Release 2020.10.2

Dockerfile

@@ -1,7 +1,7 @@
 # use a builder image for building cloudflare
 ARG TARGET_GOOS
 ARG TARGET_GOARCH
-FROM golang:1.13.3 as builder
+FROM golang:1.15.3 as builder
 ENV GO111MODULE=on \
     CGO_ENABLED=0 \
     TARGET_GOOS=${TARGET_GOOS} \

RELEASE_NOTES

@@ -1,3 +1,42 @@
+2020.10.2
+- 2020-10-21 Release 2020.10.1
+- 2020-10-21 AUTH-3185 fixed indention error
+- 2020-10-19 TUN-3459: Make service install on linux use named tunnels
+
+2020.10.1
+- 2020-10-20 Split out typed config from legacy command-line switches; refactor ingress commands and fix tests
+- 2020-10-20 Move raw ingress rules to config package
+- 2020-10-21 TUN-3476: Fix conversion to string and int slice
+- 2020-10-12 TUN-3441:  Multiple-origin routing via ingress rules
+- 2020-10-15 TUN-3464: Newtype to wrap []ingress.Rule
+- 2020-10-15 TUN-3465: Use Go 1.15.3
+- 2020-10-15 TUN-3463: Let users run a named tunnel via config file setting
+- 2020-10-19 TUN-3475: Unify config file handling with typed config for new fields
+- 2020-10-19 TUN-3459: Make service install on linux use named tunnels
+- 2020-10-06 AUTH-3148 fixed cloudflared copy and match all the files in the checksum upload
+- 2020-10-06 TUN-3436, TUN-3437: Parse ingress from YAML, ensure last rule catches everything
+- 2020-10-06 TUN-3446: Use go 1.15.2 and add a step to build cloudflared in the dev Dockerfile
+- 2020-10-07 TUN-3439: 'tunnel validate' command to check ingress rules
+- 2020-10-07 TUN-3440: 'tunnel rule' command to test ingress rules
+- 2020-10-08 TUN-3451: Cloudflared tunnel ingress command
+- 2020-10-09 TUN-3452: Fix loading of flags from config file for tunnel run subcommand. This change also cleans up building of tunnel subcommand list, hides deprecated subcommands and improves help.
+- 2020-10-08 TUN-3438: move ingress into own package, read into TunnelConfig
+
+2020.10.0
+- 2020-10-02 AUTH-2993 cleaned up worker service tests
+- 2020-10-02 TUN-3443: Decode as v4api response on non-200 status
+- 2020-09-24 TRAFFIC-448: allow the user to specify the proxy address and port to bind to, falling back to 127.0.0.1 and random port if not specified
+- 2020-09-28 TUN-3427: Define a struct that only implements RegistrationServer in tunnelpogs
+- 2020-09-29 TUN-3430: Copy flags to configure proxy to run subcommand, print relevant tunnel flags in help
+- 2020-08-12 AUTH-2993 added workers updater logic
+
+2020.9.3
+- 2020-09-22 TRAFFIC-448: build cloudflare for junos and publish to s3
+- 2020-09-22 TUN-3410: Request the v1 Tunnelstore API
+- 2020-09-23 Release 2020.9.2
+- 2020-09-17 updater service exit code should be 11
+- 2020-09-18 AUTH-3109 upload the checksum to workers kv on github releases
+
 2020.9.2
 - 2020-09-22 TRAFFIC-448: build cloudflare for junos and publish to s3
 - 2020-09-22 TUN-3410: Request the v1 Tunnelstore API

cfsetup.yaml

@@ -1,4 +1,4 @@
-pinned_go: &pinned_go go=1.15.2-1
+pinned_go: &pinned_go go=1.15.3-1
 build_dir: &build_dir /cfsetup_build
 default-flavor: stretch
 stretch: &stretch
@@ -250,8 +250,8 @@ centos-7:
       - https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
     pre-cache:
       - yum install -y fakeroot
-      - wget https://golang.org/dl/go1.15.2.linux-amd64.tar.gz -P /tmp/
-      - tar -C /usr/local -xzf /tmp/go1.15.2.linux-amd64.tar.gz
+      - wget https://golang.org/dl/go1.15.3.linux-amd64.tar.gz -P /tmp/
+      - tar -C /usr/local -xzf /tmp/go1.15.3.linux-amd64.tar.gz
     post-cache:
       - export PATH=$PATH:/usr/local/go/bin
       - export GOOS=linux
@@ -262,8 +262,8 @@ centos-7:
     builddeps: *el7_builddeps
     pre-cache:
       - yum install -y fakeroot
-      - wget https://golang.org/dl/go1.15.2.linux-amd64.tar.gz -P /tmp/
-      - tar -C /usr/local -xzf /tmp/go1.15.2.linux-amd64.tar.gz
+      - wget https://golang.org/dl/go1.15.3.linux-amd64.tar.gz -P /tmp/
+      - tar -C /usr/local -xzf /tmp/go1.15.3.linux-amd64.tar.gz
     post-cache:
       - export PATH=$PATH:/usr/local/go/bin
       - export GOOS=linux

cmd/cloudflared/config/configuration.go

@@ -2,15 +2,17 @@ package config
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
+	"time"
 
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/urfave/cli/v2"
-	"github.com/urfave/cli/v2/altsrc"
 	"gopkg.in/yaml.v2"
 
+	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/validation"
 )
 
@@ -28,6 +30,8 @@ var (
 	// Windows default config dir was ~/cloudflare-warp in documentation; let's keep it compatible
 	defaultUserConfigDirs = []string{"~/.cloudflared", "~/.cloudflare-warp", "~/cloudflare-warp"}
 	defaultNixConfigDirs  = []string{"/etc/cloudflared", DefaultUnixConfigLocation}
+
+	ErrNoConfigFile = fmt.Errorf("Cannot determine default configuration path. No file %v in %v", DefaultConfigFiles, DefaultConfigSearchDirectories())
 )
 
 const DefaultCredentialFile = "cert.pem"
@@ -88,14 +92,6 @@ func FileExists(path string) (bool, error) {
 	return true, nil
 }
 
-// FindInputSourceContext pulls the input source from the config flag.
-func FindInputSourceContext(context *cli.Context) (altsrc.InputSourceContext, error) {
-	if context.String("config") != "" {
-		return altsrc.NewYamlSourceFromFile(context.String("config"))
-	}
-	return nil, nil
-}
-
 // FindDefaultConfigPath returns the first path that contains a config file.
 // If none of the combination of DefaultConfigSearchDirectories() and DefaultConfigFiles
 // contains a config file, return empty string.
@@ -199,3 +195,155 @@ func ValidateUrl(c *cli.Context, allowFromArgs bool) (string, error) {
 	validUrl, err := validation.ValidateUrl(url)
 	return validUrl, err
 }
+
+type UnvalidatedIngressRule struct {
+	Hostname string
+	Path     string
+	Service  string
+}
+
+type Configuration struct {
+	TunnelID   string `yaml:"tunnel"`
+	Ingress    []UnvalidatedIngressRule
+	sourceFile string
+}
+
+type configFileSettings struct {
+	Configuration `yaml:",inline"`
+	// older settings will be aggregated into the generic map, should be read via cli.Context
+	Settings map[string]interface{} `yaml:",inline"`
+}
+
+func (c *Configuration) Source() string {
+	return c.sourceFile
+}
+
+func (c *configFileSettings) Int(name string) (int, error) {
+	if raw, ok := c.Settings[name]; ok {
+		if v, ok := raw.(int); ok {
+			return v, nil
+		}
+		return 0, fmt.Errorf("expected int found %T for %s", raw, name)
+	}
+	return 0, nil
+}
+
+func (c *configFileSettings) Duration(name string) (time.Duration, error) {
+	if raw, ok := c.Settings[name]; ok {
+		switch v := raw.(type) {
+		case time.Duration:
+			return v, nil
+		case string:
+			return time.ParseDuration(v)
+		}
+		return 0, fmt.Errorf("expected duration found %T for %s", raw, name)
+	}
+	return 0, nil
+}
+
+func (c *configFileSettings) Float64(name string) (float64, error) {
+	if raw, ok := c.Settings[name]; ok {
+		if v, ok := raw.(float64); ok {
+			return v, nil
+		}
+		return 0, fmt.Errorf("expected float found %T for %s", raw, name)
+	}
+	return 0, nil
+}
+
+func (c *configFileSettings) String(name string) (string, error) {
+	if raw, ok := c.Settings[name]; ok {
+		if v, ok := raw.(string); ok {
+			return v, nil
+		}
+		return "", fmt.Errorf("expected string found %T for %s", raw, name)
+	}
+	return "", nil
+}
+
+func (c *configFileSettings) StringSlice(name string) ([]string, error) {
+	if raw, ok := c.Settings[name]; ok {
+		if slice, ok := raw.([]interface{}); ok {
+			strSlice := make([]string, len(slice))
+			for i, v := range slice {
+				str, ok := v.(string)
+				if !ok {
+					return nil, fmt.Errorf("expected string, found %T for %v", i, v)
+				}
+				strSlice[i] = str
+			}
+			return strSlice, nil
+		}
+		return nil, fmt.Errorf("expected string slice found %T for %s", raw, name)
+	}
+	return nil, nil
+}
+
+func (c *configFileSettings) IntSlice(name string) ([]int, error) {
+	if raw, ok := c.Settings[name]; ok {
+		if slice, ok := raw.([]interface{}); ok {
+			intSlice := make([]int, len(slice))
+			for i, v := range slice {
+				str, ok := v.(int)
+				if !ok {
+					return nil, fmt.Errorf("expected int, found %T for %v ", v, v)
+				}
+				intSlice[i] = str
+			}
+			return intSlice, nil
+		}
+		if v, ok := raw.([]int); ok {
+			return v, nil
+		}
+		return nil, fmt.Errorf("expected int slice found %T for %s", raw, name)
+	}
+	return nil, nil
+}
+
+func (c *configFileSettings) Generic(name string) (cli.Generic, error) {
+	return nil, errors.New("option type Generic not supported")
+}
+
+func (c *configFileSettings) Bool(name string) (bool, error) {
+	if raw, ok := c.Settings[name]; ok {
+		if v, ok := raw.(bool); ok {
+			return v, nil
+		}
+		return false, fmt.Errorf("expected boolean found %T for %s", raw, name)
+	}
+	return false, nil
+}
+
+var configuration configFileSettings
+
+func GetConfiguration() *Configuration {
+	return &configuration.Configuration
+}
+
+// ReadConfigFile returns InputSourceContext initialized from the configuration file.
+// On repeat calls returns with the same file, returns without reading the file again; however,
+// if value of "config" flag changes, will read the new config file
+func ReadConfigFile(c *cli.Context, log logger.Service) (*configFileSettings, error) {
+	configFile := c.String("config")
+	if configuration.Source() == configFile || configFile == "" {
+		if configuration.Source() == "" {
+			return nil, ErrNoConfigFile
+		}
+		return &configuration, nil
+	}
+
+	log.Debugf("Loading configuration from %s", configFile)
+	file, err := os.Open(configFile)
+	if err != nil {
+		if os.IsNotExist(err) {
+			err = ErrNoConfigFile
+		}
+		return nil, err
+	}
+	defer file.Close()
+	if err := yaml.NewDecoder(file).Decode(&configuration); err != nil {
+		return nil, err
+	}
+	configuration.sourceFile = configFile
+	return &configuration, nil
+}

cmd/cloudflared/config/configuration_test.go

@@ -0,0 +1,76 @@
+package config
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"gopkg.in/yaml.v2"
+)
+
+func TestConfigFileSettings(t *testing.T) {
+	var (
+		firstIngress = UnvalidatedIngressRule{
+			Hostname: "tunnel1.example.com",
+			Path:     "/id",
+			Service:  "https://localhost:8000",
+		}
+		secondIngress = UnvalidatedIngressRule{
+			Hostname: "*",
+			Path:     "",
+			Service:  "https://localhost:8001",
+		}
+	)
+	rawYAML := `
+tunnel: config-file-test
+ingress:
+ - hostname: tunnel1.example.com
+   path: /id
+   service: https://localhost:8000
+ - hostname: "*"
+   service: https://localhost:8001
+retries: 5
+grace-period: 30s
+percentage: 3.14
+hostname: example.com
+tag:
+ - test
+ - central-1
+counters:
+ - 123
+ - 456
+`
+	var config configFileSettings
+	err := yaml.Unmarshal([]byte(rawYAML), &config)
+	assert.NoError(t, err)
+
+	assert.Equal(t, "config-file-test", config.TunnelID)
+	assert.Equal(t, firstIngress, config.Ingress[0])
+	assert.Equal(t, secondIngress, config.Ingress[1])
+
+	retries, err := config.Int("retries")
+	assert.NoError(t, err)
+	assert.Equal(t, 5, retries)
+
+	gracePeriod, err := config.Duration("grace-period")
+	assert.NoError(t, err)
+	assert.Equal(t, time.Second*30, gracePeriod)
+
+	percentage, err := config.Float64("percentage")
+	assert.NoError(t, err)
+	assert.Equal(t, 3.14, percentage)
+
+	hostname, err := config.String("hostname")
+	assert.NoError(t, err)
+	assert.Equal(t, "example.com", hostname)
+
+	tags, err := config.StringSlice("tag")
+	assert.NoError(t, err)
+	assert.Equal(t, "test", tags[0])
+	assert.Equal(t, "central-1", tags[1])
+
+	counters, err := config.IntSlice("counters")
+	assert.NoError(t, err)
+	assert.Equal(t, 123, counters[0])
+	assert.Equal(t, 456, counters[1])
+}

cmd/cloudflared/config/manager_test.go

@@ -4,9 +4,10 @@ import (
 	"os"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/watcher"
-	"github.com/stretchr/testify/assert"
 )
 
 type mockNotifier struct {

cmd/cloudflared/linux_service.go

@@ -7,11 +7,12 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/pkg/errors"
+	cli "github.com/urfave/cli/v2"
+
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
-	"github.com/pkg/errors"
-	cli "github.com/urfave/cli/v2"
 )
 
 func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
@@ -23,6 +24,12 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 				Name:   "install",
 				Usage:  "Install Argo Tunnel as a system service",
 				Action: cliutil.ErrorHandler(installLinuxService),
+				Flags: []cli.Flag{
+					&cli.BoolFlag{
+						Name:  "legacy",
+						Usage: "Generate service file for non-named tunnels",
+					},
+				},
 			},
 			&cli.Command{
 				Name:   "uninstall",
@@ -40,6 +47,7 @@ const (
 	serviceConfigDir      = "/etc/cloudflared"
 	serviceConfigFile     = "config.yml"
 	serviceCredentialFile = "cert.pem"
+	serviceConfigPath     = serviceConfigDir + "/" + serviceConfigFile
 )
 
 var systemdTemplates = []ServiceTemplate{
@@ -52,7 +60,7 @@ After=network.target
 [Service]
 TimeoutStartSec=0
 Type=notify
-ExecStart={{ .Path }} --config /etc/cloudflared/config.yml --origincert /etc/cloudflared/cert.pem --no-autoupdate
+ExecStart={{ .Path }} --config /etc/cloudflared/config.yml --no-autoupdate{{ range .ExtraArgs }} {{ . }}{{ end }}
 Restart=on-failure
 RestartSec=5s
 
@@ -102,7 +110,7 @@ var sysvTemplate = ServiceTemplate{
 # Description:       Argo Tunnel agent
 ### END INIT INFO
 name=$(basename $(readlink -f $0))
-cmd="{{.Path}} --config /etc/cloudflared/config.yml --origincert /etc/cloudflared/cert.pem --pidfile /var/run/$name.pid --autoupdate-freq 24h0m0s"
+cmd="{{.Path}} --config /etc/cloudflared/config.yml --pidfile /var/run/$name.pid --autoupdate-freq 24h0m0s{{ range .ExtraArgs }} {{ . }}{{ end }}"
 pid_file="/var/run/$name.pid"
 stdout_log="/var/log/$name.log"
 stderr_log="/var/log/$name.err"
@@ -182,10 +190,6 @@ func isSystemd() bool {
 }
 
 func copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile string, logger logger.Service) error {
-	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
-		return err
-	}
-
 	srcCredentialPath := filepath.Join(userConfigDir, userCredentialFile)
 	destCredentialPath := filepath.Join(serviceConfigDir, serviceCredentialFile)
 	if srcCredentialPath != destCredentialPath {
@@ -216,23 +220,63 @@ func installLinuxService(c *cli.Context) error {
 	if err != nil {
 		return fmt.Errorf("error determining executable path: %v", err)
 	}
-	templateArgs := ServiceTemplateArgs{Path: etPath}
+	templateArgs := ServiceTemplateArgs{
+		Path: etPath,
+	}
 
