tried, candidateMethod) {
 				continue
 			}
 			for _, meth := range methods {
@@ -72,16 +74,16 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 			}
 		}
 	}
-	return fmt.Errorf("ssh: unable to authenticate, attempted methods %v, no supported methods remain", keys(tried))
+	return fmt.Errorf("ssh: unable to authenticate, attempted methods %v, no supported methods remain", tried)
 }

-func keys(m map[string]bool) []string {
-	s := make([]string, 0, len(m))
-
-	for key := range m {
-		s = append(s, key)
+func contains(list []string, e string) bool {
+	for _, s := range list {
+		if s == e {
+			return true
+		}
 	}
-	return s
+	return false
 }

 // An AuthMethod represents an instance of an RFC 4252 authentication method.
@@ -107,6 +107,7 @@ func (p *clientConnPool) getClientConn(req *http.Request, addr string, dialOnMis

 // dialCall is an in-flight Transport dial call to a host.
 type dialCall struct {
+	_    incomparable
 	p    *clientConnPool
 	done chan struct{} // closed when done
 	res  *ClientConn   // valid after done is closed
@@ -180,6 +181,7 @@ func (p *clientConnPool) addConnIfNeeded(key string, t *Transport, c *tls.Conn)
 }

 type addConnCall struct {
+	_    incomparable
 	p    *clientConnPool
 	done chan struct{} // closed when done
 	err  error
@@ -200,12 +202,6 @@ func (c *addConnCall) run(t *Transport, key string, tc *tls.Conn) {
 	close(c.done)
 }

-func (p *clientConnPool) addConn(key string, cc *ClientConn) {
-	p.mu.Lock()
-	p.addConnLocked(key, cc)
-	p.mu.Unlock()
-}
-
 // p.mu must be held
 func (p *clientConnPool) addConnLocked(key string, cc *ClientConn) {
 	for _, v := range p.conns[key] {
@@ -8,6 +8,8 @@ package http2

 // flow is the flow control window's size.
 type flow struct {
+	_ incomparable
+
 	// n is the number of DATA bytes we're allowed to send.
 	// A flow is kept both on a conn and a per-stream.
 	n int32
@@ -105,7 +105,14 @@ func huffmanDecode(buf *bytes.Buffer, maxLen int, v []byte) error {
 	return nil
 }

+// incomparable is a zero-width, non-comparable type. Adding it to a struct
+// makes that struct also non-comparable, and generally doesn't add
+// any size (as long as it's first).
+type incomparable [0]func()
+
 type node struct {
+	_ incomparable
+
 	// children is non-nil for internal nodes
 	children *[256]*node

@@ -19,7 +19,6 @@ package http2 // import "golang.org/x/net/http2"
 import (
 	"bufio"
 	"crypto/tls"
-	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -173,11 +172,6 @@ func (s SettingID) String() string {
 	return fmt.Sprintf("UNKNOWN_SETTING_%d", uint16(s))
 }

-var (
-	errInvalidHeaderFieldName  = errors.New("http2: invalid header field name")
-	errInvalidHeaderFieldValue = errors.New("http2: invalid header field value")
-)
-
 // validWireHeaderFieldName reports whether v is a valid header field
 // name (key). See httpguts.ValidHeaderName for the base rules.
 //
@@ -247,6 +241,7 @@ func (cw closeWaiter) Wait() {
 // Its buffered writer is lazily allocated as needed, to minimize
 // idle memory usage with many connections.
 type bufferedWriter struct {
+	_  incomparable
 	w  io.Writer     // immutable
 	bw *bufio.Writer // non-nil when data is buffered
 }
@@ -319,6 +314,7 @@ func bodyAllowedForStatus(status int) bool {
 }

 type httpError struct {
+	_       incomparable
 	msg     string
 	timeout bool
 }
@@ -382,3 +378,8 @@ func (s *sorter) SortStrings(ss []string) {
 func validPseudoPath(v string) bool {
 	return (len(v) > 0 && v[0] == '/') || v == "*"
 }
+
+// incomparable is a zero-width, non-comparable type. Adding it to a struct
+// makes that struct also non-comparable, and generally doesn't add
+// any size (as long as it's first).
+type incomparable [0]func()
@@ -252,7 +252,7 @@ func ConfigureServer(s *http.Server, conf *Server) error {
 			}
 		}
 		if !haveRequired {
-			return fmt.Errorf("http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher.")
+			return fmt.Errorf("http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256).")
 		}
 	}

@@ -581,13 +581,10 @@ type stream struct {
 	cancelCtx func()

 	// owned by serverConn's serve loop:
-	bodyBytes        int64   // body bytes seen so far
-	declBodyBytes    int64   // or -1 if undeclared
-	flow             flow    // limits writing from Handler to client
-	inflow           flow    // what the client is allowed to POST/etc to us
-	parent           *stream // or nil
-	numTrailerValues int64
-	weight           uint8
+	bodyBytes        int64 // body bytes seen so far
+	declBodyBytes    int64 // or -1 if undeclared
+	flow             flow  // limits writing from Handler to client
+	inflow           flow  // what the client is allowed to POST/etc to us
 	state            streamState
 	resetQueued      bool        // RST_STREAM queued for write; set by sc.resetStream
 	gotTrailerHeader bool        // HEADER frame for trailers was seen
@@ -764,6 +761,7 @@ func (sc *serverConn) readFrames() {

 // frameWriteResult is the message passed from writeFrameAsync to the serve goroutine.
 type frameWriteResult struct {
+	_   incomparable
 	wr  FrameWriteRequest // what was written (or attempted)
 	err error             // result of the writeFrame call
 }
@@ -774,7 +772,7 @@ type frameWriteResult struct {
 // serverConn.
 func (sc *serverConn) writeFrameAsync(wr FrameWriteRequest) {
 	err := wr.write.writeFrame(sc)
-	sc.wroteFrameCh <- frameWriteResult{wr, err}
+	sc.wroteFrameCh <- frameWriteResult{wr: wr, err: err}
 }

 func (sc *serverConn) closeAllStreamsOnConnClose() {
@@ -1164,7 +1162,7 @@ func (sc *serverConn) startFrameWrite(wr FrameWriteRequest) {
 	if wr.write.staysWithinBuffer(sc.bw.Available()) {
 		sc.writingFrameAsync = false
 		err := wr.write.writeFrame(sc)
-		sc.wroteFrame(frameWriteResult{wr, err})
+		sc.wroteFrame(frameWriteResult{wr: wr, err: err})
 	} else {
 		sc.writingFrameAsync = true
 		go sc.writeFrameAsync(wr)
@@ -2060,7 +2058,7 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r
 	var trailer http.Header
 	for _, v := range rp.header["Trailer"] {
 		for _, key := range strings.Split(v, ",") {
-			key = http.CanonicalHeaderKey(strings.TrimSpace(key))
+			key = http.CanonicalHeaderKey(textproto.TrimString(key))
 			switch key {
 			case "Transfer-Encoding", "Trailer", "Content-Length":
 				// Bogus. (copy of http1 rules)
@@ -2278,6 +2276,7 @@ func (sc *serverConn) sendWindowUpdate32(st *stream, n int32) {
 // requestBody is the Handler's Request.Body type.
 // Read and Close may be called concurrently.
 type requestBody struct {
+	_             incomparable
 	stream        *stream
 	conn          *serverConn
 	closed        bool  // for use by Close only
@@ -93,7 +93,7 @@ type Transport struct {
 	// send in the initial settings frame. It is how many bytes
 	// of response headers are allowed. Unlike the http2 spec, zero here
 	// means to use a default limit (currently 10MB). If you actually
-	// want to advertise an ulimited value to the peer, Transport
+	// want to advertise an unlimited value to the peer, Transport
 	// interprets the highest possible value here (0xffffffff or 1<<32-1)
 	// to mean no limit.
 	MaxHeaderListSize uint32
@@ -108,6 +108,19 @@ type Transport struct {
 	// waiting for their turn.
 	StrictMaxConcurrentStreams bool

