Release 2021.5.2

Setup a Github action for checking the cloudflared build
Release 2021.5.1
2026-08-07 23:31:56 +00:00 · 2021-05-13 17:31:00 -05:00 · 2021-05-13 01:43:08 +01:00 · 2021-05-12 12:42:15 -05:00 · 2021-05-11 19:26:05 +00:00 · 2021-05-11 06:55:59 +00:00
47 changed files with 659 additions and 1757 deletions
@@ -15,4 +15,3 @@ cscope.*
 *-session.log
 ssh_server_tests/.env
 /.cover
-built_artifacts/
@@ -1,35 +1,6 @@
 **Experimental**: This is a new format for release notes. The format and availability is subject to change.

-## 2021.6.0
-### Bug Fixes
- Fixes a http2 transport (the new default for Named Tunnels) to work with unix socket origins.
-
-
-## 2021.5.10
-### Bug Fixes
- Fixes a memory leak in h2mux transport that connects cloudflared to Cloudflare edge.
-
-
-## 2021.5.9
-### New Features
- Uses new Worker based login helper service to facilitate token exchange in cloudflared flows.
-
-### Bug Fixes
- Fixes Centos-7 builds.
-
-## 2021.5.8
-### New Features
- When creating a DNS record to point a hostname at a tunnel, you can now use --overwrite-dns to overwrite any existing
-  DNS records with that hostname. This works both when using the CLI to provision DNS, as well as when starting an adhoc
-  named tunnel, e.g.:
-  - `cloudflared tunnel route dns --overwrite-dns foo-tunnel foo.example.com`
-  - `cloudflared tunnel --overwrite-dns --name foo-tunnel --hostname foo.example.com`
-
-## 2021.5.7
-### New Features
- Named Tunnels will automatically select the protocol to connect to Cloudflare's edge network.
-
-## 2021.5.0
+## 2020.5.0

 ### New Features
 - It is now possible to run the same tunnel using more than one `cloudflared` instance. This is a server-side change and
@@ -11,13 +11,6 @@ ifneq ($(GO_BUILD_TAGS),)
 	GO_BUILD_TAGS := -tags $(GO_BUILD_TAGS)
 endif

-ifeq ($(NIGHTLY), true)
-	DEB_PACKAGE_NAME := cloudflared-nightly
-	NIGHTLY_FLAGS := --conflicts cloudflared --replaces cloudflared
-else
-	DEB_PACKAGE_NAME := cloudflared
-endif
-
 DATE          := $(shell date -u '+%Y-%m-%d-%H%M UTC')
 VERSION_FLAGS := -ldflags='-X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"'

@@ -88,7 +81,7 @@ clean:
 	go clean

 .PHONY: cloudflared
-cloudflared: 
+cloudflared: tunnel-deps
 ifeq ($(FIPS), true)
 	$(info Building cloudflared with go-fips)
 	-test -f fips/fips.go && mv fips/fips.go fips/fips.go.linux-amd64
@@ -145,7 +138,7 @@ define build_package
 		--license 'Cloudflare Service Agreement' \
 		--url 'https://github.com/cloudflare/cloudflared' \
 		-m 'Cloudflare <support@cloudflare.com>' \
-		-a $(TARGET_ARCH) -v $(VERSION) -n $(DEB_PACKAGE_NAME) $(NIGHTLY_FLAGS) --after-install postinst.sh --after-remove postrm.sh \
+		-a $(TARGET_ARCH) -v $(VERSION) -n cloudflared --after-install postinst.sh --after-remove postrm.sh \
 		cloudflared=$(INSTALL_BINDIR) cloudflared.1=$(MAN_DIR)
 endef

@@ -157,14 +150,6 @@ cloudflared-deb: cloudflared
 cloudflared-rpm: cloudflared
 	$(call build_package,rpm)

-.PHONY: cloudflared-pkg
-cloudflared-pkg: cloudflared
-	$(call build_package,osxpkg)
-
-.PHONY: cloudflared-msi
-cloudflared-msi: cloudflared
-	wixl --define Version=$(VERSION) --define Path=$(EXECUTABLE_PATH) --output cloudflared-$(VERSION)-$(TARGET_ARCH).msi cloudflared.wxs
-
 .PHONY: cloudflared-darwin-amd64.tgz
 cloudflared-darwin-amd64.tgz: cloudflared
 	tar czf cloudflared-darwin-amd64.tgz cloudflared
@@ -239,10 +224,6 @@ release: bin/equinox
 github-release: cloudflared
 	python3 github_release.py --path $(EXECUTABLE_PATH) --release-version $(VERSION)

-.PHONY: github-release-built-pkgs
-github-release-built-pkgs:
-	python3 github_release.py --path $(PWD)/built_artifacts --release-version $(VERSION)
-
 .PHONY: github-message
 github-message:
 	python3 github_message.py --release-version $(VERSION)
@@ -256,25 +237,24 @@ bin/equinox:
 	mkdir -p bin
 	curl -s https://bin.equinox.io/c/75JtLRTsJ3n/release-tool-beta-$(EQUINOX_PLATFORM).tgz | tar xz -C bin/