-	userConfigDir := filepath.Dir(c.String("config"))
-	userConfigFile := filepath.Base(c.String("config"))
-	userCredentialFile := config.DefaultCredentialFile
-	if err = copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile, logger); err != nil {
-		logger.Errorf("Failed to copy user configuration: %s. Before running the service, ensure that %s contains two files, %s and %s", err,
-			serviceConfigDir, serviceCredentialFile, serviceConfigFile)
+	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
 		return err
 	}
+	if c.Bool("legacy") {
+		userConfigDir := filepath.Dir(c.String("config"))
+		userConfigFile := filepath.Base(c.String("config"))
+		userCredentialFile := config.DefaultCredentialFile
+		if err = copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile, logger); err != nil {
+			logger.Errorf("Failed to copy user configuration: %s. Before running the service, ensure that %s contains two files, %s and %s", err,
+				serviceConfigDir, serviceCredentialFile, serviceConfigFile)
+			return err
+		}
+		templateArgs.ExtraArgs = []string{
+			"--origincert", serviceConfigDir + "/" + serviceCredentialFile,
+		}
+	} else {
+		src, err := config.ReadConfigFile(c, logger)
+		if err != nil {
+			return err
+		}
+
+		// can't use context because this command doesn't define "credentials-file" flag
+		configPresent := func(s string) bool {
+			val, err := src.String(s)
+			return err == nil && val != ""
+		}
+		if src.TunnelID == "" || !configPresent("credentials-file") {
+			return fmt.Errorf(`Configuration file %s must contain entries for the tunnel to run and its associated credentials:
+tunnel: TUNNEL-UUID
+credentials-file: CREDENTIALS-FILE
+`, src.Source())
+		}
+		if src.Source() != serviceConfigPath {
+			if exists, err := config.FileExists(serviceConfigPath); err != nil || exists {
+				return fmt.Errorf("Possible conflicting configuration in %[1]s and %[2]s. Either remove %[2]s or run `cloudflared --config %[2]s service install`", src.Source(), serviceConfigPath)
+			}
+
+			if err := copyFile(src.Source(), serviceConfigPath); err != nil {
+				return fmt.Errorf("failed to copy %s to %s: %w", src.Source(), serviceConfigPath, err)
+			}
+		}
+
+		templateArgs.ExtraArgs = []string{
+			"tunnel", "run",
+		}
+	}
 
 	switch {
 	case isSystemd():
 		logger.Infof("Using Systemd")
 		return installSystemd(&templateArgs, logger)
 	default:
-		logger.Infof("Using Sysv")
+		logger.Infof("Using SysV")
 		return installSysv(&templateArgs, logger)
 	}
 }
@@ -291,7 +335,7 @@ func uninstallLinuxService(c *cli.Context) error {
 		logger.Infof("Using Systemd")
 		return uninstallSystemd(logger)
 	default:
-		logger.Infof("Using Sysv")
+		logger.Infof("Using SysV")
 		return uninstallSysv(logger)
 	}
 }

cmd/cloudflared/main.go

@@ -13,6 +13,7 @@ import (
 	log "github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/overwatch"
+	"github.com/cloudflare/cloudflared/tunneldns"
 	"github.com/cloudflare/cloudflared/watcher"
 
 	raven "github.com/getsentry/raven-go"
@@ -76,21 +77,42 @@ func main() {
 	and configure access control.`
 	app.Flags = flags()
 	app.Action = action(Version, shutdownC, graceShutdownC)
-	app.Before = tunnel.Before
+	app.Before = tunnel.SetFlagsFromConfigFile
 	app.Commands = commands(cli.ShowVersion)
 
 	tunnel.Init(Version, shutdownC, graceShutdownC) // we need this to support the tunnel sub command...
 	access.Init(shutdownC, graceShutdownC)
+	updater.Init(Version)
 	runApp(app, shutdownC, graceShutdownC)
 }
 
 func commands(version func(c *cli.Context)) []*cli.Command {
 	cmds := []*cli.Command{
 		{
-			Name:      "update",
-			Action:    cliutil.ErrorHandler(updater.Update),
-			Usage:     "Update the agent if a new version exists",
-			ArgsUsage: " ",
+			Name:   "update",
+			Action: cliutil.ErrorHandler(updater.Update),
+			Usage:  "Update the agent if a new version exists",
+			Flags: []cli.Flag{
+				&cli.BoolFlag{
+					Name:  "beta",
+					Usage: "specify if you wish to update to the latest beta version",
+				},
+				&cli.BoolFlag{
+					Name:   "force",
+					Usage:  "specify if you wish to force an upgrade to the latest version regardless of the current version",
+					Hidden: true,
+				},
+				&cli.BoolFlag{
+					Name:   "staging",
+					Usage:  "specify if you wish to use the staging url for updating",
+					Hidden: true,
+				},
+				&cli.StringFlag{
+					Name:   "version",
+					Usage:  "specify a version you wish to upgrade or downgrade to",
+					Hidden: false,
+				},
+			},
 			Description: `Looks for a new version on the official download server.
 If a new version exists, updates the agent binary and quits.
 Otherwise, does nothing.
@@ -108,6 +130,7 @@ To determine if an update happened in a script, check for error code 64.`,
 		},
 	}
 	cmds = append(cmds, tunnel.Commands()...)
+	cmds = append(cmds, tunneldns.Command(false))
 	cmds = append(cmds, access.Commands()...)
 	return cmds
 }

cmd/cloudflared/service_template.go

@@ -10,8 +10,9 @@ import (
 	"os/exec"
 	"text/template"
 
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/mitchellh/go-homedir"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 )
 
 type ServiceTemplate struct {
@@ -21,7 +22,8 @@ type ServiceTemplate struct {
 }
 
 type ServiceTemplateArgs struct {
-	Path string
+	Path      string
+	ExtraArgs []string
 }
 
 func (st *ServiceTemplate) ResolvePath() (string, error) {
@@ -139,6 +141,33 @@ func copyCredential(srcCredentialPath, destCredentialPath string) error {
 	return nil
 }
 
+func copyFile(src, dest string) error {
+	srcFile, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer srcFile.Close()
+
+	destFile, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+	ok := false
+	defer func() {
+		destFile.Close()
+		if !ok {
+			_ = os.Remove(dest)
+		}
+	}()
+
+	if _, err := io.Copy(destFile, srcFile); err != nil {
+		return err
+	}
+
+	ok = true
+	return nil
+}
+
 func copyConfig(srcConfigPath, destConfigPath string) error {
 	// Copy or create config
 	destFile, exists, err := openFile(destConfigPath, true)

cmd/cloudflared/tunnel/cmd.go

@@ -12,6 +12,7 @@ import (
 	"reflect"
 	"runtime"
 	"runtime/trace"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -112,86 +113,33 @@ func Flags() []cli.Flag {
 }
 
 func Commands() []*cli.Command {
-	cmds := []*cli.Command{
-		{
-			Name:      "login",
-			Action:    cliutil.ErrorHandler(login),
-			Usage:     "Generate a configuration file with your login details",
-			ArgsUsage: " ",
-			Flags: []cli.Flag{
-				&cli.StringFlag{
-					Name:   "url",
-					Hidden: true,
-				},
-			},
-			Hidden: true,
-		},
-		{
-			Name:   "proxy-dns",
-			Action: cliutil.ErrorHandler(tunneldns.Run),
-			Usage:  "Run a DNS over HTTPS proxy server.",
-			Flags: []cli.Flag{
-				&cli.StringFlag{
-					Name:    "metrics",
-					Value:   "localhost:",
-					Usage:   "Listen address for metrics reporting.",
-					EnvVars: []string{"TUNNEL_METRICS"},
-				},
-				&cli.StringFlag{
-					Name:    "address",
-					Usage:   "Listen address for the DNS over HTTPS proxy server.",
-					Value:   "localhost",
-					EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
-				},
-				&cli.IntFlag{
-					Name:    "port",
-					Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-					Value:   53,
-					EnvVars: []string{"TUNNEL_DNS_PORT"},
-				},
-				&cli.StringSliceFlag{
-					Name:    "upstream",
-					Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-					Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-					EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
-				},
-				&cli.StringSliceFlag{
-					Name:    "bootstrap",
-					Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
-					Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
-					EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
-				},
-			},
-			ArgsUsage: " ", // can't be the empty string or we get the default output
-			Hidden:    false,
-		},
+	subcommands := []*cli.Command{
+		buildLoginSubcommand(false),
+		buildCreateCommand(),
+		buildRouteCommand(),
+		buildRunCommand(),
+		buildListCommand(),
+		buildIngressSubcommand(),
+		buildDeleteCommand(),
+		buildCleanupCommand(),
+		// for compatibility, allow following as tunnel subcommands
+		tunneldns.Command(true),
 		dbConnectCmd(),
 	}
 
-	var subcommands []*cli.Command
-	for _, cmd := range cmds {
-		c := *cmd
-		c.Hidden = false
-		subcommands = append(subcommands, &c)
+	return []*cli.Command{
+		buildTunnelCommand(subcommands),
+		// for compatibility, allow following as top-level subcommands
+		buildLoginSubcommand(true),
+		dbConnectCmd(),
 	}
-
-	subcommands = append(subcommands, buildCreateCommand())
-	subcommands = append(subcommands, buildListCommand())
-	subcommands = append(subcommands, buildDeleteCommand())
-	subcommands = append(subcommands, buildRunCommand())
-	subcommands = append(subcommands, buildCleanupCommand())
-	subcommands = append(subcommands, buildRouteCommand())
-
-	cmds = append(cmds, buildTunnelCommand(subcommands))
-
-	return cmds
 }
 
 func buildTunnelCommand(subcommands []*cli.Command) *cli.Command {
 	return &cli.Command{
 		Name:      "tunnel",
 		Action:    cliutil.ErrorHandler(TunnelCommand),
-		Before:    Before,
+		Before:    SetFlagsFromConfigFile,
 		Category:  "Tunnel",
 		Usage:     "Make a locally-running web service accessible over the internet using Argo Tunnel.",
 		ArgsUsage: " ",
@@ -219,24 +167,27 @@ func buildTunnelCommand(subcommands []*cli.Command) *cli.Command {
 }
 
 func TunnelCommand(c *cli.Context) error {
-	if name := c.String("name"); name != "" { // Start a named tunnel
-		return adhocNamedTunnel(c, name)
-	} else { // Start a classic tunnel
-		return classicTunnel(c)
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
 	}
+	if name := c.String("name"); name != "" { // Start a named tunnel
+		return runAdhocNamedTunnel(sc, name)
+	}
+	if ref := config.GetConfiguration().TunnelID; ref != "" {
+		return fmt.Errorf("Use `cloudflared tunnel run` to start tunnel %s", ref)
+	}
+
+	// Start a classic tunnel
+	return runClassicTunnel(sc)
 }
 
 func Init(v string, s, g chan struct{}) {
 	version, shutdownC, graceShutdownC = v, s, g
 }
 
-// adhocNamedTunnel create, route and run a named tunnel in one command
-func adhocNamedTunnel(c *cli.Context, name string) error {
-	sc, err := newSubcommandContext(c)
-	if err != nil {
-		return err
-	}
-
+// runAdhocNamedTunnel create, route and run a named tunnel in one command
+func runAdhocNamedTunnel(sc *subcommandContext, name string) error {
 	tunnel, ok, err := sc.tunnelActive(name)
 	if err != nil || !ok {
 		tunnel, err = sc.create(name)
@@ -247,7 +198,7 @@ func adhocNamedTunnel(c *cli.Context, name string) error {
 		sc.logger.Infof("Tunnel already created with ID %s", tunnel.ID)
 	}
 
-	if r, ok := routeFromFlag(c); ok {
+	if r, ok := routeFromFlag(sc.c); ok {
 		if res, err := sc.route(tunnel.ID, r); err != nil {
 			sc.logger.Errorf("failed to create route, please create it manually. err: %v.", err)
 		} else {
@@ -262,14 +213,9 @@ func adhocNamedTunnel(c *cli.Context, name string) error {
 	return nil
 }
 
-// classicTunnel creates a "classic" non-named tunnel
-func classicTunnel(c *cli.Context) error {
-	sc, err := newSubcommandContext(c)
-	if err != nil {
-		return err
-	}
-
-	return StartServer(c, version, shutdownC, graceShutdownC, nil, sc.logger, sc.isUIEnabled)
+// runClassicTunnel creates a "classic" non-named tunnel
+func runClassicTunnel(sc *subcommandContext) error {
+	return StartServer(sc.c, version, shutdownC, graceShutdownC, nil, sc.logger, sc.isUIEnabled)
 }
 
 func routeFromFlag(c *cli.Context) (tunnelstore.Route, bool) {
@@ -332,12 +278,8 @@ func StartServer(
 	connectedSignal := signal.New(make(chan struct{}))
 	dnsReadySignal := make(chan struct{})
 
-	if c.String("config") == "" {
-		log.Infof(
-			"Cannot determine default configuration path. No file %v in %v",
-			config.DefaultConfigFiles,
-			config.DefaultConfigSearchDirectories(),
-		)
+	if config.GetConfiguration().Source() == "" {
+		log.Infof(config.ErrNoConfigFile.Error())
 	}
 
 	if c.IsSet("trace-output") {
@@ -506,7 +448,7 @@ func StartServer(
 	}
 
 	if staticHost := hostnameFromURI(c.String("url")); isProxyDestinationConfigured(staticHost, c) {
-		listener, err := net.Listen("tcp", "127.0.0.1:")
+		listener, err := net.Listen("tcp", net.JoinHostPort(c.String("proxy-address"), strconv.Itoa(c.Int("proxy-port"))))
 		if err != nil {
 			log.Errorf("Cannot start Websocket Proxy Server: %s", err)
 			return errors.Wrap(err, "Cannot start Websocket Proxy Server")
@@ -594,26 +536,25 @@ func forceSetFlag(c *cli.Context, name, value string) {
 	}
 }
 
-func Before(c *cli.Context) error {
-	logger, err := createLogger(c, false, false)
+func SetFlagsFromConfigFile(c *cli.Context) error {
+	const exitCode = 1
+	log, err := createLogger(c, false, false)
 	if err != nil {
 		return cliutil.PrintLoggerSetupError("error setting up logger", err)
 	}
-
-	if c.String("config") == "" {
-		logger.Debugf("Cannot determine default configuration path. No file %v in %v", config.DefaultConfigFiles, config.DefaultConfigSearchDirectories())
-	}
-	inputSource, err := config.FindInputSourceContext(c)
+	inputSource, err := config.ReadConfigFile(c, log)
 	if err != nil {
-		logger.Errorf("Cannot load configuration from %s: %s", c.String("config"), err)
-		return err
-	} else if inputSource != nil {
-		err := altsrc.ApplyInputSourceValues(c, inputSource, c.App.Flags)
-		if err != nil {
-			logger.Errorf("Cannot apply configuration from %s: %s", c.String("config"), err)
-			return err
+		if err == config.ErrNoConfigFile {
+			return nil
 		}
-		logger.Debugf("Applied configuration from %s", c.String("config"))
+		return cli.Exit(err, exitCode)
+	}
+	targetFlags := c.Command.Flags
+	if c.Command.Name == "" {
+		targetFlags = c.App.Flags
+	}
+	if err := altsrc.ApplyInputSourceValues(c, inputSource, targetFlags); err != nil {
+		return cli.Exit(err, exitCode)
 	}
 	return nil
 }
@@ -705,7 +646,7 @@ func dbConnectCmd() *cli.Command {
 
 	// Override before to run tunnel validation before dbconnect validation.
 	cmd.Before = func(c *cli.Context) error {
-		err := Before(c)
+		err := SetFlagsFromConfigFile(c)
 		if err == nil {
 			err = dbconnect.CmdBefore(c)
 		}
@@ -752,26 +693,11 @@ func appendFlags(flags []cli.Flag, extraFlags ...cli.Flag) []cli.Flag {
 }
 