+	// ReadIdleTimeout is the timeout after which a health check using ping
+	// frame will be carried out if no frame is received on the connection.
+	// Note that a ping response will is considered a received frame, so if
+	// there is no other traffic on the connection, the health check will
+	// be performed every ReadIdleTimeout interval.
+	// If zero, no health check is performed.
+	ReadIdleTimeout time.Duration
+
+	// PingTimeout is the timeout after which the connection will be closed
+	// if a response to Ping is not received.
+	// Defaults to 15s.
+	PingTimeout time.Duration
+
 	// t1, if non-nil, is the standard library Transport using
 	// this transport. Its settings are used (but not its
 	// RoundTrip method, etc).
@@ -131,6 +144,14 @@ func (t *Transport) disableCompression() bool {
 	return t.DisableCompression || (t.t1 != nil && t.t1.DisableCompression)
 }

+func (t *Transport) pingTimeout() time.Duration {
+	if t.PingTimeout == 0 {
+		return 15 * time.Second
+	}
+	return t.PingTimeout
+
+}
+
 // ConfigureTransport configures a net/http HTTP/1 Transport to use HTTP/2.
 // It returns an error if t1 has already been HTTP/2-enabled.
 func ConfigureTransport(t1 *http.Transport) error {
@@ -227,6 +248,7 @@ type ClientConn struct {
 	br              *bufio.Reader
 	fr              *Framer
 	lastActive      time.Time
+	lastIdle        time.Time // time last idle
 	// Settings from peer: (also guarded by mu)
 	maxFrameSize          uint32
 	maxConcurrentStreams  uint32
@@ -674,6 +696,20 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 	return cc, nil
 }

+func (cc *ClientConn) healthCheck() {
+	pingTimeout := cc.t.pingTimeout()
+	// We don't need to periodically ping in the health check, because the readLoop of ClientConn will
+	// trigger the healthCheck again if there is no frame received.
+	ctx, cancel := context.WithTimeout(context.Background(), pingTimeout)
+	defer cancel()
+	err := cc.Ping(ctx)
+	if err != nil {
+		cc.closeForLostPing()
+		cc.t.connPool().MarkDead(cc)
+		return
+	}
+}
+
 func (cc *ClientConn) setGoAway(f *GoAwayFrame) {
 	cc.mu.Lock()
 	defer cc.mu.Unlock()
@@ -736,7 +772,8 @@ func (cc *ClientConn) idleStateLocked() (st clientConnIdleState) {
 	}

 	st.canTakeNewRequest = cc.goAway == nil && !cc.closed && !cc.closing && maxConcurrentOkay &&
-		int64(cc.nextStreamID)+2*int64(cc.pendingRequests) < math.MaxInt32
+		int64(cc.nextStreamID)+2*int64(cc.pendingRequests) < math.MaxInt32 &&
+		!cc.tooIdleLocked()
 	st.freshConn = cc.nextStreamID == 1 && st.canTakeNewRequest
 	return
 }
@@ -746,6 +783,16 @@ func (cc *ClientConn) canTakeNewRequestLocked() bool {
 	return st.canTakeNewRequest
 }

+// tooIdleLocked reports whether this connection has been been sitting idle
+// for too much wall time.
+func (cc *ClientConn) tooIdleLocked() bool {
+	// The Round(0) strips the monontonic clock reading so the
+	// times are compared based on their wall time. We don't want
+	// to reuse a connection that's been sitting idle during
+	// VM/laptop suspend if monotonic time was also frozen.
+	return cc.idleTimeout != 0 && !cc.lastIdle.IsZero() && time.Since(cc.lastIdle.Round(0)) > cc.idleTimeout
+}
+
 // onIdleTimeout is called from a time.AfterFunc goroutine. It will
 // only be called when we're idle, but because we're coming from a new
 // goroutine, there could be a new request coming in at the same time,
@@ -834,14 +881,12 @@ func (cc *ClientConn) sendGoAway() error {
 	return nil
 }

-// Close closes the client connection immediately.
-//
-// In-flight requests are interrupted. For a graceful shutdown, use Shutdown instead.
-func (cc *ClientConn) Close() error {
+// closes the client connection immediately. In-flight requests are interrupted.
+// err is sent to streams.
+func (cc *ClientConn) closeForError(err error) error {
 	cc.mu.Lock()
 	defer cc.cond.Broadcast()
 	defer cc.mu.Unlock()
-	err := errors.New("http2: client connection force closed via ClientConn.Close")
 	for id, cs := range cc.streams {
 		select {
 		case cs.resc <- resAndError{err: err}:
@@ -854,6 +899,20 @@ func (cc *ClientConn) Close() error {
 	return cc.tconn.Close()
 }

+// Close closes the client connection immediately.
+//
+// In-flight requests are interrupted. For a graceful shutdown, use Shutdown instead.
+func (cc *ClientConn) Close() error {
+	err := errors.New("http2: client connection force closed via ClientConn.Close")
+	return cc.closeForError(err)
+}
+
+// closes the client connection immediately. In-flight requests are interrupted.
+func (cc *ClientConn) closeForLostPing() error {
+	err := errors.New("http2: client connection lost")
+	return cc.closeForError(err)
+}
+
 const maxAllocFrameSize = 512 << 10

 // frameBuffer returns a scratch buffer suitable for writing DATA frames.
@@ -904,7 +963,7 @@ func commaSeparatedTrailers(req *http.Request) (string, error) {
 		k = http.CanonicalHeaderKey(k)
 		switch k {
 		case "Transfer-Encoding", "Trailer", "Content-Length":
-			return "", &badStringError{"invalid Trailer key", k}
+			return "", fmt.Errorf("invalid Trailer key %q", k)
 		}
 		keys = append(keys, k)
 	}
@@ -1150,6 +1209,7 @@ func (cc *ClientConn) awaitOpenSlotForRequest(req *http.Request) error {
 			}
 			return errClientConnUnusable
 		}
+		cc.lastIdle = time.Time{}
 		if int64(len(cc.streams))+1 <= int64(cc.maxConcurrentStreams) {
 			if waitingForConn != nil {
 				close(waitingForConn)
@@ -1381,13 +1441,6 @@ func (cs *clientStream) awaitFlowControl(maxBytes int) (taken int32, err error)
 	}
 }

-type badStringError struct {
-	what string
-	str  string
-}
-
-func (e *badStringError) Error() string { return fmt.Sprintf("%s %q", e.what, e.str) }
-
 // requires cc.mu be held.
 func (cc *ClientConn) encodeHeaders(req *http.Request, addGzipHeader bool, trailers string, contentLength int64) ([]byte, error) {
 	cc.hbuf.Reset()
@@ -1603,6 +1656,7 @@ func (cc *ClientConn) writeHeader(name, value string) {
 }

 type resAndError struct {
+	_   incomparable
 	res *http.Response
 	err error
 }
@@ -1638,6 +1692,7 @@ func (cc *ClientConn) streamByID(id uint32, andRemove bool) *clientStream {
 		delete(cc.streams, id)
 		if len(cc.streams) == 0 && cc.idleTimer != nil {
 			cc.idleTimer.Reset(cc.idleTimeout)
+			cc.lastIdle = time.Now()
 		}
 		close(cs.done)
 		// Wake up checkResetOrDone via clientStream.awaitFlowControl and
@@ -1649,6 +1704,7 @@ func (cc *ClientConn) streamByID(id uint32, andRemove bool) *clientStream {