+.PHONY: tunnel-deps
+tunnel-deps: tunnelrpc/tunnelrpc.capnp.go

-.PHONY: tunnelrpc-deps
-tunnelrpc-deps:
+tunnelrpc/tunnelrpc.capnp.go: tunnelrpc/tunnelrpc.capnp
 	which capnp  # https://capnproto.org/install.html
 	which capnpc-go  # go get zombiezen.com/go/capnproto2/capnpc-go
 	capnp compile -ogo tunnelrpc/tunnelrpc.capnp

-.PHONY: quic-deps
-quic-deps: 
-	which capnp 
-	which capnpc-go
-	capnp compile -ogo quic/schema/quic_metadata_protocol.capnp
-
 .PHONY: vet
 vet:
 	go vet -mod=vendor ./...
 	which go-sumtype  # go get github.com/BurntSushi/go-sumtype (don't do this in build directory or this will cause vendor issues)
 	go-sumtype $$(go list -mod=vendor ./...)

+.PHONY: msi
+msi: cloudflared
+	go-msi make --msi cloudflared.msi --version $(MSI_VERSION)
+
 .PHONY: goimports
 goimports:
 	for d in $$(go list -mod=readonly -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc) ; do goimports -format-only -local github.com/cloudflare/cloudflared -w $$d ; done
@@ -1,53 +1,5 @@
-2021.7.2
- 2021-07-27 Fixed a syntax error with python logging.
-
-2021.7.1
- 2021-07-21 TUN-4755: Add a windows msi release option to Make
- 2021-07-22 TUN-4761: Added a build-all-packages target to cfsetup
- 2021-07-26 TUN-4771: Upload deb, rpm and msi packages to github
- 2021-07-14 TUN-4714: Name nightly package cloudflared-nightly to avoid apt conflict
- 2021-07-16 TUN-4701: Split Proxy into ProxyHTTP and ProxyTCP
- 2021-07-08 TUN-4596: Add QUIC application protocol for QUIC stream handshake
- 2021-07-09 TUN-4699: Make quick tunnels the default in cloudflared
-
-2021.7.0
- 2021-07-01 TUN-4626: Proxy non-stream based origin websockets with http Roundtrip.
- 2021-07-01 TUN-4655: ingress.StreamBasedProxy.EstablishConnection takes dest input
- 2021-07-09 TUN-4698: Add cloudflared metrics endpoint to serve quick tunnel hostname
- 2021-06-21 TUN-4521: Modify cloudflared to use zoneless-tunnels-worker for free tunnels
- 2021-04-05 AUTH-3475: Updated GetAppInfo error message
-
-2021.6.0
- 2021-06-21 TUN-4571: Changelog for 2021.6.0
- 2021-06-18 TUN-4571: Fix proxying to unix sockets when using HTTP2 transport to Cloudflare Edge
- 2021-06-07 TUN-4502: Make `cloudflared tunnel route` subcommands described consistently
- 2021-06-08 TUN-4504: Fix component tests in windows
- 2021-05-27 TUN-4461: Log resulting DNS hostname if one is received from Cloudflare API
-
-2021.5.10
- 2021-05-25 TUN-4456: Replaced instances of Tick() with Ticker() in h2mux paths
-
-2021.5.9
- 2021-05-20 TUN-4426: Fix centos builds
- 2021-05-20 Update changelog
- 2021-04-30 AUTH-3426: Point to new transfer service URL and eliminate PUT /ok
-
-2021.5.8
- 2021-05-14 TUN-4419: Improve error message when cloudflared cannot reach origin
- 2021-05-19 TUN-4425: --overwrite-dns flag for in adhoc and route dns cmds
-
-2021.5.7
- 2021-05-17 Fix typo in Changes.md
- 2021-05-17 TUN-4421: Named Tunnels will automatically select the protocol to connect to Cloudflare's edge network
-
-2021.5.6
- 2021-05-14 TUN-4418: Downgrade to Go 1.16.3
-
-2021.5.5
-
-
-2021.5.4
- Fix release pipeline
+2021.5.2
+- 2021-05-04 Setup a Github action for checking the cloudflared build

 2021.5.1
 - 2021-05-10 TUN-4342: Fix false positive warning about unused hostname property
@@ -1,22 +0,0 @@
-# This controls the directory the built artifacts go into
-export ARTIFACT_DIR=built_artifacts/
-mkdir -p $ARTIFACT_DIR
-windowsArchs=("amd64" "386")
-export TARGET_OS=windows
-for arch in ${windowsArchs[@]}; do 
-    export TARGET_ARCH=$arch
-    make cloudflared-msi
-done
-
-mv *.msi $ARTIFACT_DIR
-
-linuxArchs=("amd64" "386" "arm")
-export TARGET_OS=linux
-for arch in ${linuxArchs[@]}; do 
-    export TARGET_ARCH=$arch
-    make cloudflared-deb
-    make cloudflared-rpm
-done
-
-mv *.deb $ARTIFACT_DIR
-mv *.rpm $ARTIFACT_DIR
@@ -1,4 +1,4 @@
-pinned_go: &pinned_go go=1.16.3-1
+pinned_go: &pinned_go go=1.16.4-3
 pinned_go_fips: &pinned_go_fips go-fips=1.15.5-3