 func tunnelFlags(shouldHide bool) []cli.Flag {
-	flags := []cli.Flag{
-		&cli.StringFlag{
-			Name:   "config",
-			Usage:  "Specifies a config file in YAML format.",
-			Value:  config.FindDefaultConfigPath(),
-			Hidden: shouldHide,
-		},
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:   "autoupdate-freq",
-			Usage:  fmt.Sprintf("Autoupdate frequency. Default is %v.", updater.DefaultCheckUpdateFreq),
-			Value:  updater.DefaultCheckUpdateFreq,
-			Hidden: shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "no-autoupdate",
-			Usage:   "Disable periodic check for updates, restarting the server with the new version.",
-			EnvVars: []string{"NO_AUTOUPDATE"},
-			Value:   false,
-			Hidden:  shouldHide,
-		}),
+	flags := configureCloudflaredFlags(shouldHide)
+	flags = append(flags, configureProxyFlags(shouldHide)...)
+	flags = append(flags, configureLoggingFlags(shouldHide)...)
+	flags = append(flags, configureProxyDNSFlags(shouldHide)...)
+	flags = append(flags, []cli.Flag{
 		altsrc.NewBoolFlag(&cli.BoolFlag{
 			Name:   "is-autoupdated",
 			Usage:  "Signal the new process that Argo Tunnel client has been autoupdated",
@@ -790,49 +716,12 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_CACERT"},
 			Hidden:  true,
 		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "no-tls-verify",
-			Usage:   "Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. Note: The connection from your machine to Cloudflare's Edge is still encrypted.",
-			EnvVars: []string{"NO_TLS_VERIFY"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "origincert",
-			Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
-			EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
-			Value:   findDefaultOriginCertPath(),
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    tlsconfig.OriginCAPoolFlag,
-			Usage:   "Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.",
-			EnvVars: []string{"TUNNEL_ORIGIN_CA_POOL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "unix-socket",
-			Usage:   "Path to unix socket to use instead of --url",
-			EnvVars: []string{"TUNNEL_UNIX_SOCKET"},
-			Hidden:  shouldHide,
-		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "hostname",
 			Usage:   "Set a hostname on a Cloudflare zone to route traffic through this tunnel.",
 			EnvVars: []string{"TUNNEL_HOSTNAME"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "http-host-header",
-			Usage:   "Sets the HTTP Host header for the local webserver.",
-			EnvVars: []string{"TUNNEL_HTTP_HOST_HEADER"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "origin-server-name",
-			Usage:   "Hostname on the origin server certificate.",
-			EnvVars: []string{"TUNNEL_ORIGIN_SERVER_NAME"},
-			Hidden:  shouldHide,
-		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "id",
 			Usage:   "A unique identifier used to tie connections to this tunnel instance.",
@@ -870,13 +759,6 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:   "https://api.cloudflare.com/client/v4",
 			Hidden:  true,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "metrics",
-			Value:   "localhost:",
-			Usage:   "Listen address for metrics reporting.",
-			EnvVars: []string{"TUNNEL_METRICS"},
-			Hidden:  shouldHide,
-		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
 			Name:    "metrics-update-freq",
 			Usage:   "Frequency to update tunnel metrics",
@@ -902,21 +784,6 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:  5,
 			Hidden: true,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "loglevel",
-			Value:   "info",
-			Usage:   "Application logging level {fatal, error, info, debug}. " + debugLevelWarning,
-			EnvVars: []string{"TUNNEL_LOGLEVEL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "transport-loglevel",
-			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
-			Value:   "fatal",
-			Usage:   "Transport logging level(previously called protocol logging level) {fatal, error, info, debug}",
-			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
-			Hidden:  shouldHide,
-		}),
 		altsrc.NewUintFlag(&cli.UintFlag{
 			Name:    "retries",
 			Value:   5,
@@ -924,28 +791,130 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_RETRIES"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:   "ha-connections",
+			Value:  4,
+			Hidden: true,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:    "grace-period",
+			Usage:   "Duration to accept new requests after cloudflared receives first SIGINT/SIGTERM. A second SIGINT/SIGTERM will force cloudflared to shutdown immediately.",
+			Value:   time.Second * 30,
+			EnvVars: []string{"TUNNEL_GRACE_PERIOD"},
+			Hidden:  true,
+		}),
+		altsrc.NewUintFlag(&cli.UintFlag{
+			Name:    "compression-quality",
+			Value:   0,
+			Usage:   "(beta) Use cross-stream compression instead HTTP compression. 0-off, 1-low, 2-medium, >=3-high.",
+			EnvVars: []string{"TUNNEL_COMPRESSION_LEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "use-reconnect-token",
+			Usage:   "Test reestablishing connections with the new 'reconnect token' flow.",
+			Value:   true,
+			EnvVars: []string{"TUNNEL_USE_RECONNECT_TOKEN"},
+			Hidden:  true,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:    "dial-edge-timeout",
+			Usage:   "Maximum wait time to set up a connection with the edge",
+			Value:   time.Second * 15,
+			EnvVars: []string{"DIAL_EDGE_TIMEOUT"},
+			Hidden:  true,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "stdin-control",
+			Usage:   "Control the process using commands sent through stdin",
+			EnvVars: []string{"STDIN-CONTROL"},
+			Hidden:  true,
+			Value:   false,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "name",
+			Aliases: []string{"n"},
+			EnvVars: []string{"TUNNEL_NAME"},
+			Usage:   "Stable name to identify the tunnel. Using this flag will create, route and run a tunnel. For production usage, execute each command separately",
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:   uiFlag,
+			Usage:  "Launch tunnel UI. Tunnel logs are scrollable via 'j', 'k', or arrow keys.",
+			Value:  false,
+			Hidden: shouldHide,
+		}),
+	}...)
+
+	return flags
+}
+
+// Flags in tunnel command that is relevant to run subcommand
+func configureCloudflaredFlags(shouldHide bool) []cli.Flag {
+	return []cli.Flag{
+		&cli.StringFlag{
+			Name:   "config",
+			Usage:  "Specifies a config file in YAML format.",
+			Value:  config.FindDefaultConfigPath(),
+			Hidden: shouldHide,
+		},
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "origincert",
+			Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
+			EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
+			Value:   findDefaultOriginCertPath(),
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewDurationFlag(&cli.DurationFlag{
+			Name:   "autoupdate-freq",
+			Usage:  fmt.Sprintf("Autoupdate frequency. Default is %v.", updater.DefaultCheckUpdateFreq),
+			Value:  updater.DefaultCheckUpdateFreq,
+			Hidden: shouldHide,
+		}),
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "no-autoupdate",
+			Usage:   "Disable periodic check for updates, restarting the server with the new version.",
+			EnvVars: []string{"NO_AUTOUPDATE"},
+			Value:   false,
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "metrics",
+			Value:   "localhost:",
+			Usage:   "Listen address for metrics reporting.",
+			EnvVars: []string{"TUNNEL_METRICS"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "pidfile",
 			Usage:   "Write the application's PID to this file after first successful connection.",
 			EnvVars: []string{"TUNNEL_PIDFILE"},
 			Hidden:  shouldHide,
 		}),
+	}
+}
+
+func configureProxyFlags(shouldHide bool) []cli.Flag {
+	flags := []cli.Flag{
 		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "logfile",
-			Usage:   "Save application log to this file for reporting issues.",
-			EnvVars: []string{"TUNNEL_LOGFILE"},
+			Name:    "url",
+			Value:   "http://localhost:8080",
+			Usage:   "Connect to the local webserver at `URL`.",
+			EnvVars: []string{"TUNNEL_URL"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    logDirectoryFlag,
-			Usage:   "Save application log to this directory for reporting issues.",
-			EnvVars: []string{"TUNNEL_LOGDIRECTORY"},
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "hello-world",
+			Value:   false,
+			Usage:   "Run Hello World Server",
+			EnvVars: []string{"TUNNEL_HELLO_WORLD"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:   "ha-connections",
-			Value:  4,
-			Hidden: true,
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    socks5Flag,
+			Usage:   "specify if this tunnel is running as a SOCK5 Server",
+			EnvVars: []string{"TUNNEL_SOCKS"},
+			Value:   false,
+			Hidden:  shouldHide,
 		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
 			Name:   "proxy-connect-timeout",
@@ -994,52 +963,34 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:  time.Second * 90,
 			Hidden: shouldHide,
 		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "proxy-dns",
-			Usage:   "Run a DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:    "proxy-dns-port",
-			Value:   53,
-			Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS_PORT"},
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "http-host-header",
+			Usage:   "Sets the HTTP Host header for the local webserver.",
+			EnvVars: []string{"TUNNEL_HTTP_HOST_HEADER"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "proxy-dns-address",
-			Usage:   "Listen address for the DNS over HTTPS proxy server.",
-			Value:   "localhost",
-			EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
+			Name:    "origin-server-name",
+			Usage:   "Hostname on the origin server certificate.",
+			EnvVars: []string{"TUNNEL_ORIGIN_SERVER_NAME"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "proxy-dns-upstream",
-			Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-			Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "unix-socket",
+			Usage:   "Path to unix socket to use instead of --url",
+			EnvVars: []string{"TUNNEL_UNIX_SOCKET"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "proxy-dns-bootstrap",
-			Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
-			Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
-			EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    tlsconfig.OriginCAPoolFlag,
+			Usage:   "Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.",
+			EnvVars: []string{"TUNNEL_ORIGIN_CA_POOL"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:    "grace-period",
-			Usage:   "Duration to accept new requests after cloudflared receives first SIGINT/SIGTERM. A second SIGINT/SIGTERM will force cloudflared to shutdown immediately.",
-			Value:   time.Second * 30,
-			EnvVars: []string{"TUNNEL_GRACE_PERIOD"},
-			Hidden:  true,
-		}),
-		altsrc.NewUintFlag(&cli.UintFlag{
-			Name:    "compression-quality",
-			Value:   0,
-			Usage:   "(beta) Use cross-stream compression instead HTTP compression. 0-off, 1-low, 2-medium, >=3-high.",
-			EnvVars: []string{"TUNNEL_COMPRESSION_LEVEL"},
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "no-tls-verify",
+			Usage:   "Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. Note: The connection from your machine to Cloudflare's Edge is still encrypted.",
+			EnvVars: []string{"NO_TLS_VERIFY"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
@@ -1048,72 +999,10 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_NO_CHUNKED_ENCODING"},
 			Hidden:  shouldHide,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "trace-output",
-			Usage:   "Name of trace output file, generated when cloudflared stops.",
-			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "use-reconnect-token",
-			Usage:   "Test reestablishing connections with the new 'reconnect token' flow.",
-			Value:   true,
-			EnvVars: []string{"TUNNEL_USE_RECONNECT_TOKEN"},
-			Hidden:  true,
-		}),
-		altsrc.NewDurationFlag(&cli.DurationFlag{
-			Name:    "dial-edge-timeout",
-			Usage:   "Maximum wait time to set up a connection with the edge",
-			Value:   time.Second * 15,
-			EnvVars: []string{"DIAL_EDGE_TIMEOUT"},
-			Hidden:  true,
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    "stdin-control",
-			Usage:   "Control the process using commands sent through stdin",
-			EnvVars: []string{"STDIN-CONTROL"},
-			Hidden:  true,
-			Value:   false,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "name",
-			Aliases: []string{"n"},
-			EnvVars: []string{"TUNNEL_NAME"},
-			Usage:   "Stable name to identify the tunnel. Using this flag will create, route and run a tunnel. For production usage, execute each command separately",
-		}),
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:   uiFlag,
-			Usage:  "Launch tunnel UI. Tunnel logs are scrollable via 'j', 'k', or arrow keys.",
-			Value:  false,
-			Hidden: shouldHide,
-		}),
-		urlFlag(shouldHide),
-		helloWorldFlag(shouldHide),
-		createSocks5Flag(shouldHide),
 	}
 	return append(flags, sshFlags(shouldHide)...)
 }
 
-func urlFlag(shouldHide bool) cli.Flag {
-	return altsrc.NewStringFlag(&cli.StringFlag{
-		Name:    "url",
-		Value:   "http://localhost:8080",
-		Usage:   "Connect to the local webserver at `URL`.",
-		EnvVars: []string{"TUNNEL_URL"},
-		Hidden:  shouldHide,
-	})
-}
-
-func helloWorldFlag(shouldHide bool) cli.Flag {
-	return altsrc.NewBoolFlag(&cli.BoolFlag{
-		Name:    "hello-world",
-		Value:   false,
-		Usage:   "Run Hello World Server",
-		EnvVars: []string{"TUNNEL_HELLO_WORLD"},
-		Hidden:  shouldHide,
-	})
-}
-
 func sshFlags(shouldHide bool) []cli.Flag {
 	return []cli.Flag{
 		altsrc.NewStringFlag(&cli.StringFlag{
@@ -1191,17 +1080,98 @@ func sshFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_BASTION"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "proxy-address",
+			Usage:   "Listen address for the proxy.",
+			Value:   "127.0.0.1",
+			EnvVars: []string{"TUNNEL_PROXY_ADDRESS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:    "proxy-port",
+			Usage:   "Listen port for the proxy.",
+			Value:   0,
+			EnvVars: []string{"TUNNEL_PROXY_PORT"},
+			Hidden:  shouldHide,
+		}),
 	}
 }
 
-func createSocks5Flag(shouldHide bool) cli.Flag {
-	return altsrc.NewBoolFlag(&cli.BoolFlag{
-		Name:    socks5Flag,
-		Usage:   "specify if this tunnel is running as a SOCK5 Server",
-		EnvVars: []string{"TUNNEL_SOCKS"},
-		Value:   false,
-		Hidden:  shouldHide,
-	})
+func configureLoggingFlags(shouldHide bool) []cli.Flag {
+	return []cli.Flag{
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "loglevel",
+			Value:   "info",
+			Usage:   "Application logging level {fatal, error, info, debug}. " + debugLevelWarning,
+			EnvVars: []string{"TUNNEL_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "transport-loglevel",
+			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
+			Value:   "fatal",
+			Usage:   "Transport logging level(previously called protocol logging level) {fatal, error, info, debug}",
+			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "logfile",
+			Usage:   "Save application log to this file for reporting issues.",
+			EnvVars: []string{"TUNNEL_LOGFILE"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    logDirectoryFlag,
+			Usage:   "Save application log to this directory for reporting issues.",
+			EnvVars: []string{"TUNNEL_LOGDIRECTORY"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "trace-output",
+			Usage:   "Name of trace output file, generated when cloudflared stops.",
+			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
+			Hidden:  shouldHide,
+		}),
+	}
+}
+
+func configureProxyDNSFlags(shouldHide bool) []cli.Flag {
+	return []cli.Flag{
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name:    "proxy-dns",
+			Usage:   "Run a DNS over HTTPS proxy server.",
+			EnvVars: []string{"TUNNEL_DNS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:    "proxy-dns-port",
+			Value:   53,
+			Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
+			EnvVars: []string{"TUNNEL_DNS_PORT"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "proxy-dns-address",
+			Usage:   "Listen address for the DNS over HTTPS proxy server.",
+			Value:   "localhost",
+			EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name:    "proxy-dns-upstream",
+			Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
+			Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
+			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name:    "proxy-dns-bootstrap",
+			Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
+			Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
+			EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
+			Hidden:  shouldHide,
+		}),
+	}
 }
 
 func stdinControl(reconnectCh chan origin.ReconnectSignal, logger logger.Service) {

cmd/cloudflared/tunnel/configuration.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/buildinfo"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/tlsconfig"
@@ -184,12 +185,6 @@ func prepareTunnelConfig(
 
 	tags = append(tags, tunnelpogs.Tag{Name: "ID", Value: clientID})
 
-	originURL, err := config.ValidateUrl(c, compatibilityMode)
-	if err != nil {
-		logger.Errorf("Error validating origin URL: %s", err)
-		return nil, errors.Wrap(err, "Error validating origin URL")
-	}
-
 	var originCert []byte
 	if !isFreeTunnel {
 		originCert, err = getOriginCert(c, logger)
@@ -224,6 +219,36 @@ func prepareTunnelConfig(
 	}
 	dialContext := dialer.DialContext
 
+	var ingressRules ingress.Ingress
+	if namedTunnel != nil {
+		clientUUID, err := uuid.NewRandom()
+		if err != nil {
+			return nil, errors.Wrap(err, "can't generate clientUUID")
+		}
+		namedTunnel.Client = tunnelpogs.ClientInfo{
+			ClientID: clientUUID[:],
+			Features: []string{origin.FeatureSerializedHeaders},
+			Version:  version,
+			Arch:     fmt.Sprintf("%s_%s", buildInfo.GoOS, buildInfo.GoArch),
+		}
+		ingressRules, err = ingress.ParseIngress(config.GetConfiguration())
+		if err != nil && err != ingress.ErrNoIngressRules {
+			return nil, err
+		}
+		if !ingressRules.IsEmpty() && c.IsSet("url") {
+			return nil, ingress.ErrURLIncompatibleWithIngress
+		}
+	}
+
+	var originURL string
+	if ingressRules.IsEmpty() {
+		originURL, err = config.ValidateUrl(c, compatibilityMode)
+		if err != nil {
+			logger.Errorf("Error validating origin URL: %s", err)
+			return nil, errors.Wrap(err, "Error validating origin URL")
+		}
+	}
+
 	if c.IsSet("unix-socket") {
 		unixSocket, err := config.ValidateUnixSocket(c)
 		if err != nil {
@@ -246,8 +271,22 @@ func prepareTunnelConfig(
 	}
 	// If tunnel running in bastion mode, a connection to origin will not exist until initiated by the client.
 	if !c.IsSet(bastionFlag) {
-		if err = validation.ValidateHTTPService(originURL, hostname, httpTransport); err != nil {
-			logger.Errorf("unable to connect to the origin: %s", err)
+
+		// List all origin URLs that require validation
+		var originURLs []string
+		if ingressRules.IsEmpty() {
+			originURLs = append(originURLs, originURL)
+		} else {
+			for _, rule := range ingressRules.Rules {
+				originURLs = append(originURLs, rule.Service.String())
+			}
+		}
+
+		// Validate each origin URL
+		for _, u := range originURLs {
+			if err = validation.ValidateHTTPService(u, hostname, httpTransport); err != nil {
+				logger.Errorf("unable to connect to the origin: %s", err)
+			}
 		}
 	}
 