 // clientConnReadLoop is the state owned by the clientConn's frame-reading readLoop.
 type clientConnReadLoop struct {
+	_             incomparable
 	cc            *ClientConn
 	closeWhenIdle bool
 }
@@ -1728,8 +1784,17 @@ func (rl *clientConnReadLoop) run() error {
 	rl.closeWhenIdle = cc.t.disableKeepAlives() || cc.singleUse
 	gotReply := false // ever saw a HEADERS reply
 	gotSettings := false
+	readIdleTimeout := cc.t.ReadIdleTimeout
+	var t *time.Timer
+	if readIdleTimeout != 0 {
+		t = time.AfterFunc(readIdleTimeout, cc.healthCheck)
+		defer t.Stop()
+	}
 	for {
 		f, err := cc.fr.ReadFrame()
+		if t != nil {
+			t.Reset(readIdleTimeout)
+		}
 		if err != nil {
 			cc.vlogf("http2: Transport readFrame error on conn %p: (%T) %v", cc, err, err)
 		}
@@ -1878,7 +1943,9 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 		return nil, errors.New("malformed response from server: malformed non-numeric status pseudo header")
 	}

-	header := make(http.Header)
+	regularFields := f.RegularFields()
+	strs := make([]string, len(regularFields))
+	header := make(http.Header, len(regularFields))
 	res := &http.Response{
 		Proto:      "HTTP/2.0",
 		ProtoMajor: 2,
@@ -1886,7 +1953,7 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 		StatusCode: statusCode,
 		Status:     status + " " + http.StatusText(statusCode),
 	}
-	for _, hf := range f.RegularFields() {
+	for _, hf := range regularFields {
 		key := http.CanonicalHeaderKey(hf.Name)
 		if key == "Trailer" {
 			t := res.Trailer
@@ -1898,7 +1965,18 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 				t[http.CanonicalHeaderKey(v)] = nil
 			})
 		} else {
-			header[key] = append(header[key], hf.Value)
+			vv := header[key]
+			if vv == nil && len(strs) > 0 {
+				// More than likely this will be a single-element key.
+				// Most headers aren't multi-valued.
+				// Set the capacity on strs[0] to 1, so any future append
+				// won't extend the slice into the other strings.
+				vv, strs = strs[:1:1], strs[1:]
+				vv[0] = hf.Value
+				header[key] = vv
+			} else {
+				header[key] = append(vv, hf.Value)
+			}
 		}
 	}

@@ -2184,8 +2262,6 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 	return nil
 }

-var errInvalidTrailers = errors.New("http2: invalid trailers")
-
 func (rl *clientConnReadLoop) endStream(cs *clientStream) {
 	// TODO: check that any declared content-length matches, like
 	// server.go's (*stream).endStream method.
@@ -2416,7 +2492,6 @@ func (cc *ClientConn) writeStreamReset(streamID uint32, code ErrCode, err error)
 var (
 	errResponseHeaderListSize = errors.New("http2: response header list larger than advertised limit")
 	errRequestHeaderListSize  = errors.New("http2: request header list larger than peer's advertised limit")
-	errPseudoTrailers         = errors.New("http2: invalid pseudo header in trailers")
 )

 func (cc *ClientConn) logf(format string, args ...interface{}) {
@@ -2455,6 +2530,7 @@ func (rt erringRoundTripper) RoundTrip(*http.Request) (*http.Response, error) {
 // gzipReader wraps a response body so it can lazily
 // call gzip.NewReader on the first call to Read
 type gzipReader struct {
+	_    incomparable
 	body io.ReadCloser // underlying Response.Body
 	zr   *gzip.Reader  // lazily-initialized gzip reader
 	zerr error         // sticky error
@@ -1,6 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.

-// +build go1.13
+// +build go1.13,!go1.14

 package idna

@@ -0,0 +1,12 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !race
+
+package socket
+
+func (m *Message) raceRead() {
+}
+func (m *Message) raceWrite() {
+}
@@ -0,0 +1,37 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build race
+
+package socket
+
+import (
+	"runtime"
+	"unsafe"
+)
+
+// This package reads and writes the Message buffers using a
+// direct system call, which the race detector can't see.
+// These functions tell the race detector what is going on during the syscall.
+
+func (m *Message) raceRead() {
+	for _, b := range m.Buffers {
+		if len(b) > 0 {
+			runtime.RaceReadRange(unsafe.Pointer(&b[0]), len(b))
+		}
+	}
+	if b := m.OOB; len(b) > 0 {
+		runtime.RaceReadRange(unsafe.Pointer(&b[0]), len(b))
+	}
+}
+func (m *Message) raceWrite() {
+	for _, b := range m.Buffers {
+		if len(b) > 0 {
+			runtime.RaceWriteRange(unsafe.Pointer(&b[0]), len(b))
+		}
+	}
+	if b := m.OOB; len(b) > 0 {
+		runtime.RaceWriteRange(unsafe.Pointer(&b[0]), len(b))
+	}
+}
@@ -13,6 +13,9 @@ import (
 )

 func (c *Conn) recvMsgs(ms []Message, flags int) (int, error) {
+	for i := range ms {
+		ms[i].raceWrite()
+	}
 	hs := make(mmsghdrs, len(ms))
 	var parseFn func([]byte, string) (net.Addr, error)
 	if c.network != "tcp" {
@@ -43,6 +46,9 @@ func (c *Conn) recvMsgs(ms []Message, flags int) (int, error) {
 }

 func (c *Conn) sendMsgs(ms []Message, flags int) (int, error) {
+	for i := range ms {
+		ms[i].raceRead()
+	}
 	hs := make(mmsghdrs, len(ms))
 	var marshalFn func(net.Addr) []byte
 	if c.network != "tcp" {
@@ -12,6 +12,7 @@ import (
 )

 func (c *Conn) recvMsg(m *Message, flags int) error {
+	m.raceWrite()
 	var h msghdr
 	vs := make([]iovec, len(m.Buffers))
 	var sa []byte
@@ -48,6 +49,7 @@ func (c *Conn) recvMsg(m *Message, flags int) error {
 }

 func (c *Conn) sendMsg(m *Message, flags int) error {
+	m.raceRead()
 	var h msghdr
 	vs := make([]iovec, len(m.Buffers))
 	var sa []byte
@@ -4,4 +4,29 @@

 package socket

-func probeProtocolStack() int { return 4 }
+import (
+	"sync"
+	"syscall"
+	"unsafe"
+)
+
+// See version list in https://github.com/DragonFlyBSD/DragonFlyBSD/blob/master/sys/sys/param.h
+var (
+	osreldateOnce sync.Once
+	osreldate     uint32
+)
+
+// First __DragonFly_version after September 2019 ABI changes
+// http://lists.dragonflybsd.org/pipermail/users/2019-September/358280.html
+const _dragonflyABIChangeVersion = 500705
+
+func probeProtocolStack() int {
+	osreldateOnce.Do(func() { osreldate, _ = syscall.SysctlUint32("kern.osreldate") })
+	var p uintptr
+	if int(unsafe.Sizeof(p)) == 8 && osreldate >= _dragonflyABIChangeVersion {
+		return int(unsafe.Sizeof(p))
+	}
+	// 64-bit Dragonfly before the September 2019 ABI changes still requires
+	// 32-bit aligned access to network subsystem.
+	return 4
+}
@@ -403,9 +403,9 @@ func (ts *timeSeries) extract(l *tsLevel, start, finish time.Time, num int, resu

 	// Where should scanning start?
 	if dstStart.After(srcStart) {
-		advance := dstStart.Sub(srcStart) / srcInterval
-		srcIndex += int(advance)
-		srcStart = srcStart.Add(advance * srcInterval)
+		advance := int(dstStart.Sub(srcStart) / srcInterval)
+		srcIndex += advance
+		srcStart = srcStart.Add(time.Duration(advance) * srcInterval)
 	}