 build_dir: &build_dir /cfsetup_build
@@ -14,51 +14,9 @@ stretch: &stretch
      - export GOARCH=amd64
      - export FIPS=true
      - make cloudflared
-  build-all-packages: #except osxpkg
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go_fips
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - wget
-      # libmsi and libgcab are libraries the wixl binary depends on.
-      - libmsi-dev
-      - libgcab-dev
-    pre-cache:
-      # TODO: https://jira.cfops.it/browse/TUN-4792 Replace this wixl with the official one once msitools supports
-      # environment.
-      - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
-      - chmod a+x /usr/local/bin/wixl
-    post-cache:
-      - ./build-packages.sh
-  github-release-pkgs:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go_fips
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - wget
-      # libmsi and libgcab are libraries the wixl binary depends on.
-      - libmsi-dev
-      - libgcab-dev
-      - python3-setuptools
-      - python3-pip
-    pre-cache:
-      - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
-      - chmod a+x /usr/local/bin/wixl
-      - pip3 install pygithub
-    post-cache:
-      # build all packages and move them to /cfsetup/built_artifacts
-      - ./build-packages.sh
-      # release the packages built and moved to /cfsetup/built_artifacts
-      - make github-release-built-pkgs
  build-deb:
    build_dir: *build_dir
-    builddeps: &build_deb_deps
+    builddeps:
      - *pinned_go_fips
      - build-essential
      - fakeroot
@@ -68,18 +26,13 @@ stretch: &stretch
      - export GOARCH=amd64
      - export FIPS=true
      - make cloudflared-deb
-  build-deb-nightly:
-    build_dir: *build_dir
-    builddeps: *build_deb_deps
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=amd64
-      - export FIPS=true
-      - export NIGHTLY=true
-      - make cloudflared-deb
  build-deb-arm64:
    build_dir: *build_dir
-    builddeps: *build_deb_deps
+    builddeps:
+      - *pinned_go
+      - build-essential
+      - fakeroot
+      - rubygem-fpm
    post-cache:
      - export GOOS=linux
      - export GOARCH=arm64
@@ -326,9 +279,8 @@ centos-7:
      - https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
    pre-cache:
      - yum install -y fakeroot
-      - yum upgrade -y binutils-2.27-44.base.el7.x86_64
-      - wget https://golang.org/dl/go1.16.3.linux-amd64.tar.gz -P /tmp/
-      - tar -C /usr/local -xzf /tmp/go1.16.3.linux-amd64.tar.gz
+      - wget https://golang.org/dl/go1.16.4.linux-amd64.tar.gz -P /tmp/
+      - tar -C /usr/local -xzf /tmp/go1.16.4.linux-amd64.tar.gz
    post-cache:
      - export PATH=$PATH:/usr/local/go/bin
      - export GOOS=linux
@@ -339,9 +291,8 @@ centos-7:
    builddeps: *el7_builddeps
    pre-cache:
      - yum install -y fakeroot
-      - yum upgrade -y binutils-2.27-44.base.el7.x86_64
-      - wget https://golang.org/dl/go1.16.3.linux-amd64.tar.gz -P /tmp/
-      - tar -C /usr/local -xzf /tmp/go1.16.3.linux-amd64.tar.gz
+      - wget https://golang.org/dl/go1.16.4.linux-amd64.tar.gz -P /tmp/
+      - tar -C /usr/local -xzf /tmp/go1.16.4.linux-amd64.tar.gz
    post-cache:
      - export PATH=$PATH:/usr/local/go/bin
      - export GOOS=linux
@@ -1,62 +0,0 @@
-<?xml version="1.0"?>
-
-<?if $(var.Platform)="x86"?>
-    <?define Program_Files="ProgramFilesFolder"?>
-<?else?>
-    <?define Program_Files="ProgramFiles64Folder"?>
-<?endif?>
-<?ifndef var.Version?>
-    <?error Undefined Version variable?>
-<?endif?>
-<?ifndef var.Path?>
-    <?error Undefined Path variable?>
-<?endif?>
-
-<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
-    <Product Id="35e5e858-9372-4449-bf73-1cd6f7267128" 
-        UpgradeCode="23f90fdd-9328-47ea-ab52-5380855a4b12"
-        Name="cloudflared"
-        Version="$(var.Version)"
-        Manufacturer="cloudflare"
-        Language="1033">
-
-      <Package InstallerVersion="200" Compressed="yes" Comments="Windows Installer Package" InstallScope="perMachine"/>
-
-      <Media Id="1" Cabinet="product.cab" EmbedCab="yes"/>
-
-      <Upgrade Id="23f90fdd-9328-47ea-ab52-5380855a4b12">
-         <UpgradeVersion Minimum="$(var.Version)" OnlyDetect="yes" Property="NEWERVERSIONDETECTED"/>
-         <UpgradeVersion Minimum="2020.8.0" Maximum="$(var.Version)" IncludeMinimum="yes" IncludeMaximum="no"
-                         Property="OLDERVERSIONBEINGUPGRADED"/>
-      </Upgrade>
-      <Condition Message="A newer version of this software is already installed.">NOT NEWERVERSIONDETECTED</Condition>
-
-    <Directory Id="TARGETDIR" Name="SourceDir">
-        <!--This specifies where the cloudflared.exe is moved to in the windows Operation System-->
-        <Directory Id="$(var.Program_Files)">
-            <Directory Id="INSTALLDIR" Name="cloudflared">
-                <Component Id="ApplicationFiles" Guid="35e5e858-9372-4449-bf73-1cd6f7267128">
-                    <File Id="ApplicationFile0" Source="$(var.Path)"/>
-                </Component>
-            </Directory>
-        </Directory>
-        <Component Id="ENVS" Guid="6bb74449-d10d-4f4a-933e-6fc9fa006eae">
-        <!--Set the cloudflared bin location to the Path Environment Variable-->
-         <Environment Id="ENV0"
-           Name="PATH"
-           Value="[INSTALLDIR]."
-           Permanent="no"
-           Part="all"
-           Action="set"
-           System="yes" />
-        </Component>
-    </Directory>
-
-
-    <Feature Id='Complete' Level='1'>
-      <ComponentRef Id="ENVS"/>
-      <ComponentRef Id='ApplicationFiles' />
-    </Feature>
-
-    </Product>
-</Wix>
@@ -73,7 +73,7 @@ func Run(c *cli.Context) error {
 		log.Fatal().Err(err).Msg("Failed to open the metrics listener")
 	}