@@ -256,20 +295,6 @@ func prepareTunnelConfig(
 		logger.Errorf("unable to create TLS config to connect with edge: %s", err)
 		return nil, errors.Wrap(err, "unable to create TLS config to connect with edge")
 	}
-
-	if namedTunnel != nil {
-		clientUUID, err := uuid.NewRandom()
-		if err != nil {
-			return nil, errors.Wrap(err, "can't generate clientUUID")
-		}
-		namedTunnel.Client = tunnelpogs.ClientInfo{
-			ClientID: clientUUID[:],
-			Features: []string{origin.FeatureSerializedHeaders},
-			Version:  version,
-			Arch:     fmt.Sprintf("%s_%s", buildInfo.GoOS, buildInfo.GoArch),
-		}
-	}
-
 	return &origin.TunnelConfig{
 		BuildInfo:          buildInfo,
 		ClientID:           clientID,
@@ -301,6 +326,7 @@ func prepareTunnelConfig(
 		TlsConfig:          toEdgeTLSConfig,
 		NamedTunnel:        namedTunnel,
 		ReplaceExisting:    c.Bool("force"),
+		IngressRules:       ingressRules,
 		// turn off use of reconnect token and auth refresh when using named tunnels
 		UseReconnectToken: compatibilityMode && c.Bool("use-reconnect-token"),
 	}, nil

cmd/cloudflared/tunnel/ingress_subcommands.go

@@ -0,0 +1,110 @@
+package tunnel
+
+import (
+	"fmt"
+	"net/url"
+
+	"github.com/pkg/errors"
+	"github.com/urfave/cli/v2"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/cloudflare/cloudflared/ingress"
+)
+
+func buildIngressSubcommand() *cli.Command {
+	return &cli.Command{
+		Name:      "ingress",
+		Category:  "Tunnel",
+		Usage:     "Validate and test cloudflared tunnel's ingress configuration",
+		UsageText: "cloudflared tunnel [--config FILEPATH] ingress COMMAND [arguments...]",
+		Hidden:    true,
+		Description: ` Cloudflared lets you route traffic from the internet to multiple different addresses on your
+		origin. Multiple-origin routing is configured by a set of rules. Each rule matches traffic
+		by its hostname or path, and routes it to an address. These rules are configured under the
+		'ingress' key of your config.yaml, for example:
+
+		ingress:
+		  - hostname: www.example.com
+		    service: https://localhost:8000
+		  - hostname: *.example.xyz
+		    path: /[a-zA-Z]+.html
+		    service: https://localhost:8001
+		  - hostname: *
+		    service: https://localhost:8002
+
+		To ensure cloudflared can route all incoming requests, the last rule must be a catch-all
+		rule that matches all traffic. You can validate these rules with the 'ingress validate'
+		command, and test which rule matches a particular URL with 'ingress rule <URL>'.
+
+		Multiple-origin routing is incompatible with the --url flag.`,
+		Subcommands: []*cli.Command{buildValidateIngressCommand(), buildTestURLCommand()},
+	}
+}
+
+func buildValidateIngressCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "validate",
+		Action:      cliutil.ErrorHandler(validateIngressCommand),
+		Usage:       "Validate the ingress configuration ",
+		UsageText:   "cloudflared tunnel [--config FILEPATH] ingress validate",
+		Description: "Validates the configuration file, ensuring your ingress rules are OK.",
+	}
+}
+
+func buildTestURLCommand() *cli.Command {
+	return &cli.Command{
+		Name:      "rule",
+		Action:    cliutil.ErrorHandler(testURLCommand),
+		Usage:     "Check which ingress rule matches a given request URL",
+		UsageText: "cloudflared tunnel [--config FILEPATH] ingress rule URL",
+		ArgsUsage: "URL",
+		Description: "Check which ingress rule matches a given request URL. " +
+			"Ingress rules match a request's hostname and path. Hostname is " +
+			"optional and is either a full hostname like `www.example.com` or a " +
+			"hostname with a `*` for its subdomains, e.g. `*.example.com`. Path " +
+			"is optional and matches a regular expression, like `/[a-zA-Z0-9_]+.html`",
+	}
+}
+
+// validateIngressCommand check the syntax of the ingress rules in the cloudflared config file
+func validateIngressCommand(c *cli.Context) error {
+	conf := config.GetConfiguration()
+	fmt.Println("Validating rules from", conf.Source())
+	if _, err := ingress.ParseIngress(conf); err != nil {
+		return errors.Wrap(err, "Validation failed")
+	}
+	if c.IsSet("url") {
+		return ingress.ErrURLIncompatibleWithIngress
+	}
+	fmt.Println("OK")
+	return nil
+}
+
+// testURLCommand checks which ingress rule matches the given URL.
+func testURLCommand(c *cli.Context) error {
+	requestArg := c.Args().First()
+	if requestArg == "" {
+		return errors.New("cloudflared tunnel rule expects a single argument, the URL to test")
+	}
+
+	requestURL, err := url.Parse(requestArg)
+	if err != nil {
+		return fmt.Errorf("%s is not a valid URL", requestArg)
+	}
+	if requestURL.Hostname() == "" && requestURL.Scheme == "" {
+		return fmt.Errorf("%s doesn't have a hostname, consider adding a scheme", requestArg)
+	}
+
+	conf := config.GetConfiguration()
+	fmt.Println("Using rules from", conf.Source())
+	ing, err := ingress.ParseIngress(conf)
+	if err != nil {
+		return errors.Wrap(err, "Validation failed")
+	}
+
+	i := ing.FindMatchingRule(requestURL.Hostname(), requestURL.Path)
+	fmt.Printf("Matched rule #%d\n", i+1)
+	fmt.Println(ing.Rules[i].MultiLineString())
+	return nil
+}

cmd/cloudflared/tunnel/login.go

@@ -7,12 +7,14 @@ import (
 	"path/filepath"
 	"syscall"
 
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/transfer"
-	"github.com/cloudflare/cloudflared/logger"
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	cli "github.com/urfave/cli/v2"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/transfer"
+	"github.com/cloudflare/cloudflared/logger"
 )
 
 const (
@@ -20,6 +22,22 @@ const (
 	callbackStoreURL = "https://login.argotunnel.com/"
 )
 
+func buildLoginSubcommand(hidden bool) *cli.Command {
+	return &cli.Command{
+		Name:      "login",
+		Action:    cliutil.ErrorHandler(login),
+		Usage:     "Generate a configuration file with your login details",
+		ArgsUsage: " ",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:   "url",
+				Hidden: true,
+			},
+		},
+		Hidden: hidden,
+	}
+}
+
 func login(c *cli.Context) error {
 	logger, err := logger.New()
 	if err != nil {

cmd/cloudflared/tunnel/subcommand_context.go

@@ -8,15 +8,16 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+	"github.com/urfave/cli/v2"
+
 	"github.com/cloudflare/cloudflared/certutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/tunnelstore"
-	"github.com/google/uuid"
-	"github.com/pkg/errors"
-	"github.com/urfave/cli/v2"
 )
 
 // subcommandContext carries structs shared between subcommands, to reduce number of arguments needed to
@@ -120,6 +121,7 @@ func (sc *subcommandContext) tunnelCredentialsPath(tunnelID uuid.UUID) (string,
 		if validFilePath(filePath) {
 			return filePath, nil
 		}
+		return "", fmt.Errorf("Tunnel credentials file %s doesn't exist or is not a file", filePath)
 	}
 
 	// Fallback to look for tunnel credentials in the origin cert directory

cmd/cloudflared/tunnel/subcommands.go

@@ -17,10 +17,12 @@ import (
 	"github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v2/altsrc"
 	"golang.org/x/net/idna"
 	"gopkg.in/yaml.v2"
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/tunnelstore"
@@ -58,24 +60,24 @@ var (
 		Aliases: []string{"rd"},
 		Usage:   "Include connections that have recently disconnected in the list",
 	}
-	outputFormatFlag = &cli.StringFlag{
+	outputFormatFlag = altsrc.NewStringFlag(&cli.StringFlag{
 		Name:    "output",
 		Aliases: []string{"o"},
 		Usage:   "Render output using given `FORMAT`. Valid options are 'json' or 'yaml'",
-	}
-	forceFlag = &cli.BoolFlag{
+	})
+	forceFlag = altsrc.NewBoolFlag(&cli.BoolFlag{
 		Name:    "force",
 		Aliases: []string{"f"},
 		Usage: "By default, if a tunnel is currently being run from a cloudflared, you can't " +
 			"simultaneously rerun it again from a second cloudflared. The --force flag lets you " +
 			"overwrite the previous tunnel. If you want to use a single hostname with multiple " +
 			"tunnels, you can do so with Cloudflare's Load Balancer product.",
-	}
-	credentialsFileFlag = &cli.StringFlag{
+	})
+	credentialsFileFlag = altsrc.NewStringFlag(&cli.StringFlag{
 		Name:    "credentials-file",
 		Aliases: []string{credFileFlagAlias},
 		Usage:   "File path of tunnel credentials",
-	}
+	})
 	forceDeleteFlag = &cli.BoolFlag{
 		Name:    "force",
 		Aliases: []string{"f"},
@@ -85,11 +87,18 @@ var (
 
 func buildCreateCommand() *cli.Command {
 	return &cli.Command{
-		Name:      "create",
-		Action:    cliutil.ErrorHandler(createCommand),
-		Usage:     "Create a new tunnel with given name",
-		ArgsUsage: "TUNNEL-NAME",
-		Flags:     []cli.Flag{outputFormatFlag},
+		Name:               "create",
+		Action:             cliutil.ErrorHandler(createCommand),
+		Usage:              "Create a new tunnel with given name",
+		UsageText:          "cloudflared tunnel [tunnel command options] create [subcommand options] NAME",
+		Description:        `Creates a tunnel, registers it with Cloudflare edge and generates credential file used to run this tunnel.
+  Use "cloudflared tunnel route" subcommand to map a DNS name to this tunnel and "cloudflared tunnel run" to start the connection. 
+
+  For example, to create a tunnel named 'my-tunnel' run:
+
+  $ cloudflared tunnel create my-tunnel`,
+		Flags:              []cli.Flag{outputFormatFlag},
+		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
 
@@ -149,11 +158,13 @@ func validFilePath(path string) bool {
 
 func buildListCommand() *cli.Command {
 	return &cli.Command{
-		Name:      "list",
-		Action:    cliutil.ErrorHandler(listCommand),
-		Usage:     "List existing tunnels",
-		ArgsUsage: " ",
-		Flags:     []cli.Flag{outputFormatFlag, showDeletedFlag, listNameFlag, listExistedAtFlag, listIDFlag, showRecentlyDisconnected},
+		Name:               "list",
+		Action:             cliutil.ErrorHandler(listCommand),
+		Usage:              "List existing tunnels",
+		UsageText:          "cloudflared tunnel [tunnel command options] list [subcommand options]",
+		Description:        "cloudflared tunnel list will display all active tunnels, their created time and associated connections. Use -d flag to include deleted tunnels. See the list of options to filter the list",
+		Flags:              []cli.Flag{outputFormatFlag, showDeletedFlag, listNameFlag, listExistedAtFlag, listIDFlag, showRecentlyDisconnected},
+		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
 
@@ -253,11 +264,13 @@ func fmtConnections(connections []tunnelstore.Connection, showRecentlyDisconnect
 
 func buildDeleteCommand() *cli.Command {
 	return &cli.Command{
-		Name:      "delete",
-		Action:    cliutil.ErrorHandler(deleteCommand),
-		Usage:     "Delete existing tunnel by UUID or name",
-		ArgsUsage: "TUNNEL",
-		Flags:     []cli.Flag{credentialsFileFlag, forceDeleteFlag},
+		Name:               "delete",
+		Action:             cliutil.ErrorHandler(deleteCommand),
+		Usage:              "Delete existing tunnel by UUID or name",
+		UsageText:          "cloudflared tunnel [tunnel command options] delete [subcommand options] TUNNEL",
+		Description:        "cloudflared tunnel delete will delete tunnels with the given tunnel UUIDs or names. A tunnel cannot be deleted if it has active connections. To delete the tunnel unconditionally, use -f flag.",
+		Flags:              []cli.Flag{credentialsFileFlag, forceDeleteFlag},
+		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
 
@@ -296,45 +309,25 @@ func buildRunCommand() *cli.Command {
 	flags := []cli.Flag{
 		forceFlag,
 		credentialsFileFlag,
-		urlFlag(false),
-		helloWorldFlag(false),
-		createSocks5Flag(false),
 	}
-	flags = append(flags, sshFlags(false)...)
-	var runCommandHelpTemplate = `NAME:
-   {{.HelpName}} - {{.Usage}}
-
-USAGE:
-   {{.UsageText}}
-
-DESCRIPTION:
-   {{.Description}}
-
-TUNNEL COMMAND OPTIONS:
-	See cloudflared tunnel -h
-
-RUN COMMAND OPTIONS:
-   {{range .VisibleFlags}}{{.}}
-   {{end}}
-`
+	flags = append(flags, configureProxyFlags(false)...)
 	return &cli.Command{
 		Name:      "run",
 		Action:    cliutil.ErrorHandler(runCommand),
+		Before:    SetFlagsFromConfigFile,
 		Usage:     "Proxy a local web server by running the given tunnel",
-		UsageText: "cloudflared tunnel [tunnel command options] run [run command options]",
-		ArgsUsage: "TUNNEL",
-		Description: `Runs the tunnel identified by name or UUUD, creating a highly available connection 
-   between your server and the Cloudflare edge.
+		UsageText: "cloudflared tunnel [tunnel command options] run [subcommand options] [TUNNEL]",
+		Description: `Runs the tunnel identified by name or UUUD, creating highly available connections 
+  between your server and the Cloudflare edge. You can provide name or UUID of tunnel to run either as the
+  last command line argument or in the configuration file using "tunnel: TUNNEL".
 
-   This command requires the tunnel credentials file created when "cloudflared tunnel create" was run, 
-   however it does not need access to cert.pem from "cloudflared login". If you experience problems running
-   the tunnel, "cloudflared tunnel cleanup" may help by removing any old connection records.
-
-   All the flags from the tunnel command are available, note that they have to be specified before the run command. There are flags defined both in tunnel and run command. The one in run command will take precedence.
-   For example cloudflared tunnel --url localhost:3000 run --url localhost:5000 <TUNNEL ID> will proxy requests to localhost:5000.
+  This command requires the tunnel credentials file created when "cloudflared tunnel create" was run, 
+  however it does not need access to cert.pem from "cloudflared login" if you identify the tunnel by UUID.
+  If you experience other problems running the tunnel, "cloudflared tunnel cleanup" may help by removing 
+  any old connection records.
 `,
 		Flags:              flags,
-		CustomHelpTemplate: runCommandHelpTemplate,
+		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
 
@@ -344,23 +337,40 @@ func runCommand(c *cli.Context) error {
 		return err
 	}
 
-	if c.NArg() != 1 {
-		return cliutil.UsageError(`"cloudflared tunnel run" requires exactly 1 argument, the ID or name of the tunnel to run.`)
+	if c.NArg() > 1 {
+		return cliutil.UsageError(`"cloudflared tunnel run" accepts only one argument, the ID or name of the tunnel to run.`)
 	}
-	tunnelID, err := sc.findID(c.Args().First())
+	tunnelRef := c.Args().First()
+	if tunnelRef == "" {
+		// see if tunnel id was in the config file
+		tunnelRef = config.GetConfiguration().TunnelID
+		if tunnelRef == "" {
+			return cliutil.UsageError(`"cloudflared tunnel run" requires the ID or name of the tunnel to run as the last command line argument or in the configuration file.`)
+		}
+	}
+
+	return runNamedTunnel(sc, tunnelRef)
+}
+
+func runNamedTunnel(sc *subcommandContext, tunnelRef string) error {
+	tunnelID, err := sc.findID(tunnelRef)
 	if err != nil {
 		return errors.Wrap(err, "error parsing tunnel ID")
 	}
 
+	sc.logger.Infof("Starting tunnel %s", tunnelID.String())
+
 	return sc.run(tunnelID)
 }
 
 func buildCleanupCommand() *cli.Command {
 	return &cli.Command{
-		Name:      "cleanup",
-		Action:    cliutil.ErrorHandler(cleanupCommand),
-		Usage:     "Cleanup tunnel connections",
-		ArgsUsage: "TUNNEL",
+		Name:               "cleanup",
+		Action:             cliutil.ErrorHandler(cleanupCommand),
+		Usage:              "Cleanup tunnel connections",
+		UsageText:          "cloudflared tunnel [tunnel command options] cleanup [subcommand options] TUNNEL",
+		Description:        "Delete connections for tunnels with the given UUIDs or names.",
+		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
 
@@ -384,16 +394,17 @@ func cleanupCommand(c *cli.Context) error {
 
 func buildRouteCommand() *cli.Command {
 	return &cli.Command{
-		Name:   "route",
-		Action: cliutil.ErrorHandler(routeCommand),
-		Usage:  "Define what hostname or load balancer can route to this tunnel",
+		Name:      "route",
+		Action:    cliutil.ErrorHandler(routeCommand),
+		Usage:     "Define what hostname or load balancer can route to this tunnel",
+		UsageText: "cloudflared tunnel [tunnel command options] route [subcommand options] dns|lb TUNNEL HOSTNAME [LB-POOL]",
 		Description: `The route defines what hostname or load balancer will proxy requests to this tunnel.
 