 	// The i'th value is computed as show below.
@@ -35,6 +35,7 @@ func marshalInterface(b []byte, cm *ControlMessage) []byte {
 }

 func parseInterface(cm *ControlMessage, b []byte) {
-	sadl := (*syscall.SockaddrDatalink)(unsafe.Pointer(&b[0]))
+	var sadl syscall.SockaddrDatalink
+	copy((*[unsafe.Sizeof(sadl)]byte)(unsafe.Pointer(&sadl))[:], b)
 	cm.IfIndex = int(sadl.Index)
 }
@@ -14,9 +14,8 @@ import (
 )

 const (
-	Version      = 4  // protocol version
-	HeaderLen    = 20 // header length without extension headers
-	maxHeaderLen = 60 // sensible default, revisit if later RFCs define new usage of version and header length fields
+	Version   = 4  // protocol version
+	HeaderLen = 20 // header length without extension headers
 )

 type HeaderFlags int
@@ -13,16 +13,13 @@ import (
 )

 var (
-	errInvalidConn              = errors.New("invalid connection")
-	errMissingAddress           = errors.New("missing address")
-	errMissingHeader            = errors.New("missing header")
-	errNilHeader                = errors.New("nil header")
-	errHeaderTooShort           = errors.New("header too short")
-	errExtHeaderTooShort        = errors.New("extension header too short")
-	errInvalidConnType          = errors.New("invalid conn type")
-	errNoSuchInterface          = errors.New("no such interface")
-	errNoSuchMulticastInterface = errors.New("no such multicast interface")
-	errNotImplemented           = errors.New("not implemented on " + runtime.GOOS + "/" + runtime.GOARCH)
+	errInvalidConn       = errors.New("invalid connection")
+	errMissingAddress    = errors.New("missing address")
+	errNilHeader         = errors.New("nil header")
+	errHeaderTooShort    = errors.New("header too short")
+	errExtHeaderTooShort = errors.New("extension header too short")
+	errInvalidConnType   = errors.New("invalid conn type")
+	errNotImplemented    = errors.New("not implemented on " + runtime.GOOS + "/" + runtime.GOARCH)

 	// See https://www.freebsd.org/doc/en/books/porters-handbook/versions.html.
 	freebsdVersion  uint32
@@ -7,12 +7,15 @@
 package ipv4

 import (
+	"errors"
 	"net"
 	"unsafe"

 	"golang.org/x/net/internal/socket"
 )

+var errNoSuchInterface = errors.New("no such interface")
+
 func (so *sockOpt) setIPMreq(c *socket.Conn, ifi *net.Interface, grp net.IP) error {
 	mreq := ipMreq{Multiaddr: [4]byte{grp[0], grp[1], grp[2], grp[3]}}
 	if err := setIPMreqInterface(&mreq, ifi); err != nil {
@@ -11,13 +11,14 @@ import (

 	"golang.org/x/net/bpf"
 	"golang.org/x/net/internal/socket"
+	"golang.org/x/sys/unix"
 )

 func (so *sockOpt) setAttachFilter(c *socket.Conn, f []bpf.RawInstruction) error {
-	prog := sockFProg{
+	prog := unix.SockFprog{
 		Len:    uint16(len(f)),
-		Filter: (*sockFilter)(unsafe.Pointer(&f[0])),
+		Filter: (*unix.SockFilter)(unsafe.Pointer(&f[0])),
 	}
-	b := (*[sizeofSockFprog]byte)(unsafe.Pointer(&prog))[:sizeofSockFprog]
+	b := (*[unix.SizeofSockFprog]byte)(unsafe.Pointer(&prog))[:unix.SizeofSockFprog]
 	return so.Set(c, b)
 }
@@ -11,6 +11,7 @@ import (

 	"golang.org/x/net/internal/iana"
 	"golang.org/x/net/internal/socket"
+	"golang.org/x/sys/unix"
 )

 var (
@@ -35,7 +36,7 @@ var (
 		ssoLeaveSourceGroup:   {Option: socket.Option{Level: iana.ProtocolIP, Name: sysMCAST_LEAVE_SOURCE_GROUP, Len: sizeofGroupSourceReq}, typ: ssoTypeGroupSourceReq},
 		ssoBlockSourceGroup:   {Option: socket.Option{Level: iana.ProtocolIP, Name: sysMCAST_BLOCK_SOURCE, Len: sizeofGroupSourceReq}, typ: ssoTypeGroupSourceReq},
 		ssoUnblockSourceGroup: {Option: socket.Option{Level: iana.ProtocolIP, Name: sysMCAST_UNBLOCK_SOURCE, Len: sizeofGroupSourceReq}, typ: ssoTypeGroupSourceReq},
-		ssoAttachFilter:       {Option: socket.Option{Level: sysSOL_SOCKET, Name: sysSO_ATTACH_FILTER, Len: sizeofSockFprog}},
+		ssoAttachFilter:       {Option: socket.Option{Level: unix.SOL_SOCKET, Name: unix.SO_ATTACH_FILTER, Len: unix.SizeofSockFprog}},
 	}
 )

@@ -0,0 +1,93 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_freebsd.go
+
+package ipv4
+
+const (
+	sysIP_OPTIONS     = 0x1
+	sysIP_HDRINCL     = 0x2
+	sysIP_TOS         = 0x3
+	sysIP_TTL         = 0x4
+	sysIP_RECVOPTS    = 0x5
+	sysIP_RECVRETOPTS = 0x6
+	sysIP_RECVDSTADDR = 0x7
+	sysIP_SENDSRCADDR = 0x7
+	sysIP_RETOPTS     = 0x8
+	sysIP_RECVIF      = 0x14
+	sysIP_ONESBCAST   = 0x17
+	sysIP_BINDANY     = 0x18
+	sysIP_RECVTTL     = 0x41
+	sysIP_MINTTL      = 0x42
+	sysIP_DONTFRAG    = 0x43
+	sysIP_RECVTOS     = 0x44
+
+	sysIP_MULTICAST_IF           = 0x9
+	sysIP_MULTICAST_TTL          = 0xa
+	sysIP_MULTICAST_LOOP         = 0xb
+	sysIP_ADD_MEMBERSHIP         = 0xc
+	sysIP_DROP_MEMBERSHIP        = 0xd
+	sysIP_MULTICAST_VIF          = 0xe
+	sysIP_ADD_SOURCE_MEMBERSHIP  = 0x46
+	sysIP_DROP_SOURCE_MEMBERSHIP = 0x47
+	sysIP_BLOCK_SOURCE           = 0x48
+	sysIP_UNBLOCK_SOURCE         = 0x49
+	sysMCAST_JOIN_GROUP          = 0x50
+	sysMCAST_LEAVE_GROUP         = 0x51
+	sysMCAST_JOIN_SOURCE_GROUP   = 0x52
+	sysMCAST_LEAVE_SOURCE_GROUP  = 0x53
+	sysMCAST_BLOCK_SOURCE        = 0x54
+	sysMCAST_UNBLOCK_SOURCE      = 0x55
+
+	sizeofSockaddrStorage = 0x80
+	sizeofSockaddrInet    = 0x10
+
+	sizeofIPMreq         = 0x8
+	sizeofIPMreqn        = 0xc
+	sizeofIPMreqSource   = 0xc
+	sizeofGroupReq       = 0x88
+	sizeofGroupSourceReq = 0x108
+)
+
+type sockaddrStorage struct {
+	Len         uint8
+	Family      uint8
+	X__ss_pad1  [6]uint8
+	X__ss_align int64
+	X__ss_pad2  [112]uint8
+}
+
+type sockaddrInet struct {
+	Len    uint8
+	Family uint8
+	Port   uint16
+	Addr   [4]byte /* in_addr */
+	Zero   [8]uint8
+}
+
+type ipMreq struct {
+	Multiaddr [4]byte /* in_addr */
+	Interface [4]byte /* in_addr */
+}
+
+type ipMreqn struct {
+	Multiaddr [4]byte /* in_addr */
+	Address   [4]byte /* in_addr */
+	Ifindex   int32
+}
+
+type ipMreqSource struct {
+	Multiaddr  [4]byte /* in_addr */
+	Sourceaddr [4]byte /* in_addr */
+	Interface  [4]byte /* in_addr */
+}
+
+type groupReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+}
+
+type groupSourceReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+	Source    sockaddrStorage
+}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -133,16 +128,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -135,16 +130,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -133,16 +128,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -135,16 +130,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -133,16 +128,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -135,16 +130,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -135,16 +130,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -133,16 +128,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -133,16 +128,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -135,16 +130,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -135,16 +130,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -57,9 +57,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -72,8 +69,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -137,15 +132,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len    uint16
-	Filter *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -55,9 +55,6 @@ const (
 	sysSO_EE_ORIGIN_TXSTATUS     = 0x4
 	sysSO_EE_ORIGIN_TIMESTAMPING = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet          = 0x10
 	sizeofInetPktinfo           = 0xc
@@ -70,8 +67,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPFilter = 0x4
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -135,16 +130,3 @@ type groupSourceReq struct {
 type icmpFilter struct {
 	Data uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -15,7 +15,6 @@ var (
 	errMissingAddress  = errors.New("missing address")
 	errHeaderTooShort  = errors.New("header too short")
 	errInvalidConnType = errors.New("invalid conn type")
-	errNoSuchInterface = errors.New("no such interface")
 	errNotImplemented  = errors.New("not implemented on " + runtime.GOOS + "/" + runtime.GOARCH)
 )