-	go metrics.ServeMetrics(metricsListener, nil, nil, "", log)
+	go metrics.ServeMetrics(metricsListener, nil, nil, log)

 	listener, err := tunneldns.CreateListener(
 		c.String("address"),
@@ -87,10 +87,6 @@ const (
 var (
 	graceShutdownC chan struct{}
 	version        string
-
-	routeFailMsg = fmt.Sprintf("failed to provision routing, please create it manually via Cloudflare dashboard or UI; "+
-		"most likely you already have a conflicting record there. You can also rerun this command with --%s to overwrite "+
-		"any existing DNS records for this hostname.", overwriteDNSFlag)
 )

 func Flags() []cli.Flag {
@@ -163,12 +159,6 @@ func TunnelCommand(c *cli.Context) error {
 		return fmt.Errorf("Use `cloudflared tunnel run` to start tunnel %s", ref)
 	}

-	// Unauthenticated named tunnel on <random>.<quick-tunnels-service>.com
-	// For now, default to legacy setup unless quick-service is specified
-	if c.String("hostname") == "" && c.String("quick-service") != "" {
-		return RunQuickTunnel(sc)
-	}
-
 	// Start a classic tunnel
 	return runClassicTunnel(sc)
 }
@@ -191,7 +181,7 @@ func runAdhocNamedTunnel(sc *subcommandContext, name, credentialsOutputPath stri

 	if r, ok := routeFromFlag(sc.c); ok {
 		if res, err := sc.route(tunnel.ID, r); err != nil {
-			sc.log.Err(err).Str("route", r.String()).Msg(routeFailMsg)
+			sc.log.Err(err).Str("route", r.String()).Msg("failed to provision routing, please create it manually via Cloudflare dashboard or UI; most likely you already have a conflicting record there")
 		} else {
 			sc.log.Info().Msg(res.SuccessSummary())
 		}
@@ -209,12 +199,12 @@ func runClassicTunnel(sc *subcommandContext) error {
 	return StartServer(sc.c, version, nil, sc.log, sc.isUIEnabled)
 }

-func routeFromFlag(c *cli.Context) (route tunnelstore.Route, ok bool) {
+func routeFromFlag(c *cli.Context) (tunnelstore.Route, bool) {
 	if hostname := c.String("hostname"); hostname != "" {
 		if lbPool := c.String("lb-pool"); lbPool != "" {
 			return tunnelstore.NewLBRoute(hostname, lbPool), true
 		}
-		return tunnelstore.NewDNSRoute(hostname, c.Bool(overwriteDNSFlagName)), true
+		return tunnelstore.NewDNSRoute(hostname), true
 	}
 	return nil, false
 }
@@ -324,15 +314,6 @@ func StartServer(

 	observer := connection.NewObserver(log, logTransport, isUIEnabled)

-	// Send Quick Tunnel URL to UI if applicable
-	var quickTunnelURL string
-	if namedTunnel != nil {
-		quickTunnelURL = namedTunnel.QuickTunnelUrl
-	}
-	if quickTunnelURL != "" {
-		observer.SendURL(quickTunnelURL)
-	}
-
 	tunnelConfig, ingressRules, err := prepareTunnelConfig(c, buildInfo, version, log, logTransport, observer, namedTunnel)
 	if err != nil {
 		log.Err(err).Msg("Couldn't start tunnel")
@@ -350,7 +331,7 @@ func StartServer(
 		defer wg.Done()
 		readinessServer := metrics.NewReadyServer(log)
 		observer.RegisterSink(readinessServer)
-		errC <- metrics.ServeMetrics(metricsListener, ctx.Done(), readinessServer, quickTunnelURL, log)
+		errC <- metrics.ServeMetrics(metricsListener, ctx.Done(), readinessServer, log)
 	}()

 	if err := ingressRules.StartOrigins(&wg, log, ctx.Done(), errC); err != nil {
@@ -631,14 +612,7 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:  false,
 			Hidden: shouldHide,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:   "quick-service",
-			Usage:  "URL for a service which manages unauthenticated 'quick' tunnels.",
-			Value:  "https://api.trycloudflare.com",
-			Hidden: true,
-		}),
 		selectProtocolFlag,
-		overwriteDNSFlag,
 	}...)