    To route a hostname by creating a CNAME to tunnel's address:
       cloudflared tunnel route dns <tunnel ID> <hostname>
    To use this tunnel as a load balancer origin, creating pool and load balancer if necessary:
       cloudflared tunnel route lb <tunnel ID> <load balancer name> <load balancer pool>`,
-		ArgsUsage: "dns|lb TUNNEL HOSTNAME [LB-POOL]",
+		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
 
@@ -501,3 +512,29 @@ func routeCommand(c *cli.Context) error {
 	sc.logger.Infof(res.SuccessSummary())
 	return nil
 }
+
+func commandHelpTemplate() string {
+	var parentFlagsHelp string
+	for _, f := range configureCloudflaredFlags(false) {
+		parentFlagsHelp += fmt.Sprintf(" %s\n\t", f)
+	}
+	for _, f := range configureLoggingFlags(false) {
+		parentFlagsHelp += fmt.Sprintf(" %s\n\t", f)
+	}
+	const template = `NAME:
+	{{.HelpName}} - {{.Usage}}
+	
+USAGE:
+	{{.UsageText}}
+ 
+DESCRIPTION:
+	{{.Description}}
+ 
+TUNNEL COMMAND OPTIONS:
+	%s
+SUBCOMMAND OPTIONS:
+	{{range .VisibleFlags}}{{.}}
+	{{end}}
+`
+	return fmt.Sprintf(template, parentFlagsHelp)
+}

cmd/cloudflared/updater/service.go

@@ -0,0 +1,26 @@
+package updater
+
+// Version is the functions needed to perform an update
+type Version interface {
+	Apply() error
+	String() string
+}
+
+// Service is the functions to get check for new updates
+type Service interface {
+	Check() (Version, error)
+}
+
+const (
+	// OSKeyName is the url parameter key to send to the checkin API for the operating system of the local cloudflared (e.g. windows, darwin, linux)
+	OSKeyName = "os"
+
+	// ArchitectureKeyName is the url parameter key to send to the checkin API for the architecture of the local cloudflared (e.g. amd64, x86)
+	ArchitectureKeyName = "arch"
+
+	// BetaKeyName is the url parameter key to send to the checkin API to signal if the update should be a beta version or not
+	BetaKeyName = "beta"
+
+	// VersionKeyName is the url parameter key to send to the checkin API to specific what version to upgrade or downgrade to
+	VersionKeyName = "version"
+)

cmd/cloudflared/updater/update.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
-	"github.com/equinox-io/equinox"
 	"github.com/facebookgo/grace/gracenet"
 	"github.com/pkg/errors"
 )
@@ -25,16 +24,12 @@ const (
 	noUpdateOnWindowsMessage      = "cloudflared will not automatically update on Windows systems."
 	noUpdateManagedPackageMessage = "cloudflared will not automatically update if installed by a package manager."
 	isManagedInstallFile          = ".installedFromPackageManager"
+	UpdateURL                     = "https://update.argotunnel.com"
+	StagingUpdateURL              = "https://staging-update.argotunnel.com"
 )
 
 var (
-	publicKey = []byte(`
------BEGIN ECDSA PUBLIC KEY-----
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4OWZocTVZ8Do/L6ScLdkV+9A0IYMHoOf
-dsCmJ/QZ6aw0w9qkkwEpne1Lmo6+0pGexZzFZOH6w5amShn+RXt7qkSid9iWlzGq
-EKx0BZogHSor9Wy5VztdFaAaVbsJiCbO
------END ECDSA PUBLIC KEY-----
-`)
+	version string
 )
 
 // BinaryUpdated implements ExitCoder interface, the app will exit with status code 11
@@ -64,6 +59,13 @@ func (e *statusErr) ExitCode() int {
 	return 10
 }
 
+type updateOptions struct {
+	isBeta    bool
+	isStaging bool
+	isForced  bool
+	version   string
+}
+
 type UpdateOutcome struct {
 	Updated bool
 	Version string
@@ -74,29 +76,44 @@ func (uo *UpdateOutcome) noUpdate() bool {
 	return uo.Error == nil && uo.Updated == false
 }
 
-func checkForUpdateAndApply() UpdateOutcome {
-	var opts equinox.Options
-	if err := opts.SetPublicKeyPEM(publicKey); err != nil {
-		return UpdateOutcome{Error: err}
-	}
+func Init(v string) {
+	version = v
+}
 
-	resp, err := equinox.Check(appID, opts)
-	switch {
-	case err == equinox.NotAvailableErr:
-		return UpdateOutcome{}
-	case err != nil:
-		return UpdateOutcome{Error: err}
-	}
-
-	err = resp.Apply()
+func checkForUpdateAndApply(options updateOptions) UpdateOutcome {
+	cfdPath, err := os.Executable()
 	if err != nil {
 		return UpdateOutcome{Error: err}
 	}
 
-	return UpdateOutcome{Updated: true, Version: resp.ReleaseVersion}
+	url := UpdateURL
+	if options.isStaging {
+		url = StagingUpdateURL
+	}
+
+	s := NewWorkersService(version, url, cfdPath, Options{IsBeta: options.isBeta,
+		IsForced: options.isForced, RequestedVersion: options.version})
+
+	v, err := s.Check()
+	if err != nil {
+		return UpdateOutcome{Error: err}
+	}
+
+	//already on the latest version
+	if v == nil {
+		return UpdateOutcome{}
+	}
+
+	err = v.Apply()
+	if err != nil {
+		return UpdateOutcome{Error: err}
+	}
+
+	return UpdateOutcome{Updated: true, Version: v.String()}
 }
 
-func Update(_ *cli.Context) error {
+// Update is the handler for the update command from the command line
+func Update(c *cli.Context) error {
 	logger, err := logger.New()
 	if err != nil {
 		return errors.Wrap(err, "error setting up logger")
@@ -107,7 +124,22 @@ func Update(_ *cli.Context) error {
 		return nil
 	}
 
-	updateOutcome := loggedUpdate(logger)
+	isBeta := c.Bool("beta")
+	if isBeta {
+		logger.Info("cloudflared is set to update to the latest beta version")
+	}
+
+	isStaging := c.Bool("staging")
+	if isStaging {
+		logger.Info("cloudflared is set to update from staging")
+	}
+
+	isForced := c.Bool("force")
+	if isForced {
+		logger.Info("cloudflared is set to upgrade to the latest publish version regardless of the current version")
+	}
+
+	updateOutcome := loggedUpdate(logger, updateOptions{isBeta: isBeta, isStaging: isStaging, isForced: isForced, version: c.String("version")})
 	if updateOutcome.Error != nil {
 		return &statusErr{updateOutcome.Error}
 	}
@@ -121,8 +153,8 @@ func Update(_ *cli.Context) error {
 }
 
 // Checks for an update and applies it if one is available
-func loggedUpdate(logger logger.Service) UpdateOutcome {
-	updateOutcome := checkForUpdateAndApply()
+func loggedUpdate(logger logger.Service, options updateOptions) UpdateOutcome {
+	updateOutcome := checkForUpdateAndApply(options)
 	if updateOutcome.Updated {
 		logger.Infof("cloudflared has been updated to version %s", updateOutcome.Version)
 	}
@@ -168,7 +200,7 @@ func (a *AutoUpdater) Run(ctx context.Context) error {
 	ticker := time.NewTicker(a.configurable.freq)
 	for {
 		if a.configurable.enabled {
-			updateOutcome := loggedUpdate(a.logger)
+			updateOutcome := loggedUpdate(a.logger, updateOptions{})
 			if updateOutcome.Updated {
 				os.Args = append(os.Args, "--is-autoupdated=true")
 				if IsSysV() {

cmd/cloudflared/updater/workers_service.go

@@ -0,0 +1,154 @@
+package updater
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Options are the update options supported by the
+type Options struct {
+	// IsBeta is for beta updates to be installed if available
+	IsBeta bool
+
+	// IsForced is to forcibly download the latest version regardless of the current version
+	IsForced bool
+
+	// RequestedVersion is the specific version to upgrade or downgrade to
+	RequestedVersion string
+}
+
+// VersionResponse is the JSON response from the Workers API endpoint
+type VersionResponse struct {
+	URL          string `json:"url"`
+	Version      string `json:"version"`
+	Checksum     string `json:"checksum"`
+	IsCompressed bool   `json:"compressed"`
+	Error        string `json:"error"`
+}
+
+// WorkersService implements Service.
+// It contains everything needed to check in with the WorkersAPI and download and apply the updates
+type WorkersService struct {
+	currentVersion string
+	url            string
+	targetPath     string
+	opts           Options
+}
+
+// NewWorkersService creates a new updater Service object.
+func NewWorkersService(currentVersion, url, targetPath string, opts Options) Service {
+	return &WorkersService{
+		currentVersion: currentVersion,
+		url:            url,
+		targetPath:     targetPath,
+		opts:           opts,
+	}
+}
+
+// Check does a check in with the Workers API to get a new version update
+func (s *WorkersService) Check() (Version, error) {
+	client := &http.Client{
+		Timeout: time.Second * 5,
+	}
+
+	req, err := http.NewRequest(http.MethodGet, s.url, nil)
+	q := req.URL.Query()
+	q.Add(OSKeyName, runtime.GOOS)
+	q.Add(ArchitectureKeyName, runtime.GOARCH)
+
+	if s.opts.IsBeta {
+		q.Add(BetaKeyName, "true")
+	}
+
+	if s.opts.RequestedVersion != "" {
+		q.Add(VersionKeyName, s.opts.RequestedVersion)
+	}
+
+	req.URL.RawQuery = q.Encode()
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	var v VersionResponse
+	if err := json.NewDecoder(resp.Body).Decode(&v); err != nil {
+		return nil, err
+	}
+
+	if v.Error != "" {
+		return nil, errors.New(v.Error)
+	}
+
+	if !s.opts.IsForced && !IsNewerVersion(s.currentVersion, v.Version) {
+		return nil, nil
+	}
+
+	return NewWorkersVersion(v.URL, v.Version, v.Checksum, s.targetPath, v.IsCompressed), nil
+}
+
+// IsNewerVersion checks semantic versioning for the latest version
+// cloudflared tagging is more of a date than a semantic version,
+// but the same comparision logic still holds for major.minor.patch
+// e.g. 2020.8.2 is newer than 2020.8.1.
+func IsNewerVersion(current string, check string) bool {
+	if strings.Contains(strings.ToLower(current), "dev") {
+		return false // dev builds shouldn't update
+	}
+
+	cMajor, cMinor, cPatch, err := SemanticParts(current)
+	if err != nil {
+		return false
+	}
+
+	nMajor, nMinor, nPatch, err := SemanticParts(check)
+	if err != nil {
+		return false
+	}
+
+	if nMajor > cMajor {
+		return true
+	}
+
+	if nMajor == cMajor && nMinor > cMinor {
+		return true
+	}
+
+	if nMajor == cMajor && nMinor == cMinor && nPatch > cPatch {
+		return true
+	}
+	return false
+}
+
+// SemanticParts gets the major, minor, and patch version of a semantic version string
+// e.g. 3.1.2 would return 3, 1, 2, nil
+func SemanticParts(version string) (major int, minor int, patch int, err error) {
+	major = 0
+	minor = 0
+	patch = 0
+	parts := strings.Split(version, ".")
+	if len(parts) != 3 {
+		err = errors.New("invalid version")
+		return
+	}
+	major, err = strconv.Atoi(parts[0])
+	if err != nil {
+		return
+	}
+
+	minor, err = strconv.Atoi(parts[1])
+	if err != nil {
+		return
+	}
+
+	patch, err = strconv.Atoi(parts[2])
+	if err != nil {
+		return
+	}
+	return
+}

cmd/cloudflared/updater/workers_service_test.go

@@ -0,0 +1,273 @@
+package updater
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func respondWithJSON(w http.ResponseWriter, v interface{}, status int) {
+	data, _ := json.Marshal(v)
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	w.Write(data)
+}
+
+func respondWithData(w http.ResponseWriter, b []byte, status int) {
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.WriteHeader(status)
+	w.Write(b)
+}
+
+func updateHandler(w http.ResponseWriter, r *http.Request) {
+	version := "2020.08.05"
+	host := fmt.Sprintf("http://%s", r.Host)
+	url := host + "/download"
+
+	query := r.URL.Query()
+
+	if query.Get(BetaKeyName) == "true" {
+		version = "2020.08.06"
+		url = host + "/beta"
+	}
+
+	requestedVersion := query.Get(VersionKeyName)
+	if requestedVersion != "" {
+		version = requestedVersion
+		url = fmt.Sprintf("%s?version=%s", url, requestedVersion)
+	}
+
+	if query.Get(ArchitectureKeyName) != runtime.GOARCH || query.Get(OSKeyName) != runtime.GOOS {
+		respondWithJSON(w, VersionResponse{Error: "unsupported os and architecture"}, http.StatusBadRequest)
+		return
+	}
+
+	h := sha256.New()
+	fmt.Fprint(h, version)
+	checksum := fmt.Sprintf("%x", h.Sum(nil))
+
+	v := VersionResponse{URL: url, Version: version, Checksum: checksum}
+	respondWithJSON(w, v, http.StatusOK)
+}
+
+func gzipUpdateHandler(w http.ResponseWriter, r *http.Request) {
+	log.Println("got a request!")
+	version := "2020.09.02"
+	h := sha256.New()
+	fmt.Fprint(h, version)
+	checksum := fmt.Sprintf("%x", h.Sum(nil))
+
+	url := fmt.Sprintf("http://%s/gzip-download.tgz", r.Host)
+	v := VersionResponse{URL: url, Version: version, Checksum: checksum}
+	respondWithJSON(w, v, http.StatusOK)
+}
+
+func compressedDownloadHandler(w http.ResponseWriter, r *http.Request) {
+	version := "2020.09.02"
+	buf := new(bytes.Buffer)
+
+	gw := gzip.NewWriter(buf)
+	tw := tar.NewWriter(gw)
+
+	header := &tar.Header{
+		Size: int64(len(version)),
+		Name: "download",
+	}
+	tw.WriteHeader(header)
+	tw.Write([]byte(version))
+
+	tw.Close()
+	gw.Close()
+
+	respondWithData(w, buf.Bytes(), http.StatusOK)
+}
+
+func downloadHandler(w http.ResponseWriter, r *http.Request) {
+	version := "2020.08.05"
+	requestedVersion := r.URL.Query().Get(VersionKeyName)
+	if requestedVersion != "" {
+		version = requestedVersion
+	}
+	respondWithData(w, []byte(version), http.StatusOK)
+}
+
+func betaHandler(w http.ResponseWriter, r *http.Request) {
+	respondWithData(w, []byte("2020.08.06"), http.StatusOK)
+}
+
+func failureHandler(w http.ResponseWriter, r *http.Request) {
+	respondWithJSON(w, VersionResponse{Error: "unsupported os and architecture"}, http.StatusBadRequest)
+}
+
+func createServer() *httptest.Server {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/updater", updateHandler)
+	mux.HandleFunc("/download", downloadHandler)
+	mux.HandleFunc("/beta", betaHandler)
+	mux.HandleFunc("/fail", failureHandler)
+	mux.HandleFunc("/compressed", gzipUpdateHandler)
+	mux.HandleFunc("/gzip-download.tgz", compressedDownloadHandler)
+	return httptest.NewServer(mux)
+}
+
+func createTestFile(t *testing.T, path string) {
+	f, err := os.Create("tmpfile")
+	require.NoError(t, err)
+	fmt.Fprint(f, "2020.08.04")
+	f.Close()
+}
+
+func TestUpdateService(t *testing.T) {
+	ts := createServer()
+	defer ts.Close()
+
+	testFilePath := "tmpfile"
+	createTestFile(t, testFilePath)
+	defer os.Remove(testFilePath)
+	log.Println("server url: ", ts.URL)
+
+	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{})
+	v, err := s.Check()
+	require.NoError(t, err)
+	require.Equal(t, v.String(), "2020.08.05")
+
+	require.NoError(t, v.Apply())
+	dat, err := ioutil.ReadFile(testFilePath)
+	require.NoError(t, err)
+
+	require.Equal(t, string(dat), "2020.08.05")
+}
+
+func TestBetaUpdateService(t *testing.T) {
+	ts := createServer()
+	defer ts.Close()
+
+	testFilePath := "tmpfile"
+	createTestFile(t, testFilePath)
+	defer os.Remove(testFilePath)
+
+	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{IsBeta: true})
+	v, err := s.Check()
+	require.NoError(t, err)
+	require.Equal(t, v.String(), "2020.08.06")
+
+	require.NoError(t, v.Apply())
+	dat, err := ioutil.ReadFile(testFilePath)
+	require.NoError(t, err)
+
+	require.Equal(t, string(dat), "2020.08.06")
+}
+
+func TestFailUpdateService(t *testing.T) {
+	ts := createServer()
+	defer ts.Close()
+
+	testFilePath := "tmpfile"
+	createTestFile(t, testFilePath)
+	defer os.Remove(testFilePath)
+
+	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/fail", ts.URL), testFilePath, Options{})
+	v, err := s.Check()
+	require.Error(t, err)
+	require.Nil(t, v)
+}
+
+func TestNoUpdateService(t *testing.T) {
+	ts := createServer()
+	defer ts.Close()
+
+	testFilePath := "tmpfile"
+	createTestFile(t, testFilePath)
+	defer os.Remove(testFilePath)
+
+	s := NewWorkersService("2020.8.5", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{})
+	v, err := s.Check()
+	require.NoError(t, err)
+	require.Nil(t, v)
+}
+
+func TestForcedUpdateService(t *testing.T) {
+	ts := createServer()
+	defer ts.Close()
+
+	testFilePath := "tmpfile"
+	createTestFile(t, testFilePath)
+	defer os.Remove(testFilePath)
+
+	s := NewWorkersService("2020.8.5", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{IsForced: true})
+	v, err := s.Check()
+	require.NoError(t, err)
+	require.Equal(t, v.String(), "2020.08.05")
+
+	require.NoError(t, v.Apply())
+	dat, err := ioutil.ReadFile(testFilePath)
+	require.NoError(t, err)
+
+	require.Equal(t, string(dat), "2020.08.05")
+}
+
+func TestUpdateSpecificVersionService(t *testing.T) {
+	ts := createServer()
+	defer ts.Close()
+
+	testFilePath := "tmpfile"
+	createTestFile(t, testFilePath)
+	defer os.Remove(testFilePath)
+	reqVersion := "2020.9.1"
+
+	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/updater", ts.URL), testFilePath, Options{RequestedVersion: reqVersion})
+	v, err := s.Check()
+	require.NoError(t, err)
+	require.Equal(t, reqVersion, v.String())
+
+	require.NoError(t, v.Apply())
+	dat, err := ioutil.ReadFile(testFilePath)
+	require.NoError(t, err)
+
+	require.Equal(t, reqVersion, string(dat))
+}
+
+func TestCompressedUpdateService(t *testing.T) {
+	ts := createServer()
+	defer ts.Close()
+
+	testFilePath := "tmpfile"
+	createTestFile(t, testFilePath)
+	defer os.Remove(testFilePath)
+
+	s := NewWorkersService("2020.8.2", fmt.Sprintf("%s/compressed", ts.URL), testFilePath, Options{})
+	v, err := s.Check()
+	require.NoError(t, err)
+	require.Equal(t, "2020.09.02", v.String())
+
+	require.NoError(t, v.Apply())
+	dat, err := ioutil.ReadFile(testFilePath)
+	require.NoError(t, err)
+
+	require.Equal(t, "2020.09.02", string(dat))
+}
+
+func TestVersionParsing(t *testing.T) {
+	require.False(t, IsNewerVersion("2020.8.2", "2020.8.2"))
+	require.True(t, IsNewerVersion("2020.8.2", "2020.8.3"))
+	require.True(t, IsNewerVersion("2020.8.2", "2021.1.2"))
+	require.True(t, IsNewerVersion("2020.8.2", "2020.9.1"))
+	require.True(t, IsNewerVersion("2020.8.2", "2020.12.45"))
+	require.False(t, IsNewerVersion("2020.8.2", "2020.6.3"))
+	require.False(t, IsNewerVersion("DEV", "2020.8.5"))
+	require.False(t, IsNewerVersion("2020.8.2", "asdlkfjasdf"))
+	require.True(t, IsNewerVersion("3.0.1", "4.2.1"))
+}