@@ -11,13 +11,14 @@ import (

 	"golang.org/x/net/bpf"
 	"golang.org/x/net/internal/socket"
+	"golang.org/x/sys/unix"
 )

 func (so *sockOpt) setAttachFilter(c *socket.Conn, f []bpf.RawInstruction) error {
-	prog := sockFProg{
+	prog := unix.SockFprog{
 		Len:    uint16(len(f)),
-		Filter: (*sockFilter)(unsafe.Pointer(&f[0])),
+		Filter: (*unix.SockFilter)(unsafe.Pointer(&f[0])),
 	}
-	b := (*[sizeofSockFprog]byte)(unsafe.Pointer(&prog))[:sizeofSockFprog]
+	b := (*[unix.SizeofSockFprog]byte)(unsafe.Pointer(&prog))[:unix.SizeofSockFprog]
 	return so.Set(c, b)
 }
@@ -11,6 +11,7 @@ import (

 	"golang.org/x/net/internal/iana"
 	"golang.org/x/net/internal/socket"
+	"golang.org/x/sys/unix"
 )

 var (
@@ -40,7 +41,7 @@ var (
 		ssoLeaveSourceGroup:    {Option: socket.Option{Level: iana.ProtocolIPv6, Name: sysMCAST_LEAVE_SOURCE_GROUP, Len: sizeofGroupSourceReq}, typ: ssoTypeGroupSourceReq},
 		ssoBlockSourceGroup:    {Option: socket.Option{Level: iana.ProtocolIPv6, Name: sysMCAST_BLOCK_SOURCE, Len: sizeofGroupSourceReq}, typ: ssoTypeGroupSourceReq},
 		ssoUnblockSourceGroup:  {Option: socket.Option{Level: iana.ProtocolIPv6, Name: sysMCAST_UNBLOCK_SOURCE, Len: sizeofGroupSourceReq}, typ: ssoTypeGroupSourceReq},
-		ssoAttachFilter:        {Option: socket.Option{Level: sysSOL_SOCKET, Name: sysSO_ATTACH_FILTER, Len: sizeofSockFprog}},
+		ssoAttachFilter:        {Option: socket.Option{Level: unix.SOL_SOCKET, Name: unix.SO_ATTACH_FILTER, Len: unix.SizeofSockFprog}},
 	}
 )

@@ -0,0 +1,122 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_freebsd.go
+
+package ipv6
+
+const (
+	sysIPV6_UNICAST_HOPS   = 0x4
+	sysIPV6_MULTICAST_IF   = 0x9
+	sysIPV6_MULTICAST_HOPS = 0xa
+	sysIPV6_MULTICAST_LOOP = 0xb
+	sysIPV6_JOIN_GROUP     = 0xc
+	sysIPV6_LEAVE_GROUP    = 0xd
+	sysIPV6_PORTRANGE      = 0xe
+	sysICMP6_FILTER        = 0x12
+
+	sysIPV6_CHECKSUM = 0x1a
+	sysIPV6_V6ONLY   = 0x1b
+
+	sysIPV6_IPSEC_POLICY = 0x1c
+
+	sysIPV6_RTHDRDSTOPTS = 0x23
+
+	sysIPV6_RECVPKTINFO  = 0x24
+	sysIPV6_RECVHOPLIMIT = 0x25
+	sysIPV6_RECVRTHDR    = 0x26
+	sysIPV6_RECVHOPOPTS  = 0x27
+	sysIPV6_RECVDSTOPTS  = 0x28
+
+	sysIPV6_USE_MIN_MTU = 0x2a
+	sysIPV6_RECVPATHMTU = 0x2b
+
+	sysIPV6_PATHMTU = 0x2c
+
+	sysIPV6_PKTINFO  = 0x2e
+	sysIPV6_HOPLIMIT = 0x2f
+	sysIPV6_NEXTHOP  = 0x30
+	sysIPV6_HOPOPTS  = 0x31
+	sysIPV6_DSTOPTS  = 0x32
+	sysIPV6_RTHDR    = 0x33
+
+	sysIPV6_RECVTCLASS = 0x39
+
+	sysIPV6_AUTOFLOWLABEL = 0x3b
+
+	sysIPV6_TCLASS   = 0x3d
+	sysIPV6_DONTFRAG = 0x3e
+
+	sysIPV6_PREFER_TEMPADDR = 0x3f
+
+	sysIPV6_BINDANY = 0x40
+
+	sysIPV6_MSFILTER = 0x4a
+
+	sysMCAST_JOIN_GROUP         = 0x50
+	sysMCAST_LEAVE_GROUP        = 0x51
+	sysMCAST_JOIN_SOURCE_GROUP  = 0x52
+	sysMCAST_LEAVE_SOURCE_GROUP = 0x53
+	sysMCAST_BLOCK_SOURCE       = 0x54
+	sysMCAST_UNBLOCK_SOURCE     = 0x55
+
+	sysIPV6_PORTRANGE_DEFAULT = 0x0
+	sysIPV6_PORTRANGE_HIGH    = 0x1
+	sysIPV6_PORTRANGE_LOW     = 0x2
+
+	sizeofSockaddrStorage = 0x80
+	sizeofSockaddrInet6   = 0x1c
+	sizeofInet6Pktinfo    = 0x14
+	sizeofIPv6Mtuinfo     = 0x20
+
+	sizeofIPv6Mreq       = 0x14
+	sizeofGroupReq       = 0x88
+	sizeofGroupSourceReq = 0x108
+
+	sizeofICMPv6Filter = 0x20
+)
+
+type sockaddrStorage struct {
+	Len         uint8
+	Family      uint8
+	X__ss_pad1  [6]uint8
+	X__ss_align int64
+	X__ss_pad2  [112]uint8
+}
+
+type sockaddrInet6 struct {
+	Len      uint8
+	Family   uint8
+	Port     uint16
+	Flowinfo uint32
+	Addr     [16]byte /* in6_addr */
+	Scope_id uint32
+}
+
+type inet6Pktinfo struct {
+	Addr    [16]byte /* in6_addr */
+	Ifindex uint32
+}
+
+type ipv6Mtuinfo struct {
+	Addr sockaddrInet6
+	Mtu  uint32
+}
+
+type ipv6Mreq struct {
+	Multiaddr [16]byte /* in6_addr */
+	Interface uint32
+}
+
+type groupReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+}
+
+type groupSourceReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+	Source    sockaddrStorage
+}
+
+type icmpv6Filter struct {
+	Filt [8]uint32
+}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -155,16 +150,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -157,16 +152,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -155,16 +150,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -157,16 +152,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -155,16 +150,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -157,16 +152,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -157,16 +152,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -155,16 +150,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x104

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x8
 )

 type kernelSockaddrStorage struct {
@@ -155,16 +150,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [2]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -157,16 +152,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -157,16 +152,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -86,9 +86,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -100,8 +97,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -159,15 +154,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len    uint16
-	Filter *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -84,9 +84,6 @@ const (
 	sysICMPV6_FILTER_BLOCKOTHERS = 0x3
 	sysICMPV6_FILTER_PASSONLY    = 0x4