 	return flags
@@ -161,7 +161,7 @@ func prepareTunnelConfig(
 		log.Err(err).Str(LogFieldHostname, configHostname).Msg("Invalid hostname")
 		return nil, ingress.Ingress{}, errors.Wrap(err, "Invalid hostname")
 	}
-	isQuickTunnel := hostname == ""
+	isFreeTunnel := hostname == ""
 	clientID := c.String("id")
 	if !c.IsSet("id") {
 		clientID, err = generateRandomClientID(log)
@@ -179,7 +179,7 @@ func prepareTunnelConfig(
 	tags = append(tags, tunnelpogs.Tag{Name: "ID", Value: clientID})

 	var originCert []byte
-	if !isQuickTunnel {
+	if !isFreeTunnel {
 		originCertPath := c.String("origincert")
 		originCertLog := log.With().
 			Str(LogFieldOriginCertPath, originCertPath).
@@ -278,6 +278,7 @@ func prepareTunnelConfig(
 		HAConnections:    c.Int("ha-connections"),
 		IncidentLookup:   origin.NewIncidentLookup(),
 		IsAutoupdated:    c.Bool("is-autoupdated"),
+		IsFreeTunnel:     isFreeTunnel,
 		LBPool:           c.String("lb-pool"),
 		Tags:             tags,
 		Log:              log,
@@ -20,7 +20,7 @@ import (

 const (
 	baseLoginURL     = "https://dash.cloudflare.com/argotunnel"
-	callbackStoreURL = "https://login.cloudflareaccess.org/"
+	callbackStoreURL = "https://login.argotunnel.com/"
 )

 func buildLoginSubcommand(hidden bool) *cli.Command {
@@ -1,111 +0,0 @@
-package tunnel
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/pkg/errors"
-
-	"github.com/cloudflare/cloudflared/connection"
-)
-
-const httpTimeout = 15 * time.Second
-
-// RunQuickTunnel requests a tunnel from the specified service.
-// We use this to power quick tunnels on trycloudflare.com, but the
-// service is open-source and could be used by anyone.
-func RunQuickTunnel(sc *subcommandContext) error {
-	sc.log.Info().Msg("Requesting new Quick Tunnel...")
-
-	client := http.Client{
-		Transport: &http.Transport{
-			TLSHandshakeTimeout:   httpTimeout,
-			ResponseHeaderTimeout: httpTimeout,
-		},
-		Timeout: httpTimeout,
-	}
-
-	resp, err := client.Post(fmt.Sprintf("%s/tunnel", sc.c.String("quick-service")), "application/json", nil)
-	if err != nil {
-		return errors.Wrap(err, "failed to request quick tunnel")
-	}
-	defer resp.Body.Close()
-
-	var data QuickTunnelResponse
-	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
-		return errors.Wrap(err, "failed to unmarshal quick tunnel")
-	}
-
-	tunnelID, err := uuid.Parse(data.Result.ID)
-	if err != nil {
-		return errors.Wrap(err, "failed to parse quick tunnel ID")
-	}
-
-	credentials := connection.Credentials{
-		AccountTag:   data.Result.AccountTag,
-		TunnelSecret: data.Result.Secret,
-		TunnelID:     tunnelID,
-		TunnelName:   data.Result.Name,
-	}
-
-	for _, line := range AsciiBox([]string{
-		"Your Quick Tunnel has been created! Visit it at:",
-		data.Result.Hostname,
-	}, 2) {
-		sc.log.Info().Msg(line)
-	}
-
-	return StartServer(
-		sc.c,
-		version,
-		&connection.NamedTunnelConfig{Credentials: credentials, QuickTunnelUrl: data.Result.Hostname},
-		sc.log,
-		sc.isUIEnabled,
-	)
-}
-
-type QuickTunnelResponse struct {
-	Success bool
-	Result  QuickTunnel
-	Errors  []QuickTunnelError
-}
-
-type QuickTunnelError struct {
-	Code    int
-	Message string
-}
-
-type QuickTunnel struct {
-	ID         string `json:"id"`
-	Name       string `json:"name"`
-	Hostname   string `json:"hostname"`
-	AccountTag string `json:"account_tag"`
-	Secret     []byte `json:"secret"`
-}
-
-// Print out the given lines in a nice ASCII box.
-func AsciiBox(lines []string, padding int) (box []string) {
-	maxLen := maxLen(lines)
-	spacer := strings.Repeat(" ", padding)
-	border := "+" + strings.Repeat("-", maxLen+(padding*2)) + "+"
-	box = append(box, border)
-	for _, line := range lines {
-		box = append(box, "|"+spacer+line+strings.Repeat(" ", maxLen-len(line))+spacer+"|")
-	}
-	box = append(box, border)
-	return
-}
-
-func maxLen(lines []string) int {
-	max := 0
-	for _, line := range lines {
-		if len(line) > max {
-			max = len(line)
-		}
-	}
-	return max
-}
@@ -29,11 +29,10 @@ import (
 )