cmd/cloudflared/updater/workers_update.go

@@ -0,0 +1,227 @@
+package updater
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"text/template"
+	"time"
+)
+
+// stop the service
+// rename cloudflared.exe to cloudflared.exe.old
+// rename cloudflared.exe.new to cloudflared.exe
+// delete cloudflared.exe.old
+// start the service
+// delete the batch file
+const windowsUpdateCommandTemplate = `@echo off
+sc stop cloudflared >nul 2>&1
+rename "{{.TargetPath}}" {{.OldName}}
+rename "{{.NewPath}}" {{.BinaryName}}
+del "{{.OldPath}}"
+sc start cloudflared >nul 2>&1
+del {{.BatchName}}`
+const batchFileName = "cfd_update.bat"
+
+// Prepare some data to insert into the template.
+type batchData struct {
+	TargetPath string
+	OldName    string
+	NewPath    string
+	OldPath    string
+	BinaryName string
+	BatchName  string
+}
+
+// WorkersVersion implements the Version interface.
+// It contains everything needed to preform a version upgrade
+type WorkersVersion struct {
+	downloadURL  string
+	checksum     string
+	version      string
+	targetPath   string
+	isCompressed bool
+}
+
+// NewWorkersVersion creates a new Version object. This is normally created by a WorkersService JSON checkin response
+// url is where to download the file
+// version is the version of this update
+// checksum is the expected checksum of the downloaded file
+// target path is where the file should be replace. Normally this the running cloudflared's path
+func NewWorkersVersion(url, version, checksum, targetPath string, isCompressed bool) Version {
+	return &WorkersVersion{downloadURL: url, version: version, checksum: checksum, targetPath: targetPath, isCompressed: isCompressed}
+}
+
+// Apply does the actual verification and update logic.
+// This includes signature and checksum validation,
+// replacing the binary, etc
+func (v *WorkersVersion) Apply() error {
+	newFilePath := fmt.Sprintf("%s.new", v.targetPath)
+	os.Remove(newFilePath) //remove any failed updates before download
+
+	// download the file
+	if err := download(v.downloadURL, newFilePath, v.isCompressed); err != nil {
+		return err
+	}
+
+	// check that the file is what is expected
+	if err := isValidChecksum(v.checksum, newFilePath); err != nil {
+		return err
+	}
+
+	oldFilePath := fmt.Sprintf("%s.old", v.targetPath)
+	// Windows requires more effort to self update, especially when it is running as a service:
+	// you have to stop the service (if running as one) in order to move/rename the binary
+	// but now the binary isn't running though, so an external process
+	// has to move the old binary out and the new one in then start the service
+	// the easiest way to do this is with a batch file (or with a DLL, but that gets ugly for a cross compiled binary like cloudflared)
+	// a batch file isn't ideal, but it is the simplest path forward for the constraints Windows creates
+	if runtime.GOOS == "windows" {
+		if err := writeBatchFile(v.targetPath, newFilePath, oldFilePath); err != nil {
+			return err
+		}
+		rootDir := filepath.Dir(v.targetPath)
+		batchPath := filepath.Join(rootDir, batchFileName)
+		return runWindowsBatch(batchPath)
+	}
+
+	// now move the current file out, move the new file in and delete the old file
+	if err := os.Rename(v.targetPath, oldFilePath); err != nil {
+		return err
+	}
+
+	if err := os.Rename(newFilePath, v.targetPath); err != nil {
+		//attempt rollback
+		os.Rename(oldFilePath, v.targetPath)
+		return err
+	}
+	os.Remove(oldFilePath)
+
+	return nil
+}
+
+// String returns the version number of this update/release (e.g. 2020.08.05)
+func (v *WorkersVersion) String() string {
+	return v.version
+}
+
+// download the file from the link in the json
+func download(url, filepath string, isCompressed bool) error {
+	client := &http.Client{
+		Timeout: time.Second * 5,
+	}
+	resp, err := client.Get(url)
+
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	var r io.Reader
+	r = resp.Body
+
+	// compressed macos binary, need to decompress
+	if isCompressed || isCompressedFile(url) {
+		// first the gzip reader
+		gr, err := gzip.NewReader(resp.Body)
+		if err != nil {
+			return err
+		}
+		defer gr.Close()
+
+		// now the tar
+		tr := tar.NewReader(gr)
+
+		// advance the reader pass the header, which will be the single binary file
+		tr.Next()
+
+		r = tr
+	}
+
+	out, err := os.OpenFile(filepath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, r)
+	return err
+}
+
+// isCompressedFile is a really simple file extension check to see if this is a macos tar and gzipped
+func isCompressedFile(urlstring string) bool {
+	if strings.HasSuffix(urlstring, ".tgz") {
+		return true
+	}
+
+	u, err := url.Parse(urlstring)
+	if err != nil {
+		return false
+	}
+	return strings.HasSuffix(u.Path, ".tgz")
+}
+
+// checks if the checksum in the json response matches the checksum of the file download
+func isValidChecksum(checksum, filePath string) error {
+	f, err := os.Open(filePath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return err
+	}
+
+	hash := fmt.Sprintf("%x", h.Sum(nil))
+
+	if checksum != hash {
+		return errors.New("checksum validation failed")
+	}
+	return nil
+}
+
+// writeBatchFile writes a batch file out to disk
+// see the dicussion on why it has to be done this way
+func writeBatchFile(targetPath string, newPath string, oldPath string) error {
+	os.Remove(batchFileName) //remove any failed updates before download
+	f, err := os.Create(batchFileName)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	cfdName := filepath.Base(targetPath)
+	oldName := filepath.Base(oldPath)
+
+	data := batchData{
+		TargetPath: targetPath,
+		OldName:    oldName,
+		NewPath:    newPath,
+		OldPath:    oldPath,
+		BinaryName: cfdName,
+		BatchName:  batchFileName,
+	}
+
+	t, err := template.New("batch").Parse(windowsUpdateCommandTemplate)
+	if err != nil {
+		return err
+	}
+	return t.Execute(f, data)
+}
+
+// run each OS command for windows
+func runWindowsBatch(batchFile string) error {
+	cmd := exec.Command("cmd", "/c", batchFile)
+	return cmd.Start()
+}

connection/rpc.go

@@ -2,48 +2,40 @@ package connection
 
 import (
 	"context"
-	"fmt"
-	"time"
+	"io"
 
 	rpc "zombiezen.com/go/capnproto2/rpc"
 
-	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 
-// NewRPCClient creates and returns a new RPC client, which will communicate
+// NewTunnelRPCClient creates and returns a new RPC client, which will communicate
 // using a stream on the given muxer
-func NewRPCClient(
+func NewTunnelRPCClient(
 	ctx context.Context,
-	muxer *h2mux.Muxer,
+	stream io.ReadWriteCloser,
 	logger logger.Service,
-	openStreamTimeout time.Duration,
 ) (client tunnelpogs.TunnelServer_PogsClient, err error) {
-	openStreamCtx, openStreamCancel := context.WithTimeout(ctx, openStreamTimeout)
-	defer openStreamCancel()
-	stream, err := muxer.OpenRPCStream(openStreamCtx)
-	if err != nil {
-		return
-	}
-
-	if !isRPCStreamResponse(stream.Headers) {
-		stream.Close()
-		err = fmt.Errorf("rpc: bad response headers: %v", stream.Headers)
-		return
-	}
-
 	conn := rpc.NewConn(
 		tunnelrpc.NewTransportLogger(logger, rpc.StreamTransport(stream)),
 		tunnelrpc.ConnLog(logger),
 	)
-	client = tunnelpogs.TunnelServer_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn}
+	registrationClient := tunnelpogs.RegistrationServer_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn}
+	client = tunnelpogs.TunnelServer_PogsClient{RegistrationServer_PogsClient: registrationClient, Client: conn.Bootstrap(ctx), Conn: conn}
 	return client, nil
 }
 
-func isRPCStreamResponse(headers []h2mux.Header) bool {
-	return len(headers) == 1 &&
-		headers[0].Name == ":status" &&
-		headers[0].Value == "200"
+func NewRegistrationRPCClient(
+	ctx context.Context,
+	stream io.ReadWriteCloser,
+	logger logger.Service,
+) (client tunnelpogs.RegistrationServer_PogsClient, err error) {
+	conn := rpc.NewConn(
+		tunnelrpc.NewTransportLogger(logger, rpc.StreamTransport(stream)),
+		tunnelrpc.ConnLog(logger),
+	)
+	client = tunnelpogs.RegistrationServer_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn}
+	return client, nil
 }

dev.Dockerfile

@@ -1,4 +1,9 @@
-FROM golang:1.12 as builder
+FROM golang:1.15.3 as builder
+ENV GO111MODULE=on \
+    CGO_ENABLED=0
 WORKDIR /go/src/github.com/cloudflare/cloudflared/
 RUN apt-get update
 COPY . .
+# compile cloudflared
+RUN make cloudflared
+RUN cp /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/

github_message.py

@@ -97,10 +97,11 @@ def main():
 
         msg = release.body
 
-        for filename in glob.glob(".artifacts/*.*"):
-            pkg_hash = get_sha256(filename)
+        for filepath in glob.glob("artifacts/*"):
+            pkg_hash = get_sha256(filepath)
             # add the sha256 of the new artifact to the release message body
-            msg = update_or_add_message(msg, filename, pkg_hash)
+            name = os.path.basename(filepath)
+            msg = update_or_add_message(msg, name, pkg_hash)
 
         if args.dry_run:
             logging.info("Skipping asset upload because of dry-run")

github_release.py

@@ -9,6 +9,7 @@ import os
 import shutil
 import hashlib
 import requests
+import tarfile
 
 from github import Github, GithubException, UnknownObjectException
 
@@ -175,8 +176,21 @@ def main():
 
         release.upload_asset(args.path, name=args.name)
 
+        # check and extract if the file is a tar and gzipped file (as is the case with the macos builds)
+        binary_path = args.path
+        if binary_path.endswith("tgz"):
+            try:
+                shutil.rmtree('cfd') 
+            except OSError as e:
+                pass
+            zipfile = tarfile.open(binary_path, "r:gz")
+            zipfile.extractall('cfd') # specify which folder to extract to
+            zipfile.close()
+
+            binary_path = os.path.join(os.getcwd(), 'cfd', 'cloudflared') 
+
         # send the sha256 (the checksum) to workers kv
-        pkg_hash = get_sha256(args.path)
+        pkg_hash = get_sha256(binary_path)
         send_hash(pkg_hash, args.name, args.release_version, args.kv_account_id, args.namespace_id, args.kv_api_token)
 
         # create the artifacts directory if it doesn't exist 
@@ -186,9 +200,10 @@ def main():
 
         # copy the binary to the path
         copy_path = os.path.join(artifact_path, args.name)
-        shutil.copy(args.path, copy_path)
-
-
+        try:
+            shutil.copy(args.path, copy_path)
+        except shutil.SameFileError:
+            pass # the macOS release copy fails with being the same file (already in the artifacts directory). Catching to ignore.
 
     except Exception as e:
         logging.exception(e)

h2mux/error.go

@@ -19,6 +19,7 @@ var (
 	ErrUnexpectedFrameType = MuxerProtocolError{"2001 unexpected frame type", http2.ErrCodeProtocol}
 	ErrUnknownStream       = MuxerProtocolError{"2002 unknown stream", http2.ErrCodeProtocol}
 	ErrInvalidStream       = MuxerProtocolError{"2003 invalid stream", http2.ErrCodeProtocol}
+	ErrNotRPCStream        = MuxerProtocolError{"2004 not RPC stream", http2.ErrCodeProtocol}
 
 	ErrStreamHeadersSent               = MuxerApplicationError{"3000 headers already sent"}
 	ErrStreamRequestConnectionClosed   = MuxerApplicationError{"3001 connection closed while opening stream"}

h2mux/h2mux.go

@@ -22,7 +22,7 @@ const (
 	defaultTimeout           time.Duration = 5 * time.Second
 	defaultRetries           uint64        = 5
 	defaultWriteBufferMaxLen int           = 1024 * 1024 // 1mb
-	writeBufferInitialSize   int           = 16 * 1024 // 16KB
+	writeBufferInitialSize   int           = 16 * 1024   // 16KB
 
 	SettingMuxerMagic http2.SettingID = 0x42db
 	MuxerMagicOrigin  uint32          = 0xa2e43c8b
@@ -441,11 +441,17 @@ func (m *Muxer) OpenStream(ctx context.Context, headers []Header, body io.Reader
 func (m *Muxer) OpenRPCStream(ctx context.Context) (*MuxedStream, error) {
 	stream := m.NewStream(RPCHeaders())
 	if err := m.MakeMuxedStreamRequest(ctx, NewMuxedStreamRequest(stream, nil)); err != nil {
+		stream.Close()
 		return nil, err
 	}
 	if err := m.AwaitResponseHeaders(ctx, stream); err != nil {
+		stream.Close()
 		return nil, err
 	}
+	if !IsRPCStreamResponse(stream) {
+		stream.Close()
+		return nil, ErrNotRPCStream
+	}
 	return stream, nil
 }
 
@@ -499,3 +505,10 @@ func (m *Muxer) abort() {
 func (m *Muxer) TimerRetries() uint64 {
 	return m.muxWriter.idleTimer.RetryCount()
 }
+
+func IsRPCStreamResponse(stream *MuxedStream) bool {
+	headers := stream.Headers
+	return len(headers) == 1 &&
+		headers[0].Name == ":status" &&
+		headers[0].Value == "200"
+}

ingress/ingress.go

@@ -0,0 +1,159 @@
+package ingress
+
+import (
+	"fmt"
+	"net/url"
+	"regexp"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+)
+
+var (
+	ErrNoIngressRules             = errors.New("No ingress rules were specified in the config file")
+	errLastRuleNotCatchAll        = errors.New("The last ingress rule must match all hostnames (i.e. it must be missing, or must be \"*\")")
+	errBadWildcard                = errors.New("Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"")
+	ErrURLIncompatibleWithIngress = errors.New("You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules")
+)
+
+// Each rule route traffic from a hostname/path on the public
+// internet to the service running on the given URL.
+type Rule struct {
+	// Requests for this hostname will be proxied to this rule's service.
+	Hostname string
+
+	// Path is an optional regex that can specify path-driven ingress rules.
+	Path *regexp.Regexp
+
+	// A (probably local) address. Requests for a hostname which matches this
+	// rule's hostname pattern will be proxied to the service running on this
+	// address.
+	Service *url.URL
+}
+
+func (r Rule) MultiLineString() string {
+	var out strings.Builder
+	if r.Hostname != "" {
+		out.WriteString("\thostname: ")
+		out.WriteString(r.Hostname)
+		out.WriteRune('\n')
+	}
+	if r.Path != nil {
+		out.WriteString("\tpath: ")
+		out.WriteString(r.Path.String())
+		out.WriteRune('\n')
+	}
+	out.WriteString("\tservice: ")
+	out.WriteString(r.Service.String())
+	return out.String()
+}
+
+func (r *Rule) Matches(hostname, path string) bool {
+	hostMatch := r.Hostname == "" || r.Hostname == "*" || matchHost(r.Hostname, hostname)
+	pathMatch := r.Path == nil || r.Path.MatchString(path)
+	return hostMatch && pathMatch
+}
+
+// FindMatchingRule returns the index of the Ingress Rule which matches the given
+// hostname and path. This function assumes the last rule matches everything,
+// which is the case if the rules were instantiated via the ingress#Validate method
+func (ing Ingress) FindMatchingRule(hostname, path string) int {
+	for i, rule := range ing.Rules {
+		if rule.Matches(hostname, path) {
+			return i
+		}
+	}
+	return len(ing.Rules) - 1
+}
+
+func matchHost(ruleHost, reqHost string) bool {
+	if ruleHost == reqHost {
+		return true
+	}
+
+	// Validate hostnames that use wildcards at the start
+	if strings.HasPrefix(ruleHost, "*.") {
+		toMatch := strings.TrimPrefix(ruleHost, "*.")
+		return strings.HasSuffix(reqHost, toMatch)
+	}
+	return false
+}
+
+// Ingress maps eyeball requests to origins.
+type Ingress struct {
+	Rules []Rule
+}
+
+// IsEmpty checks if there are any ingress rules.
+func (ing Ingress) IsEmpty() bool {
+	return len(ing.Rules) == 0
+}
+
+func validate(ingress []config.UnvalidatedIngressRule) (Ingress, error) {
+	rules := make([]Rule, len(ingress))
+	for i, r := range ingress {
+		service, err := url.Parse(r.Service)
+		if err != nil {
+			return Ingress{}, err
+		}
+		if service.Scheme == "" || service.Hostname() == "" {
+			return Ingress{}, fmt.Errorf("The service %s must have a scheme and a hostname", r.Service)
+		}
+
+		if service.Path != "" {
+			return Ingress{}, fmt.Errorf("%s is an invalid address, ingress rules don't support proxying to a different path on the origin service. The path will be the same as the eyeball request's path.", r.Service)
+		}
+
+		// Ensure that there are no wildcards anywhere except the first character
+		// of the hostname.
+		if strings.LastIndex(r.Hostname, "*") > 0 {
+			return Ingress{}, errBadWildcard
+		}
+
+		// The last rule should catch all hostnames.
+		isCatchAllRule := (r.Hostname == "" || r.Hostname == "*") && r.Path == ""
+		isLastRule := i == len(ingress)-1
+		if isLastRule && !isCatchAllRule {
+			return Ingress{}, errLastRuleNotCatchAll
+		}
+		// ONLY the last rule should catch all hostnames.
+		if !isLastRule && isCatchAllRule {
+			return Ingress{}, errRuleShouldNotBeCatchAll{i: i, hostname: r.Hostname}
+		}
+
+		var pathRegex *regexp.Regexp
+		if r.Path != "" {
+			pathRegex, err = regexp.Compile(r.Path)
+			if err != nil {
+				return Ingress{}, errors.Wrapf(err, "Rule #%d has an invalid regex", i+1)
+			}
+		}
+
+		rules[i] = Rule{
+			Hostname: r.Hostname,
+			Service:  service,
+			Path:     pathRegex,
+		}
+	}
+	return Ingress{Rules: rules}, nil
+}
+
+type errRuleShouldNotBeCatchAll struct {
+	i        int
+	hostname string
+}
+
+func (e errRuleShouldNotBeCatchAll) Error() string {
+	return fmt.Sprintf("Rule #%d is matching the hostname '%s', but "+
+		"this will match every hostname, meaning the rules which follow it "+
+		"will never be triggered.", e.i+1, e.hostname)
+}
+
+func ParseIngress(conf *config.Configuration) (Ingress, error) {
+	if len(conf.Ingress) == 0 {
+		return Ingress{}, ErrNoIngressRules
+	}
+	return validate(conf.Ingress)
+}