-	sysSOL_SOCKET       = 0x1
-	sysSO_ATTACH_FILTER = 0x1a
-
 	sizeofKernelSockaddrStorage = 0x80
 	sizeofSockaddrInet6         = 0x1c
 	sizeofInet6Pktinfo          = 0x14
@@ -98,8 +95,6 @@ const (
 	sizeofGroupSourceReq = 0x108

 	sizeofICMPv6Filter = 0x20
-
-	sizeofSockFprog = 0x10
 )

 type kernelSockaddrStorage struct {
@@ -157,16 +152,3 @@ type groupSourceReq struct {
 type icmpv6Filter struct {
 	Data [8]uint32
 }
-
-type sockFProg struct {
-	Len       uint16
-	Pad_cgo_0 [6]byte
-	Filter    *sockFilter
-}
-
-type sockFilter struct {
-	Code uint16
-	Jt   uint8
-	Jf   uint8
-	K    uint32
-}
@@ -39,20 +39,25 @@ func (bigEndian) Uint64(b []byte) uint64 {
 		uint64(b[3])<<32 | uint64(b[2])<<40 | uint64(b[1])<<48 | uint64(b[0])<<56
 }

-// hostByteOrder returns binary.LittleEndian on little-endian machines and
-// binary.BigEndian on big-endian machines.
+// hostByteOrder returns littleEndian on little-endian machines and
+// bigEndian on big-endian machines.
 func hostByteOrder() byteOrder {
 	switch runtime.GOARCH {
 	case "386", "amd64", "amd64p32",
+		"alpha",
 		"arm", "arm64",
 		"mipsle", "mips64le", "mips64p32le",
+		"nios2",
 		"ppc64le",
-		"riscv", "riscv64":
+		"riscv", "riscv64",
+		"sh":
 		return littleEndian{}
 	case "armbe", "arm64be",
+		"m68k",
 		"mips", "mips64", "mips64p32",
 		"ppc", "ppc64",
 		"s390", "s390x",
+		"shbe",
 		"sparc", "sparc64":
 		return bigEndian{}
 	}
@@ -114,6 +114,15 @@ var ARM struct {
 	_           CacheLinePad
 }

+// MIPS64X contains the supported CPU features of the current mips64/mips64le
+// platforms. If the current platform is not mips64/mips64le or the current
+// operating system is not Linux then all feature flags are false.
+var MIPS64X struct {
+	_      CacheLinePad
+	HasMSA bool // MIPS SIMD architecture
+	_      CacheLinePad
+}
+
 // PPC64 contains the supported CPU features of the current ppc64/ppc64le platforms.
 // If the current platform is not ppc64/ppc64le then all feature flags are false.
 //
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

-// +build aix,ppc64
+// +build aix

 package cpu

@@ -0,0 +1,144 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import "runtime"
+
+const cacheLineSize = 64
+
+func init() {
+	switch runtime.GOOS {
+	case "android", "darwin", "netbsd":
+		// Android and iOS don't seem to allow reading these registers.
+		//
+		// NetBSD:
+		// ID_AA64ISAR0_EL1 is a privileged register and cannot be read from EL0.
+		// It can be read via sysctl(3). Example for future implementers:
+		// https://nxr.netbsd.org/xref/src/usr.sbin/cpuctl/arch/aarch64.c
+		//
+		// Fake the minimal features expected by
+		// TestARM64minimalFeatures.
+		ARM64.HasASIMD = true
+		ARM64.HasFP = true
+	case "linux":
+		doinit()
+	default:
+		readARM64Registers()
+	}
+}
+
+func readARM64Registers() {
+	Initialized = true
+
+	// ID_AA64ISAR0_EL1
+	isar0 := getisar0()
+
+	switch extractBits(isar0, 4, 7) {
+	case 1:
+		ARM64.HasAES = true
+	case 2:
+		ARM64.HasAES = true
+		ARM64.HasPMULL = true
+	}
+
+	switch extractBits(isar0, 8, 11) {
+	case 1:
+		ARM64.HasSHA1 = true
+	}
+
+	switch extractBits(isar0, 12, 15) {
+	case 1:
+		ARM64.HasSHA2 = true
+	case 2:
+		ARM64.HasSHA2 = true
+		ARM64.HasSHA512 = true
+	}
+
+	switch extractBits(isar0, 16, 19) {
+	case 1:
+		ARM64.HasCRC32 = true
+	}
+
+	switch extractBits(isar0, 20, 23) {
+	case 2:
+		ARM64.HasATOMICS = true
+	}
+
+	switch extractBits(isar0, 28, 31) {
+	case 1:
+		ARM64.HasASIMDRDM = true
+	}
+
+	switch extractBits(isar0, 32, 35) {
+	case 1:
+		ARM64.HasSHA3 = true
+	}
+
+	switch extractBits(isar0, 36, 39) {
+	case 1:
+		ARM64.HasSM3 = true
+	}
+
+	switch extractBits(isar0, 40, 43) {
+	case 1:
+		ARM64.HasSM4 = true
+	}
+
+	switch extractBits(isar0, 44, 47) {
+	case 1:
+		ARM64.HasASIMDDP = true
+	}
+
+	// ID_AA64ISAR1_EL1
+	isar1 := getisar1()
+
+	switch extractBits(isar1, 0, 3) {
+	case 1:
+		ARM64.HasDCPOP = true
+	}
+
+	switch extractBits(isar1, 12, 15) {
+	case 1:
+		ARM64.HasJSCVT = true
+	}
+
+	switch extractBits(isar1, 16, 19) {
+	case 1:
+		ARM64.HasFCMA = true
+	}
+
+	switch extractBits(isar1, 20, 23) {
+	case 1:
+		ARM64.HasLRCPC = true
+	}
+
+	// ID_AA64PFR0_EL1
+	pfr0 := getpfr0()
+
+	switch extractBits(pfr0, 16, 19) {
+	case 0:
+		ARM64.HasFP = true
+	case 1:
+		ARM64.HasFP = true
+		ARM64.HasFPHP = true
+	}
+
+	switch extractBits(pfr0, 20, 23) {
+	case 0:
+		ARM64.HasASIMD = true
+	case 1:
+		ARM64.HasASIMD = true
+		ARM64.HasASIMDHP = true
+	}
+
+	switch extractBits(pfr0, 32, 35) {
+	case 1:
+		ARM64.HasSVE = true
+	}
+}
+
+func extractBits(data uint64, start, end uint) uint {
+	return (uint)(data>>start) & ((1 << (end - start + 1)) - 1)
+}
@@ -0,0 +1,31 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !gccgo
+
+#include "textflag.h"
+
+// func getisar0() uint64
+TEXT ·getisar0(SB),NOSPLIT,$0-8
+	// get Instruction Set Attributes 0 into x0
+	// mrs x0, ID_AA64ISAR0_EL1 = d5380600
+	WORD	$0xd5380600
+	MOVD	R0, ret+0(FP)
+	RET
+
+// func getisar1() uint64
+TEXT ·getisar1(SB),NOSPLIT,$0-8
+	// get Instruction Set Attributes 1 into x0
+	// mrs x0, ID_AA64ISAR1_EL1 = d5380620
+	WORD	$0xd5380620
+	MOVD	R0, ret+0(FP)
+	RET
+
+// func getpfr0() uint64
+TEXT ·getpfr0(SB),NOSPLIT,$0-8
+	// get Processor Feature Register 0 into x0
+	// mrs x0, ID_AA64PFR0_EL1 = d5380400
+	WORD	$0xd5380400
+	MOVD	R0, ret+0(FP)
+	RET
@@ -0,0 +1,11 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !gccgo
+
+package cpu
+
+func getisar0() uint64
+func getisar1() uint64
+func getpfr0() uint64
@@ -0,0 +1,11 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build gccgo
+
+package cpu
+
+func getisar0() uint64 { return 0 }
+func getisar1() uint64 { return 0 }
+func getpfr0() uint64  { return 0 }
@@ -2,58 +2,14 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