 const (
-	allSortByOptions     = "name, id, createdAt, deletedAt, numConnections"
-	connsSortByOptions   = "id, startedAt, numConnections, version"
-	CredFileFlagAlias    = "cred-file"
-	CredFileFlag         = "credentials-file"
-	overwriteDNSFlagName = "overwrite-dns"
+	allSortByOptions   = "name, id, createdAt, deletedAt, numConnections"
+	connsSortByOptions = "id, startedAt, numConnections, version"
+	CredFileFlagAlias  = "cred-file"
+	CredFileFlag       = "credentials-file"

 	LogFieldTunnelID = "tunnelID"
 )
@@ -111,7 +110,7 @@ var (
 	}
 	selectProtocolFlag = altsrc.NewStringFlag(&cli.StringFlag{
 		Name:    "protocol",
-		Value:   "auto",
+		Value:   "h2mux",
 		Aliases: []string{"p"},
 		Usage:   fmt.Sprintf("Protocol implementation to connect with Cloudflare's edge network. %s", connection.AvailableProtocolFlagMessage),
 		EnvVars: []string{"TUNNEL_TRANSPORT_PROTOCOL"},
@@ -134,12 +133,6 @@ var (
 		Usage:   `Constraints the cleanup to stop the connections of a single Connector (by its ID). You can find the various Connectors (and their IDs) currently connected to your tunnel via 'cloudflared tunnel info <name>'.`,
 		EnvVars: []string{"TUNNEL_CLEANUP_CONNECTOR"},
 	}
-	overwriteDNSFlag = &cli.BoolFlag{
-		Name:    overwriteDNSFlagName,
-		Aliases: []string{"f"},
-		Usage:   `Overwrites existing DNS records with this hostname`,
-		EnvVars: []string{"TUNNEL_FORCE_PROVISIONING_DNS"},
-	}
 )

 func buildCreateCommand() *cli.Command {
@@ -655,6 +648,7 @@ func cleanupCommand(c *cli.Context) error {
 func buildRouteCommand() *cli.Command {
 	return &cli.Command{
 		Name:      "route",
+		Action:    cliutil.ConfiguredAction(routeCommand),
 		Usage:     "Define which traffic routed from Cloudflare edge to this tunnel: requests to a DNS hostname, to a Cloudflare Load Balancer, or traffic originating from Cloudflare WARP clients",
 		UsageText: "cloudflared tunnel [tunnel command options] route [subcommand options] [dns TUNNEL HOSTNAME]|[lb TUNNEL HOSTNAME LB-POOL]|[ip NETWORK TUNNEL]",
 		Description: `The route command defines how Cloudflare will proxy requests to this tunnel.
@@ -674,30 +668,15 @@ Further information about managing Cloudflare WARP traffic to your tunnel is ava
 `,
 		CustomHelpTemplate: commandHelpTemplate(),
 		Subcommands: []*cli.Command{
-			{
-				Name:        "dns",
-				Action:      cliutil.ConfiguredAction(routeDnsCommand),
-				Usage:       "Route a hostname by creating a DNS CNAME record to a tunnel",
-				UsageText:   "cloudflared tunnel route dns [TUNNEL] [HOSTNAME]",
-				Description: `Creates a DNS CNAME record hostname that points to the tunnel.`,
-				Flags:       []cli.Flag{overwriteDNSFlag},
-			},
-			{
-				Name:        "lb",
-				Action:      cliutil.ConfiguredAction(routeLbCommand),
-				Usage:       "Use this tunnel as a load balancer origin, creating pool and load balancer if necessary",
-				UsageText:   "cloudflared tunnel route dns [TUNNEL] [HOSTNAME] [LB-POOL]",
-				Description: `Creates Load Balancer with an origin pool that points to the tunnel.`,
-			},
 			buildRouteIPSubcommand(),
 		},
 	}
 }