ingress/ingress_test.go

@@ -0,0 +1,312 @@
+package ingress
+
+import (
+	"net/url"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v2"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
+)
+
+func Test_parseIngress(t *testing.T) {
+	localhost8000 := MustParseURL(t, "https://localhost:8000")
+	localhost8001 := MustParseURL(t, "https://localhost:8001")
+	type args struct {
+		rawYAML string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    Ingress
+		wantErr bool
+	}{
+		{
+			name:    "Empty file",
+			args:    args{rawYAML: ""},
+			wantErr: true,
+		},
+		{
+			name: "Multiple rules",
+			args: args{rawYAML: `
+ingress:
+ - hostname: tunnel1.example.com
+   service: https://localhost:8000
+ - hostname: "*"
+   service: https://localhost:8001
+`},
+			want: Ingress{Rules: []Rule{
+				{
+					Hostname: "tunnel1.example.com",
+					Service:  localhost8000,
+				},
+				{
+					Hostname: "*",
+					Service:  localhost8001,
+				},
+			}},
+		},
+		{
+			name: "Extra keys",
+			args: args{rawYAML: `
+ingress:
+ - hostname: "*"
+   service: https://localhost:8000
+extraKey: extraValue
+`},
+			want: Ingress{Rules: []Rule{
+				{
+					Hostname: "*",
+					Service:  localhost8000,
+				},
+			}},
+		},
+		{
+			name: "Hostname can be omitted",
+			args: args{rawYAML: `
+ingress:
+ - service: https://localhost:8000
+`},
+			want: Ingress{Rules: []Rule{
+				{
+					Service: localhost8000,
+				},
+			}},
+		},
+		{
+			name: "Invalid service",
+			args: args{rawYAML: `
+ingress:
+ - hostname: "*"
+   service: https://local host:8000
+`},
+			wantErr: true,
+		},
+		{
+			name: "Last rule isn't catchall",
+			args: args{rawYAML: `
+ingress:
+ - hostname: example.com
+   service: https://localhost:8000
+`},
+			wantErr: true,
+		},
+		{
+			name: "First rule is catchall",
+			args: args{rawYAML: `
+ingress:
+ - service: https://localhost:8000
+ - hostname: example.com
+   service: https://localhost:8000
+`},
+			wantErr: true,
+		},
+		{
+			name: "Catch-all rule can't have a path",
+			args: args{rawYAML: `
+ingress:
+ - service: https://localhost:8001
+   path: /subpath1/(.*)/subpath2
+`},
+			wantErr: true,
+		},
+		{
+			name: "Invalid regex",
+			args: args{rawYAML: `
+ingress:
+ - hostname: example.com
+   service: https://localhost:8000
+   path: "*/subpath2"
+ - service: https://localhost:8001
+`},
+			wantErr: true,
+		},
+		{
+			name: "Service must have a scheme",
+			args: args{rawYAML: `
+ingress:
+ - service: localhost:8000
+`},
+			wantErr: true,
+		},
+		{
+			name: "Wildcard not at start",
+			args: args{rawYAML: `
+ingress:
+ - hostname: "test.*.example.com"
+   service: https://localhost:8000
+`},
+			wantErr: true,
+		},
+		{
+			name: "Service can't have a path",
+			args: args{rawYAML: `
+ingress:
+ - service: https://localhost:8000/static/
+`},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ParseIngress(MustReadIngress(tt.args.rawYAML))
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ParseIngress() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func MustParseURL(t *testing.T, rawURL string) *url.URL {
+	u, err := url.Parse(rawURL)
+	require.NoError(t, err)
+	return u
+}
+
+func Test_rule_matches(t *testing.T) {
+	type fields struct {
+		Hostname string
+		Path     *regexp.Regexp
+		Service  *url.URL
+	}
+	type args struct {
+		requestURL *url.URL
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		want   bool
+	}{
+		{
+			name: "Just hostname, pass",
+			fields: fields{
+				Hostname: "example.com",
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://example.com"),
+			},
+			want: true,
+		},
+		{
+			name: "Entire hostname is wildcard, should match everything",
+			fields: fields{
+				Hostname: "*",
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://example.com"),
+			},
+			want: true,
+		},
+		{
+			name: "Just hostname, fail",
+			fields: fields{
+				Hostname: "example.com",
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://foo.bar"),
+			},
+			want: false,
+		},
+		{
+			name: "Just wildcard hostname, pass",
+			fields: fields{
+				Hostname: "*.example.com",
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://adam.example.com"),
+			},
+			want: true,
+		},
+		{
+			name: "Just wildcard hostname, fail",
+			fields: fields{
+				Hostname: "*.example.com",
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://tunnel.com"),
+			},
+			want: false,
+		},
+		{
+			name: "Just wildcard outside of subdomain in hostname, fail",
+			fields: fields{
+				Hostname: "*example.com",
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://www.example.com"),
+			},
+			want: false,
+		},
+		{
+			name: "Wildcard over multiple subdomains",
+			fields: fields{
+				Hostname: "*.example.com",
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://adam.chalmers.example.com"),
+			},
+			want: true,
+		},
+		{
+			name: "Hostname and path",
+			fields: fields{
+				Hostname: "*.example.com",
+				Path:     regexp.MustCompile("/static/.*\\.html"),
+			},
+			args: args{
+				requestURL: MustParseURL(t, "https://www.example.com/static/index.html"),
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := Rule{
+				Hostname: tt.fields.Hostname,
+				Path:     tt.fields.Path,
+				Service:  tt.fields.Service,
+			}
+			u := tt.args.requestURL
+			if got := r.Matches(u.Hostname(), u.Path); got != tt.want {
+				t.Errorf("rule.matches() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func BenchmarkFindMatch(b *testing.B) {
+	rulesYAML := `
+ingress:
+ - hostname: tunnel1.example.com
+   service: https://localhost:8000
+ - hostname: tunnel2.example.com
+   service: https://localhost:8001
+ - hostname: "*"
+   service: https://localhost:8002
+`
+
+	ing, err := ParseIngress(MustReadIngress(rulesYAML))
+	if err != nil {
+		b.Error(err)
+	}
+	for n := 0; n < b.N; n++ {
+		ing.FindMatchingRule("tunnel1.example.com", "")
+		ing.FindMatchingRule("tunnel2.example.com", "")
+		ing.FindMatchingRule("tunnel3.example.com", "")
+	}
+}
+
+func MustReadIngress(s string) *config.Configuration {
+	var conf config.Configuration
+	err := yaml.Unmarshal([]byte(s), &conf)
+	if err != nil {
+		panic(err)
+	}
+	return &conf
+}

origin/reconnect.go

@@ -7,7 +7,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -164,18 +163,17 @@ func ReconnectTunnel(
 	}
 
 	config.TransportLogger.Debug("initiating RPC stream to reconnect")
-	tunnelServer, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
+	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, reconnect)
 	if err != nil {
-		// RPC stream open error
-		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, reconnect)
+		return err
 	}
-	defer tunnelServer.Close()
+	defer rpcClient.Close()
 	// Request server info without blocking tunnel registration; must use capnp library directly.
-	serverInfoPromise := tunnelrpc.TunnelServer{Client: tunnelServer.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
+	serverInfoPromise := tunnelrpc.TunnelServer{Client: rpcClient.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
 		return nil
 	})
 	LogServerInfo(serverInfoPromise.Result(), connectionID, config.Metrics, logger, config.TunnelEventChan)
-	registration := tunnelServer.ReconnectTunnel(
+	registration := rpcClient.ReconnectTunnel(
 		ctx,
 		token,
 		eventDigest,

origin/supervisor.go

@@ -323,16 +323,16 @@ func (s *Supervisor) authenticate(ctx context.Context, numPreviousAttempts int)
 		<-muxer.Shutdown()
 	}()
 
-	tunnelServer, err := connection.NewRPCClient(ctx, muxer, s.logger, openStreamTimeout)
+	rpcClient, err := newTunnelRPCClient(ctx, muxer, s.config, authenticate)
 	if err != nil {
 		return nil, err
 	}
-	defer tunnelServer.Close()
+	defer rpcClient.Close()
 
 	const arbitraryConnectionID = uint8(0)
 	registrationOptions := s.config.RegistrationOptions(arbitraryConnectionID, edgeConn.LocalAddr().String(), s.cloudflaredUUID)
 	registrationOptions.NumPreviousAttempts = uint8(numPreviousAttempts)
-	authResponse, err := tunnelServer.Authenticate(
+	authResponse, err := rpcClient.Authenticate(
 		ctx,
 		s.config.OriginCert,
 		s.config.Hostname,

origin/tunnel.go

@@ -24,6 +24,7 @@ import (
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/ui"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -44,11 +45,13 @@ const (
 	FeatureQuickReconnects   = "quick_reconnects"
 )
 
-type registerRPCName string
+type rpcName string
 
 const (
-	register  registerRPCName = "register"
-	reconnect registerRPCName = "reconnect"
+	register     rpcName = "register"
+	reconnect    rpcName = "reconnect"
+	unregister   rpcName = "unregister"
+	authenticate rpcName = " authenticate"
 )
 
 type TunnelConfig struct {
@@ -90,6 +93,7 @@ type TunnelConfig struct {
 	NamedTunnel     *NamedTunnelConfig
 	ReplaceExisting bool
 	TunnelEventChan chan<- ui.TunnelEvent
+	IngressRules    ingress.Ingress
 }
 
 type dupConnRegisterTunnelError struct{}
@@ -121,7 +125,7 @@ type clientRegisterTunnelError struct {
 	cause error
 }
 
-func newClientRegisterTunnelError(cause error, counter *prometheus.CounterVec, name registerRPCName) clientRegisterTunnelError {
+func newRPCError(cause error, counter *prometheus.CounterVec, name rpcName) clientRegisterTunnelError {
 	counter.WithLabelValues(cause.Error(), string(name)).Inc()
 	return clientRegisterTunnelError{cause: cause}
 }
@@ -337,7 +341,7 @@ func ServeTunnel(
 					if config.NamedTunnel != nil {
 						_ = UnregisterConnection(ctx, handler.muxer, config)
 					} else {
-						_ = UnregisterTunnel(handler.muxer, config.GracePeriod, config.TransportLogger)
+						_ = UnregisterTunnel(handler.muxer, config)
 					}
 				}
 				handler.muxer.Shutdown()
@@ -417,14 +421,13 @@ func RegisterConnection(
 	const registerConnection = "registerConnection"
 
 	config.TransportLogger.Debug("initiating RPC stream for RegisterConnection")
-	rpc, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
+	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, registerConnection)
 	if err != nil {
-		// RPC stream open error
-		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, registerConnection)
+		return err
 	}
-	defer rpc.Close()
+	defer rpcClient.Close()
 
-	conn, err := rpc.RegisterConnection(
+	conn, err := rpcClient.RegisterConnection(
 		ctx,
 		config.NamedTunnel.Auth,
 		config.NamedTunnel.ID,
@@ -470,14 +473,14 @@ func UnregisterConnection(
 	config *TunnelConfig,
 ) error {
 	config.TransportLogger.Debug("initiating RPC stream for UnregisterConnection")
-	rpc, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
+	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, register)
 	if err != nil {
 		// RPC stream open error
-		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, register)
+		return err
 	}
-	defer rpc.Close()
+	defer rpcClient.Close()
 
-	return rpc.UnregisterConnection(ctx)
+	return rpcClient.UnregisterConnection(ctx)
 }
 
 func RegisterTunnel(
@@ -494,18 +497,18 @@ func RegisterTunnel(
 	if config.TunnelEventChan != nil {
 		config.TunnelEventChan <- ui.TunnelEvent{EventType: ui.RegisteringTunnel}
 	}
-	tunnelServer, err := connection.NewRPCClient(ctx, muxer, config.TransportLogger, openStreamTimeout)
+
+	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, register)
 	if err != nil {
-		// RPC stream open error
-		return newClientRegisterTunnelError(err, config.Metrics.rpcFail, register)
+		return err
 	}
-	defer tunnelServer.Close()
+	defer rpcClient.Close()
 	// Request server info without blocking tunnel registration; must use capnp library directly.
-	serverInfoPromise := tunnelrpc.TunnelServer{Client: tunnelServer.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
+	serverInfoPromise := tunnelrpc.TunnelServer{Client: rpcClient.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
 		return nil
 	})
 	LogServerInfo(serverInfoPromise.Result(), connectionID, config.Metrics, logger, config.TunnelEventChan)
-	registration := tunnelServer.RegisterTunnel(
+	registration := rpcClient.RegisterTunnel(
 		ctx,
 		config.OriginCert,
 		config.Hostname,
@@ -529,7 +532,7 @@ func processRegistrationSuccess(
 	logger logger.Service,
 	connectionID uint8,
 	registration *tunnelpogs.TunnelRegistration,
-	name registerRPCName,
+	name rpcName,
 	credentialManager *reconnectCredentialManager,
 ) error {
 	for _, logLine := range registration.LogLines {
@@ -563,7 +566,7 @@ func processRegistrationSuccess(
 	return nil
 }
 
-func processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, metrics *TunnelMetrics, name registerRPCName) error {
+func processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, metrics *TunnelMetrics, name rpcName) error {
 	if err.Error() == DuplicateConnectionError {
 		metrics.regFail.WithLabelValues("dup_edge_conn", string(name)).Inc()
 		return errDuplicationConnection
@@ -575,18 +578,18 @@ func processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, metrics
 	}
 }
 
-func UnregisterTunnel(muxer *h2mux.Muxer, gracePeriod time.Duration, logger logger.Service) error {
-	logger.Debug("initiating RPC stream to unregister")
+func UnregisterTunnel(muxer *h2mux.Muxer, config *TunnelConfig) error {
+	config.TransportLogger.Debug("initiating RPC stream to unregister")
 	ctx := context.Background()
-	tunnelServer, err := connection.NewRPCClient(ctx, muxer, logger, openStreamTimeout)
+	rpcClient, err := newTunnelRPCClient(ctx, muxer, config, unregister)
 	if err != nil {
 		// RPC stream open error
 		return err
 	}
-	defer tunnelServer.Close()
+	defer rpcClient.Close()
 
 	// gracePeriod is encoded in int64 using capnproto
-	return tunnelServer.UnregisterTunnel(ctx, gracePeriod.Nanoseconds())
+	return rpcClient.UnregisterTunnel(ctx, config.GracePeriod.Nanoseconds())
 }
 
 func LogServerInfo(
@@ -616,6 +619,7 @@ func LogServerInfo(
 
 type TunnelHandler struct {
 	originUrl      string
+	ingressRules   ingress.Ingress
 	httpHostHeader string
 	muxer          *h2mux.Muxer
 	httpClient     http.RoundTripper
@@ -637,12 +641,20 @@ func NewTunnelHandler(ctx context.Context,
 	connectionID uint8,
 	bufferPool *buffer.Pool,
 ) (*TunnelHandler, string, error) {
-	originURL, err := validation.ValidateUrl(config.OriginUrl)
-	if err != nil {
-		return nil, "", fmt.Errorf("unable to parse origin URL %#v", originURL)
+
+	// Check single-origin config
+	var originURL string
+	var err error
+	if config.IngressRules.IsEmpty() {
+		originURL, err = validation.ValidateUrl(config.OriginUrl)
+		if err != nil {
+			return nil, "", fmt.Errorf("unable to parse origin URL %#v", originURL)
+		}
 	}
+
 	h := &TunnelHandler{
 		originUrl:         originURL,
+		ingressRules:      config.IngressRules,
 		httpHostHeader:    config.HTTPHostHeader,
 		httpClient:        config.HTTPTransport,
 		tlsConfig:         config.ClientTlsConfig,
@@ -715,6 +727,12 @@ func (h *TunnelHandler) createRequest(stream *h2mux.MuxedStream) (*http.Request,
 		return nil, errors.Wrap(err, "invalid request received")
 	}
 	h.AppendTagHeaders(req)
+	if !h.ingressRules.IsEmpty() {
+		ruleNumber := h.ingressRules.FindMatchingRule(req.Host, req.URL.Path)
+		destination := h.ingressRules.Rules[ruleNumber].Service
+		req.URL.Host = destination.Host
+		req.URL.Scheme = destination.Scheme
+	}
 	return req, nil
 }
 