-// +build !amd64,!amd64p32,!386
+// +build !386,!amd64,!amd64p32,!arm64

 package cpu

-import (
-	"io/ioutil"
-)
-
-const (
-	_AT_HWCAP  = 16
-	_AT_HWCAP2 = 26
-
-	procAuxv = "/proc/self/auxv"
-
-	uintSize = int(32 << (^uint(0) >> 63))
-)
-
-// For those platforms don't have a 'cpuid' equivalent we use HWCAP/HWCAP2
-// These are initialized in cpu_$GOARCH.go
-// and should not be changed after they are initialized.
-var hwCap uint
-var hwCap2 uint
-
 func init() {
-	buf, err := ioutil.ReadFile(procAuxv)
-	if err != nil {
-		// e.g. on android /proc/self/auxv is not accessible, so silently
-		// ignore the error and leave Initialized = false
+	if err := readHWCAP(); err != nil {
 		return
 	}
-
-	bo := hostByteOrder()
-	for len(buf) >= 2*(uintSize/8) {
-		var tag, val uint
-		switch uintSize {
-		case 32:
-			tag = uint(bo.Uint32(buf[0:]))
-			val = uint(bo.Uint32(buf[4:]))
-			buf = buf[8:]
-		case 64:
-			tag = uint(bo.Uint64(buf[0:]))
-			val = uint(bo.Uint64(buf[8:]))
-			buf = buf[16:]
-		}
-		switch tag {
-		case _AT_HWCAP:
-			hwCap = val
-		case _AT_HWCAP2:
-			hwCap2 = val
-		}
-	}
 	doinit()
-
 	Initialized = true
 }
@@ -4,8 +4,6 @@

 package cpu

-const cacheLineSize = 64
-
 // HWCAP/HWCAP2 bits. These are exposed by Linux.
 const (
 	hwcap_FP       = 1 << 0
@@ -35,6 +33,12 @@ const (
 )

 func doinit() {
+	if err := readHWCAP(); err != nil {
+		// failed to read /proc/self/auxv, try reading registers directly
+		readARM64Registers()
+		return
+	}
+
 	// HWCAP feature bits
 	ARM64.HasFP = isSet(hwCap, hwcap_FP)
 	ARM64.HasASIMD = isSet(hwCap, hwcap_ASIMD)
@@ -0,0 +1,22 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build mips64 mips64le
+
+package cpu
+
+// HWCAP bits. These are exposed by the Linux kernel 5.4.
+const (
+	// CPU features
+	hwcap_MIPS_MSA = 1 << 1
+)
+
+func doinit() {
+	// HWCAP feature bits
+	MIPS64X.HasMSA = isSet(hwCap, hwcap_MIPS_MSA)
+}
+
+func isSet(hwc uint, value uint) bool {
+	return hwc&value != 0
+}
@@ -0,0 +1,9 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build linux,!arm,!arm64,!mips64,!mips64le,!ppc64,!ppc64le,!s390x
+
+package cpu
+
+func doinit() {}
@@ -7,5 +7,3 @@
 package cpu

 const cacheLineSize = 32
-
-func doinit() {}
@@ -7,5 +7,3 @@
 package cpu

 const cacheLineSize = 32
-
-func doinit() {}
@@ -6,6 +6,4 @@

 package cpu

-const cacheLineSize = 64
-
 func doinit() {}
@@ -0,0 +1,9 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build riscv64
+
+package cpu
+
+const cacheLineSize = 32
@@ -11,5 +11,3 @@ package cpu
 // rules are good enough.

 const cacheLineSize = 0
-
-func doinit() {}
@@ -0,0 +1,56 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cpu
+
+import (
+	"io/ioutil"
+)
+
+const (
+	_AT_HWCAP  = 16
+	_AT_HWCAP2 = 26
+
+	procAuxv = "/proc/self/auxv"
+
+	uintSize = int(32 << (^uint(0) >> 63))
+)
+
+// For those platforms don't have a 'cpuid' equivalent we use HWCAP/HWCAP2
+// These are initialized in cpu_$GOARCH.go
+// and should not be changed after they are initialized.
+var hwCap uint
+var hwCap2 uint
+
+func readHWCAP() error {
+	buf, err := ioutil.ReadFile(procAuxv)
+	if err != nil {
+		// e.g. on android /proc/self/auxv is not accessible, so silently
+		// ignore the error and leave Initialized = false. On some
+		// architectures (e.g. arm64) doinit() implements a fallback
+		// readout and will set Initialized = true again.
+		return err
+	}
+	bo := hostByteOrder()
+	for len(buf) >= 2*(uintSize/8) {
+		var tag, val uint
+		switch uintSize {
+		case 32:
+			tag = uint(bo.Uint32(buf[0:]))
+			val = uint(bo.Uint32(buf[4:]))
+			buf = buf[8:]
+		case 64:
+			tag = uint(bo.Uint64(buf[0:]))
+			val = uint(bo.Uint64(buf[8:]))
+			buf = buf[16:]
+		}
+		switch tag {
+		case _AT_HWCAP:
+			hwCap = val
+		case _AT_HWCAP2:
+			hwCap2 = val
+		}
+	}
+	return nil
+}
@@ -0,0 +1,27 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Recreate a getsystemcfg syscall handler instead of
+// using the one provided by x/sys/unix to avoid having
+// the dependency between them. (See golang.org/issue/32102)
+// Morever, this file will be used during the building of
+// gccgo's libgo and thus must not used a CGo method.
+
+// +build aix
+// +build gccgo
+
+package cpu
+
+import (
+	"syscall"
+)
+
+//extern getsystemcfg
+func gccgoGetsystemcfg(label uint32) (r uint64)
+
+func callgetsystemcfg(label int) (r1 uintptr, e1 syscall.Errno) {
+	r1 = uintptr(gccgoGetsystemcfg(uint32(label)))
+	e1 = syscall.GetErrno()
+	return
+}
@@ -0,0 +1,30 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package unsafeheader contains header declarations for the Go runtime's
+// slice and string implementations.
+//
+// This package allows x/sys to use types equivalent to
+// reflect.SliceHeader and reflect.StringHeader without introducing
+// a dependency on the (relatively heavy) "reflect" package.
+package unsafeheader
+
+import (
+	"unsafe"
+)
+
+// Slice is the runtime representation of a slice.
+// It cannot be used safely or portably and its representation may change in a later release.
+type Slice struct {
+	Data unsafe.Pointer
+	Len  int
+	Cap  int
+}
+
+// String is the runtime representation of a string.
+// It cannot be used safely or portably and its representation may change in a later release.
+type String struct {
+	Data unsafe.Pointer
+	Len  int
+}
@@ -89,7 +89,7 @@ constants.

 Adding new syscall numbers is mostly done by running the build on a sufficiently
 new installation of the target OS (or updating the source checkouts for the
-new build system). However, depending on the OS, you make need to update the
+new build system). However, depending on the OS, you may need to update the
 parsing in mksysnum.

 ### mksyscall.go
@@ -149,10 +149,21 @@ To add a constant, add the header that includes it to the appropriate variable.
 Then, edit the regex (if necessary) to match the desired constant. Avoid making
 the regex too broad to avoid matching unintended constants.