-func dnsRouteFromArg(c *cli.Context, overwriteExisting bool) (tunnelstore.Route, error) {
+func dnsRouteFromArg(c *cli.Context) (tunnelstore.Route, error) {
 	const (
-		userHostnameIndex = 1
-		expectedNArgs     = 2
+		userHostnameIndex = 2
+		expectedNArgs     = 3
 	)
 	if c.NArg() != expectedNArgs {
 		return nil, cliutil.UsageError("Expected %d arguments, got %d", expectedNArgs, c.NArg())
@@ -708,14 +687,14 @@ func dnsRouteFromArg(c *cli.Context, overwriteExisting bool) (tunnelstore.Route,
 	} else if !validateHostname(userHostname, true) {
 		return nil, errors.Errorf("%s is not a valid hostname", userHostname)
 	}
-	return tunnelstore.NewDNSRoute(userHostname, overwriteExisting), nil
+	return tunnelstore.NewDNSRoute(userHostname), nil
 }

 func lbRouteFromArg(c *cli.Context) (tunnelstore.Route, error) {
 	const (
-		lbNameIndex   = 1
-		lbPoolIndex   = 2
-		expectedNArgs = 3
+		lbNameIndex   = 2
+		lbPoolIndex   = 3
+		expectedNArgs = 4
 	)
 	if c.NArg() != expectedNArgs {
 		return nil, cliutil.UsageError("Expected %d arguments, got %d", expectedNArgs, c.NArg())
@@ -757,39 +736,41 @@ func validateHostname(s string, allowWildcardSubdomain bool) bool {
 	return err == nil && validateName(puny, allowWildcardSubdomain)
 }

-func routeDnsCommand(c *cli.Context) error {
-	if c.NArg() != 2 {
-		return cliutil.UsageError(`This command expects the format "cloudflared tunnel route dns <tunnel name/id> <hostname>"`)
+func routeCommand(c *cli.Context) error {
+	if c.NArg() < 2 {
+		return cliutil.UsageError(`"cloudflared tunnel route" requires the first argument to be the route type(dns or lb), followed by the ID or name of the tunnel`)
 	}
-	return routeCommand(c, "dns")
-}
-
-func routeLbCommand(c *cli.Context) error {
-	if c.NArg() != 3 {
-		return cliutil.UsageError(`This command expects the format "cloudflared tunnel route lb <tunnel name/id> <hostname> <load balancer pool>"`)
-	}
-	return routeCommand(c, "lb")
-}
-
-func routeCommand(c *cli.Context, routeType string) error {
 	sc, err := newSubcommandContext(c)
 	if err != nil {
 		return err
 	}

-	tunnelID, err := sc.findID(c.Args().Get(0))
-	if err != nil {
-		return err
-	}
+	const tunnelIDIndex = 1
+
+	routeType := c.Args().First()
 	var route tunnelstore.Route
+	var tunnelID uuid.UUID
 	switch routeType {
 	case "dns":
-		route, err = dnsRouteFromArg(c, c.Bool(overwriteDNSFlagName))
+		tunnelID, err = sc.findID(c.Args().Get(tunnelIDIndex))
+		if err != nil {
+			return err
+		}
+		route, err = dnsRouteFromArg(c)
+		if err != nil {
+			return err
+		}
 	case "lb":
+		tunnelID, err = sc.findID(c.Args().Get(tunnelIDIndex))
+		if err != nil {
+			return err
+		}
 		route, err = lbRouteFromArg(c)
-	}
-	if err != nil {
-		return err
+		if err != nil {
+			return err
+		}
+	default:
+		return cliutil.UsageError("%s is not a recognized route type. Supported route types are dns and lb", routeType)
 	}

 	res, err := sc.route(tunnelID, route)
@@ -7,7 +7,7 @@ from util import start_cloudflared, wait_tunnel_ready, send_requests
 # Rolling logger rotate log files after 1 MB
 rotate_after_size = 1000 * 1000
 default_log_file = "cloudflared.log"
-expect_message = "Starting Hello"
+expect_message = "Starting Hello World server"


 def assert_log_to_terminal(cloudflared):
@@ -1,36 +1,32 @@
 #!/usr/bin/env python
 import copy
-import platform
 from time import sleep

-import pytest
 from flaky import flaky

 from util import start_cloudflared, wait_tunnel_ready, check_tunnel_not_connected


@flaky(max_runs=3, min_passes=1)
-class TestReconnect:
+class TestReconnect():
    default_ha_conns = 4
-    default_reconnect_secs = 15
+    default_reconnect_secs = 5
    extra_config = {
        "stdin-control": True,
    }

-    @pytest.mark.skipif(platform.system() == "Windows", reason=f"Currently buggy on Windows TUN-4584")
    def test_named_reconnect(self, tmp_path, component_tests_config):
        config = component_tests_config(self.extra_config)
        with start_cloudflared(tmp_path, config, new_process=True, allow_input=True, capture_output=False) as cloudflared:
            # Repeat the test multiple times because some issues only occur after multiple reconnects
            self.assert_reconnect(config, cloudflared, 5)