@@ -909,3 +927,18 @@ func findCfRayHeader(h1 *http.Request) string {
 func isLBProbeRequest(req *http.Request) bool {
 	return strings.HasPrefix(req.UserAgent(), lbProbeUserAgentPrefix)
 }
+
+func newTunnelRPCClient(ctx context.Context, muxer *h2mux.Muxer, config *TunnelConfig, rpcName rpcName) (tunnelpogs.TunnelServer_PogsClient, error) {
+	openStreamCtx, openStreamCancel := context.WithTimeout(ctx, openStreamTimeout)
+	defer openStreamCancel()
+	stream, err := muxer.OpenRPCStream(openStreamCtx)
+	if err != nil {
+		return tunnelpogs.TunnelServer_PogsClient{}, err
+	}
+	rpcClient, err := connection.NewTunnelRPCClient(ctx, stream, config.TransportLogger)
+	if err != nil {
+		// RPC stream open error
+		return tunnelpogs.TunnelServer_PogsClient{}, newRPCError(err, config.Metrics.rpcFail, rpcName)
+	}
+	return rpcClient, nil
+}

tunneldns/tunnel.go

@@ -27,6 +27,48 @@ type Listener struct {
 	logger logger.Service
 }
 
+func Command(hidden bool) *cli.Command {
+	return &cli.Command{
+		Name:   "proxy-dns",
+		Action: cliutil.ErrorHandler(Run),
+		Usage:  "Run a DNS over HTTPS proxy server.",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "metrics",
+				Value:   "localhost:",
+				Usage:   "Listen address for metrics reporting.",
+				EnvVars: []string{"TUNNEL_METRICS"},
+			},
+			&cli.StringFlag{
+				Name:    "address",
+				Usage:   "Listen address for the DNS over HTTPS proxy server.",
+				Value:   "localhost",
+				EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
+			},
+			&cli.IntFlag{
+				Name:    "port",
+				Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
+				Value:   53,
+				EnvVars: []string{"TUNNEL_DNS_PORT"},
+			},
+			&cli.StringSliceFlag{
+				Name:    "upstream",
+				Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
+				Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
+				EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
+			},
+			&cli.StringSliceFlag{
+				Name:    "bootstrap",
+				Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
+				Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
+				EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
+			},
+		},
+		ArgsUsage: " ", // can't be the empty string or we get the default output
+		Hidden:    hidden,
+	}
+}
+
 // Run implements a foreground runner
 func Run(c *cli.Context) error {
 	logDirectory, logLevel := config.FindLogSettings()

tunnelrpc/pogs/connectionrpc.go

@@ -7,7 +7,9 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	capnp "zombiezen.com/go/capnproto2"
 	"zombiezen.com/go/capnproto2/pogs"
+	"zombiezen.com/go/capnproto2/rpc"
 	"zombiezen.com/go/capnproto2/server"
 
 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -18,6 +20,156 @@ type RegistrationServer interface {
 	UnregisterConnection(ctx context.Context)
 }
 
+type RegistrationServer_PogsImpl struct {
+	impl RegistrationServer
+}
+
+func RegistrationServer_ServerToClient(s RegistrationServer) tunnelrpc.RegistrationServer {
+	return tunnelrpc.RegistrationServer_ServerToClient(RegistrationServer_PogsImpl{s})
+}
+
+func (i RegistrationServer_PogsImpl) RegisterConnection(p tunnelrpc.RegistrationServer_registerConnection) error {
+	server.Ack(p.Options)
+
+	auth, err := p.Params.Auth()
+	if err != nil {
+		return err
+	}
+	var pogsAuth TunnelAuth
+	err = pogsAuth.UnmarshalCapnproto(auth)
+	if err != nil {
+		return err
+	}
+	uuidBytes, err := p.Params.TunnelId()
+	if err != nil {
+		return err
+	}
+	tunnelID, err := uuid.FromBytes(uuidBytes)
+	if err != nil {
+		return err
+	}
+	connIndex := p.Params.ConnIndex()
+	options, err := p.Params.Options()
+	if err != nil {
+		return err
+	}
+	var pogsOptions ConnectionOptions
+	err = pogsOptions.UnmarshalCapnproto(options)
+	if err != nil {
+		return err
+	}
+
+	connDetails, callError := i.impl.RegisterConnection(p.Ctx, pogsAuth, tunnelID, connIndex, &pogsOptions)
+
+	resp, err := p.Results.NewResult()
+	if err != nil {
+		return err
+	}
+
+	if callError != nil {
+		if connError, err := resp.Result().NewError(); err != nil {
+			return err
+		} else {
+			return MarshalError(connError, callError)
+		}
+	}
+
+	if details, err := resp.Result().NewConnectionDetails(); err != nil {
+		return err
+	} else {
+		return connDetails.MarshalCapnproto(details)
+	}
+}
+
+func (i RegistrationServer_PogsImpl) UnregisterConnection(p tunnelrpc.RegistrationServer_unregisterConnection) error {
+	server.Ack(p.Options)
+
+	i.impl.UnregisterConnection(p.Ctx)
+	return nil
+}
+
+type RegistrationServer_PogsClient struct {
+	Client capnp.Client
+	Conn   *rpc.Conn
+}
+
+func (c RegistrationServer_PogsClient) RegisterConnection(ctx context.Context, auth TunnelAuth, tunnelID uuid.UUID, connIndex byte, options *ConnectionOptions) (*ConnectionDetails, error) {
+	client := tunnelrpc.TunnelServer{Client: c.Client}
+	promise := client.RegisterConnection(ctx, func(p tunnelrpc.RegistrationServer_registerConnection_Params) error {
+		tunnelAuth, err := p.NewAuth()
+		if err != nil {
+			return err
+		}
+		if err = auth.MarshalCapnproto(tunnelAuth); err != nil {
+			return err
+		}
+		err = p.SetAuth(tunnelAuth)
+		if err != nil {
+			return err
+		}
+		err = p.SetTunnelId(tunnelID[:])
+		if err != nil {
+			return err
+		}
+		p.SetConnIndex(connIndex)
+		connectionOptions, err := p.NewOptions()
+		if err != nil {
+			return err
+		}
+		err = options.MarshalCapnproto(connectionOptions)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	response, err := promise.Result().Struct()
+	if err != nil {
+		return nil, wrapRPCError(err)
+	}
+	result := response.Result()
+	switch result.Which() {
+	case tunnelrpc.ConnectionResponse_result_Which_error:
+		resultError, err := result.Error()
+		if err != nil {
+			return nil, wrapRPCError(err)
+		}
+		cause, err := resultError.Cause()
+		if err != nil {
+			return nil, wrapRPCError(err)
+		}
+		err = errors.New(cause)
+		if resultError.ShouldRetry() {
+			err = RetryErrorAfter(err, time.Duration(resultError.RetryAfter()))
+		}
+		return nil, err
+
+	case tunnelrpc.ConnectionResponse_result_Which_connectionDetails:
+		connDetails, err := result.ConnectionDetails()
+		if err != nil {
+			return nil, wrapRPCError(err)
+		}
+		details := new(ConnectionDetails)
+		if err = details.UnmarshalCapnproto(connDetails); err != nil {
+			return nil, wrapRPCError(err)
+		}
+		return details, nil
+	}
+
+	return nil, newRPCError("unknown result which %d", result.Which())
+}
+
+func (c RegistrationServer_PogsClient) UnregisterConnection(ctx context.Context) error {
+	client := tunnelrpc.TunnelServer{Client: c.Client}
+	promise := client.UnregisterConnection(ctx, func(p tunnelrpc.RegistrationServer_unregisterConnection_Params) error {
+		return nil
+	})
+	_, err := promise.Struct()
+	if err != nil {
+		return wrapRPCError(err)
+	}
+	return nil
+}
+
 type ClientInfo struct {
 	ClientID []byte `capnp:"clientId"` // must be a slice for capnp compatibility
 	Features []string
@@ -98,140 +250,3 @@ func MarshalError(s tunnelrpc.ConnectionError, err error) error {
 
 	return nil
 }
-
-func (i TunnelServer_PogsImpl) RegisterConnection(p tunnelrpc.RegistrationServer_registerConnection) error {
-	server.Ack(p.Options)
-
-	auth, err := p.Params.Auth()
-	if err != nil {
-		return err
-	}
-	var pogsAuth TunnelAuth
-	err = pogsAuth.UnmarshalCapnproto(auth)
-	if err != nil {
-		return err
-	}
-	uuidBytes, err := p.Params.TunnelId()
-	if err != nil {
-		return err
-	}
-	tunnelID, err := uuid.FromBytes(uuidBytes)
-	if err != nil {
-		return err
-	}
-	connIndex := p.Params.ConnIndex()
-	options, err := p.Params.Options()
-	if err != nil {
-		return err
-	}
-	var pogsOptions ConnectionOptions
-	err = pogsOptions.UnmarshalCapnproto(options)
-	if err != nil {
-		return err
-	}
-
-	connDetails, callError := i.impl.RegisterConnection(p.Ctx, pogsAuth, tunnelID, connIndex, &pogsOptions)
-
-	resp, err := p.Results.NewResult()
-	if err != nil {
-		return err
-	}
-
-	if callError != nil {
-		if connError, err := resp.Result().NewError(); err != nil {
-			return err
-		} else {
-			return MarshalError(connError, callError)
-		}
-	}
-
-	if details, err := resp.Result().NewConnectionDetails(); err != nil {
-		return err
-	} else {
-		return connDetails.MarshalCapnproto(details)
-	}
-}
-
-func (i TunnelServer_PogsImpl) UnregisterConnection(p tunnelrpc.RegistrationServer_unregisterConnection) error {
-	server.Ack(p.Options)
-
-	i.impl.UnregisterConnection(p.Ctx)
-	return nil
-}
-
-func (c TunnelServer_PogsClient) RegisterConnection(ctx context.Context, auth TunnelAuth, tunnelID uuid.UUID, connIndex byte, options *ConnectionOptions) (*ConnectionDetails, error) {
-	client := tunnelrpc.TunnelServer{Client: c.Client}
-	promise := client.RegisterConnection(ctx, func(p tunnelrpc.RegistrationServer_registerConnection_Params) error {
-		tunnelAuth, err := p.NewAuth()
-		if err != nil {
-			return err
-		}
-		if err = auth.MarshalCapnproto(tunnelAuth); err != nil {
-			return err
-		}
-		err = p.SetAuth(tunnelAuth)
-		if err != nil {
-			return err
-		}
-		err = p.SetTunnelId(tunnelID[:])
-		if err != nil {
-			return err
-		}
-		p.SetConnIndex(connIndex)
-		connectionOptions, err := p.NewOptions()
-		if err != nil {
-			return err
-		}
-		err = options.MarshalCapnproto(connectionOptions)
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-	response, err := promise.Result().Struct()
-	if err != nil {
-		return nil, wrapRPCError(err)
-	}
-	result := response.Result()
-	switch result.Which() {
-	case tunnelrpc.ConnectionResponse_result_Which_error:
-		resultError, err := result.Error()
-		if err != nil {
-			return nil, wrapRPCError(err)
-		}
-		cause, err := resultError.Cause()
-		if err != nil {
-			return nil, wrapRPCError(err)
-		}
-		err = errors.New(cause)
-		if resultError.ShouldRetry() {
-			err = RetryErrorAfter(err, time.Duration(resultError.RetryAfter()))
-		}
-		return nil, err
-
-	case tunnelrpc.ConnectionResponse_result_Which_connectionDetails:
-		connDetails, err := result.ConnectionDetails()
-		if err != nil {
-			return nil, wrapRPCError(err)
-		}
-		details := new(ConnectionDetails)
-		if err = details.UnmarshalCapnproto(connDetails); err != nil {
-			return nil, wrapRPCError(err)
-		}
-		return details, nil
-	}
-
-	return nil, newRPCError("unknown result which %d", result.Which())
-}
-
-func (c TunnelServer_PogsClient) UnregisterConnection(ctx context.Context) error {
-	client := tunnelrpc.TunnelServer{Client: c.Client}
-	promise := client.UnregisterConnection(ctx, func(p tunnelrpc.RegistrationServer_unregisterConnection_Params) error {
-		return nil
-	})
-	_, err := promise.Struct()
-	if err != nil {
-		return wrapRPCError(err)
-	}
-	return nil
-}

tunnelrpc/pogs/connectionrpc_test.go

@@ -62,6 +62,10 @@ func TestConnectionRegistrationRPC(t *testing.T) {
 	clientConn := rpc.NewConn(t2)
 	defer clientConn.Close()
 	client := TunnelServer_PogsClient{
+		RegistrationServer_PogsClient: RegistrationServer_PogsClient{
+			Client: clientConn.Bootstrap(ctx),
+			Conn:   clientConn,
+		},
 		Client: clientConn.Bootstrap(ctx),
 		Conn:   clientConn,
 	}

tunnelrpc/pogs/tunnelrpc.go

@@ -210,10 +210,11 @@ type TunnelServer interface {
 }
 
 func TunnelServer_ServerToClient(s TunnelServer) tunnelrpc.TunnelServer {
-	return tunnelrpc.TunnelServer_ServerToClient(TunnelServer_PogsImpl{s})
+	return tunnelrpc.TunnelServer_ServerToClient(TunnelServer_PogsImpl{RegistrationServer_PogsImpl{s}, s})
 }
 
 type TunnelServer_PogsImpl struct {
+	RegistrationServer_PogsImpl
 	impl TunnelServer
 }
 
@@ -268,6 +269,7 @@ func (i TunnelServer_PogsImpl) ObsoleteDeclarativeTunnelConnect(p tunnelrpc.Tunn
 }
 
 type TunnelServer_PogsClient struct {
+	RegistrationServer_PogsClient
 	Client capnp.Client
 	Conn   *rpc.Conn
 }

tunnelstore/client.go

@@ -376,16 +376,12 @@ func (r *RESTClient) sendRequest(method string, url url.URL, body interface{}) (
 func parseResponse(reader io.Reader, data interface{}) error {
 	// Schema for Tunnelstore responses in the v1 API.
 	// Roughly, it's a wrapper around a particular result that adds failures/errors/etc
-	var result struct {
-		Result  json.RawMessage `json:"result"`
-		Success bool            `json:"success"`
-		Errors  []string        `json:"errors"`
-	}
+	var result response
 	// First, parse the wrapper and check the API call succeeded
 	if err := json.NewDecoder(reader).Decode(&result); err != nil {
 		return errors.Wrap(err, "failed to decode response")
 	}
-	if err := checkErrors(result.Errors); err != nil {
+	if err := result.checkErrors(); err != nil {
 		return err
 	}
 	if !result.Success {
@@ -402,24 +398,43 @@ func unmarshalTunnel(reader io.Reader) (*Tunnel, error) {
 	return &tunnel, err
 }
 
-func checkErrors(errs []string) error {
-	if len(errs) == 0 {
+type response struct {
+	Success  bool            `json:"success,omitempty"`
+	Errors   []apiErr        `json:"errors,omitempty"`
+	Messages []string        `json:"messages,omitempty"`
+	Result   json.RawMessage `json:"result,omitempty"`
+}
+
+func (r *response) checkErrors() error {
+	if len(r.Errors) == 0 {
 		return nil
 	}
-	if len(errs) == 1 {
-		return fmt.Errorf("API error: %s", errs[0])
+	if len(r.Errors) == 1 {
+		return r.Errors[0]
 	}
-	allErrs := strings.Join(errs, "; ")
-	return fmt.Errorf("API errors: %s", allErrs)
+	var messages string
+	for _, e := range r.Errors {
+		messages += fmt.Sprintf("%s; ", e)
+	}
+	return fmt.Errorf("API errors: %s", messages)
+}
+
+type apiErr struct {
+	Code    json.Number `json:"code,omitempty"`
+	Message string      `json:"message,omitempty"`
+}
+
+func (e apiErr) Error() string {
+	return fmt.Sprintf("code: %v, reason: %s", e.Code, e.Message)
 }
 
 func (r *RESTClient) statusCodeToError(op string, resp *http.Response) error {
 	if resp.Header.Get("Content-Type") == "application/json" {
-		var errorsResp struct {
-			Error string `json:"error"`
-		}
-		if json.NewDecoder(resp.Body).Decode(&errorsResp) == nil && errorsResp.Error != "" {
-			return errors.Errorf("Failed to %s: %s", op, errorsResp.Error)
+		var errorsResp response
+		if json.NewDecoder(resp.Body).Decode(&errorsResp) == nil {
+			if err := errorsResp.checkErrors(); err != nil {
+				return errors.Errorf("Failed to %s: %s", op, err)
+			}
 		}
 	}
 

tunnelstore/client_test.go

@@ -30,8 +30,8 @@ func TestDNSRouteUnmarshalResult(t *testing.T) {
 	badJSON := []string{
 		`abc`,
 		`{"success": false, "result": {"cname": "new"}}`,
-		`{"errors": ["foo"], "result": {"cname": "new"}}`,
-		`{"errors": ["foo", "bar"], "result": {"cname": "new"}}`,
+		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"cname": "new"}}`,
+		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}, {"code": 1004, "message":"Cannot use tunnel as origin for non-proxied load balancer"}], "result": {"cname": "new"}}`,
 		`{"result": {"cname": "new"}}`,
 		`{"result": {"cname": "new"}}`,
 	}
@@ -60,8 +60,8 @@ func TestLBRouteUnmarshalResult(t *testing.T) {
 	badJSON := []string{
 		`abc`,
 		`{"success": false, "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
-		`{"errors": ["foo"], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
-		`{"errors": ["foo", "bar"], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
+		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
+		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}, {"code": 1004, "message":"Cannot use tunnel as origin for non-proxied load balancer"}], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 		`{"result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 	}
 
@@ -127,7 +127,7 @@ func Test_parseListTunnels(t *testing.T) {
 		},
 		{
 			name:    "errors are present",
-			args:    args{body: `{"errors": ["foo"], "result": []}`},
+			args:    args{body: `{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": []}`},
 			wantErr: true,
 		},
 		{
@@ -197,7 +197,7 @@ func TestUnmarshalTunnelErr(t *testing.T) {
 		`abc`,
 		`{"success": true, "result": abc}`,
 		`{"success": false, "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
-		`{"errors": ["foo"], "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
+		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
 	}
 
 	for i, test := range tests {