+### mkmerge.go
+
+This program is used to extract duplicate const, func, and type declarations
+from the generated architecture-specific files listed below, and merge these
+into a common file for each OS.
+
+The merge is performed in the following steps:
+1. Construct the set of common code that is idential in all architecture-specific files.
+2. Write this common code to the merged file.
+3. Remove the common code from all architecture-specific files.
+

 ## Generated files

-### `zerror_${GOOS}_${GOARCH}.go`
+### `zerrors_${GOOS}_${GOARCH}.go`

 A file containing all of the system's generated error numbers, error strings,
 signal numbers, and constants. Generated by `mkerrors.sh` (see above).
@@ -23,10 +23,6 @@ TEXT ·SyscallNoError(SB),NOSPLIT,$0-48
 	MOV	a1+8(FP), A0
 	MOV	a2+16(FP), A1
 	MOV	a3+24(FP), A2
-	MOV	$0, A3
-	MOV	$0, A4
-	MOV	$0, A5
-	MOV	$0, A6
 	MOV	trap+0(FP), A7	// syscall entry
 	ECALL
 	MOV	A0, r1+32(FP)	// r1
@@ -44,9 +40,6 @@ TEXT ·RawSyscallNoError(SB),NOSPLIT,$0-48
 	MOV	a1+8(FP), A0
 	MOV	a2+16(FP), A1
 	MOV	a3+24(FP), A2
-	MOV	ZERO, A3
-	MOV	ZERO, A4
-	MOV	ZERO, A5
 	MOV	trap+0(FP), A7	// syscall entry
 	ECALL
 	MOV	A0, r1+32(FP)
@@ -23,6 +23,7 @@ const (
 	HCI_CHANNEL_USER    = 1
 	HCI_CHANNEL_MONITOR = 2
 	HCI_CHANNEL_CONTROL = 3
+	HCI_CHANNEL_LOGGING = 4
 )

 // Socketoption Level
@@ -8,6 +8,7 @@
 package unix

 const (
+	DLT_HHDLC                         = 0x79
 	IFF_SMART                         = 0x20
 	IFT_1822                          = 0x2
 	IFT_A12MPPSWITCH                  = 0x82
@@ -210,13 +211,18 @@ const (
 	IFT_XETHER                        = 0x1a
 	IPPROTO_MAXID                     = 0x34
 	IPV6_FAITH                        = 0x1d
+	IPV6_MIN_MEMBERSHIPS              = 0x1f
 	IP_FAITH                          = 0x16
+	IP_MAX_SOURCE_FILTER              = 0x400
+	IP_MIN_MEMBERSHIPS                = 0x1f
 	MAP_NORESERVE                     = 0x40
 	MAP_RENAME                        = 0x20
 	NET_RT_MAXID                      = 0x6
 	RTF_PRCLONING                     = 0x10000
 	RTM_OLDADD                        = 0x9
 	RTM_OLDDEL                        = 0xa
+	RT_CACHING_CONTEXT                = 0x1
+	RT_NORTREF                        = 0x2
 	SIOCADDRT                         = 0x8030720a
 	SIOCALIFADDR                      = 0x8118691b
 	SIOCDELRT                         = 0x8030720b
@@ -8,6 +8,7 @@
 package unix

 const (
+	DLT_HHDLC                         = 0x79
 	IFF_SMART                         = 0x20
 	IFT_1822                          = 0x2
 	IFT_A12MPPSWITCH                  = 0x82
@@ -210,13 +211,18 @@ const (
 	IFT_XETHER                        = 0x1a
 	IPPROTO_MAXID                     = 0x34
 	IPV6_FAITH                        = 0x1d
+	IPV6_MIN_MEMBERSHIPS              = 0x1f
 	IP_FAITH                          = 0x16
+	IP_MAX_SOURCE_FILTER              = 0x400
+	IP_MIN_MEMBERSHIPS                = 0x1f
 	MAP_NORESERVE                     = 0x40
 	MAP_RENAME                        = 0x20
 	NET_RT_MAXID                      = 0x6
 	RTF_PRCLONING                     = 0x10000
 	RTM_OLDADD                        = 0x9
 	RTM_OLDDEL                        = 0xa
+	RT_CACHING_CONTEXT                = 0x1
+	RT_NORTREF                        = 0x2
 	SIOCADDRT                         = 0x8040720a
 	SIOCALIFADDR                      = 0x8118691b
 	SIOCDELRT                         = 0x8040720b
@@ -0,0 +1,17 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Constants that were deprecated or moved to enums in the FreeBSD headers. Keep
+// them here for backwards compatibility.
+
+package unix
+
+const (
+	DLT_HHDLC            = 0x79
+	IPV6_MIN_MEMBERSHIPS = 0x1f
+	IP_MAX_SOURCE_FILTER = 0x400
+	IP_MIN_MEMBERSHIPS   = 0x1f
+	RT_CACHING_CONTEXT   = 0x1
+	RT_NORTREF           = 0x2
+)
@@ -9,12 +9,11 @@ package unix
 import "unsafe"

 // fcntl64Syscall is usually SYS_FCNTL, but is overridden on 32-bit Linux
-// systems by flock_linux_32bit.go to be SYS_FCNTL64.
+// systems by fcntl_linux_32bit.go to be SYS_FCNTL64.
 var fcntl64Syscall uintptr = SYS_FCNTL

-// FcntlInt performs a fcntl syscall on fd with the provided command and argument.
-func FcntlInt(fd uintptr, cmd, arg int) (int, error) {
-	valptr, _, errno := Syscall(fcntl64Syscall, fd, uintptr(cmd), uintptr(arg))
+func fcntl(fd int, cmd, arg int) (int, error) {
+	valptr, _, errno := Syscall(fcntl64Syscall, uintptr(fd), uintptr(cmd), uintptr(arg))
 	var err error
 	if errno != 0 {
 		err = errno
@@ -22,6 +21,11 @@ func FcntlInt(fd uintptr, cmd, arg int) (int, error) {
 	return int(valptr), err
 }

+// FcntlInt performs a fcntl syscall on fd with the provided command and argument.
+func FcntlInt(fd uintptr, cmd, arg int) (int, error) {
+	return fcntl(int(fd), cmd, arg)
+}
+
 // FcntlFlock performs a fcntl syscall for the F_GETLK, F_SETLK or F_SETLKW command.
 func FcntlFlock(fd uintptr, cmd int, lk *Flock_t) error {
 	_, _, errno := Syscall(fcntl64Syscall, fd, uintptr(cmd), uintptr(unsafe.Pointer(lk)))
@@ -0,0 +1,29 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+
+package unix
+
+// Set adds fd to the set fds.
+func (fds *FdSet) Set(fd int) {
+	fds.Bits[fd/NFDBITS] |= (1 << (uintptr(fd) % NFDBITS))
+}
+
+// Clear removes fd from the set fds.
+func (fds *FdSet) Clear(fd int) {
+	fds.Bits[fd/NFDBITS] &^= (1 << (uintptr(fd) % NFDBITS))
+}
+
+// IsSet returns whether fd is in the set fds.
+func (fds *FdSet) IsSet(fd int) bool {
+	return fds.Bits[fd/NFDBITS]&(1<<(uintptr(fd)%NFDBITS)) != 0
+}
+
+// Zero clears the set fds.
+func (fds *FdSet) Zero() {
+	for i := range fds.Bits {
+		fds.Bits[i] = 0
+	}
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Michael Borkenstein	b9d6aaebbe	Release 2020.7.1	2020-07-06 11:47:37 -05:00
Adam Chalmers	a99780ed9d	TUN-3161: Upgrade golang.org/x/ deps	2020-07-06 16:42:48 +00:00
Dalton	92765b4261	AUTH-2850 log config file path	2020-07-06 16:32:57 +00:00
Robert McNeil	8b88b4a403	DEVTOOLS-7321: Push GitHub homebrew updates to master	2020-07-02 16:51:04 +00:00
Michael Borkenstein	2ce6720a6e	AUTH-2854: Create cloudflared RPMs	2020-07-01 14:50:38 -05:00
Michael Borkenstein	772ccc9607	Release 2020.7.0	2020-07-01 10:52:35 -05:00
Michael Borkenstein	7724ff8176	AUTH-2860: Fix builds	2020-07-01 15:51:02 +00:00
Igor Postelnik	2a3d486126	TUN-3007: Implement named tunnel connection registration and unregistration. Removed flag for using quick reconnect, this logic is now always enabled.	2020-07-01 04:19:30 +00:00
Rachel Williams	932e383051	TUN-3140: Add timestamps to terminal log entries	2020-06-30 22:28:22 +00:00