-    @pytest.mark.skipif(platform.system() == "Windows", reason=f"Currently buggy on Windows TUN-4699")
    def test_classic_reconnect(self, tmp_path, component_tests_config):
        extra_config = copy.copy(self.extra_config)
        extra_config["hello-world"] = True
        config = component_tests_config(
            additional_config=extra_config, named_tunnel=False)
-        with start_cloudflared(tmp_path, config, cfd_args=[], new_process=True, allow_input=True, capture_output=True) as cloudflared:
+        with start_cloudflared(tmp_path, config, cfd_args=[], new_process=True, allow_input=True, capture_output=False) as cloudflared:
            self.assert_reconnect(config, cloudflared, 1)

    def send_reconnect(self, cloudflared, secs):
@@ -40,7 +36,7 @@ class TestReconnect:
        cloudflared.stdin.flush()

    def assert_reconnect(self, config, cloudflared, repeat):
-        wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=self.default_ha_conns)
+        wait_tunnel_ready(tunnel_url=config.get_url())
        for _ in range(repeat):
            for i in range(self.default_ha_conns):
                self.send_reconnect(cloudflared, self.default_reconnect_secs)
@@ -48,9 +44,11 @@ class TestReconnect:
                if expect_connections > 0:
                    # Don't check if tunnel returns 200 here because there is a race condition between wait_tunnel_ready
                    # retrying to get 200 response and reconnecting
-                    wait_tunnel_ready(require_min_connections=expect_connections)
+                    wait_tunnel_ready(
+                        require_min_connections=expect_connections)
                else:
                    check_tunnel_not_connected()

-            sleep(self.default_reconnect_secs * 2)
-            wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=self.default_ha_conns)
+            sleep(self.default_reconnect_secs + 10)
+            wait_tunnel_ready(tunnel_url=config.get_url(),
+                              require_min_connections=self.default_ha_conns)
@@ -34,7 +34,7 @@ def cloudflared_cmd(config, config_path, cfd_args, cfd_pre_args, root):
        cmd += ["sudo"]
    cmd += [config.cloudflared_binary]
    cmd += cfd_pre_args
-    cmd += ["--config", str(config_path)]
+    cmd += ["--config", config_path]
    cmd += cfd_args
    LOGGER.info(f"Run cmd {cmd} with config {config}")
    return cmd
@@ -50,7 +50,8 @@ def run_cloudflared_background(cmd, allow_input, capture_output):
    finally:
        cfd.terminate()
        if capture_output:
-            LOGGER.info(f"cloudflared log: {cfd.stderr.read()}")
+            LOGGER.info(
+                f"cloudflared log: {cfd.stderr.read()}")


@retry(stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
@@ -1,7 +1,6 @@
 package connection

 import (
-	"context"
 	"fmt"
 	"io"
 	"net/http"
@@ -12,15 +11,9 @@ import (
 	"github.com/google/uuid"

 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
-	"github.com/cloudflare/cloudflared/websocket"
 )

-const (
-	lbProbeUserAgentPrefix = "Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/;"
-	LogFieldConnIndex      = "connIndex"
-)
-
-var switchingProtocolText = fmt.Sprintf("%d %s", http.StatusSwitchingProtocols, http.StatusText(http.StatusSwitchingProtocols))
+const LogFieldConnIndex = "connIndex"

 type Config struct {
 	OriginProxy     OriginProxy
@@ -29,9 +22,8 @@ type Config struct {
 }

 type NamedTunnelConfig struct {
-	Credentials    Credentials
-	Client         pogs.ClientInfo
-	QuickTunnelUrl string
+	Credentials Credentials
+	Client      pogs.ClientInfo
 }

 // Credentials are stored in the credentials file and contain all info needed to run a tunnel.
@@ -56,6 +48,10 @@ type ClassicTunnelConfig struct {
 	UseReconnectToken bool
 }

+func (c *ClassicTunnelConfig) IsTrialZone() bool {
+	return c.Hostname == ""
+}
+
 // Type indicates the connection type of the  connection.
 type Type int

@@ -91,64 +87,9 @@ func (t Type) String() string {
 	}
 }

-// OriginProxy is how data flows from cloudflared to the origin services running behind it.
 type OriginProxy interface {
-	ProxyHTTP(w ResponseWriter, req *http.Request, isWebsocket bool) error
-	ProxyTCP(ctx context.Context, rwa ReadWriteAcker, req *TCPRequest) error
-}
-
-// TCPRequest defines the input format needed to perform a TCP proxy.
-type TCPRequest struct {
-	Dest    string
-	CFRay   string
-	LBProbe bool
-}
-
-// ReadWriteAcker is a readwriter with the ability to Acknowledge to the downstream (edge) that the origin has
-// accepted the connection.
-type ReadWriteAcker interface {
-	io.ReadWriter
-	AckConnection() error
-}
-
-// HTTPResponseReadWriteAcker is an HTTP implementation of ReadWriteAcker.
-type HTTPResponseReadWriteAcker struct {
-	r   io.Reader
-	w   ResponseWriter
-	req *http.Request
-}
-
-// NewHTTPResponseReadWriterAcker returns a new instance of HTTPResponseReadWriteAcker.
-func NewHTTPResponseReadWriterAcker(w ResponseWriter, req *http.Request) *HTTPResponseReadWriteAcker {
-	return &HTTPResponseReadWriteAcker{
-		r:   req.Body,
-		w:   w,
-		req: req,
-	}
-}
-
-func (h *HTTPResponseReadWriteAcker) Read(p []byte) (int, error) {
-	return h.r.Read(p)
-}
-
-func (h *HTTPResponseReadWriteAcker) Write(p []byte) (int, error) {
-	return h.w.Write(p)
-}
-
-// AckConnection acks an HTTP connection by sending a switch protocols status code that enables the caller to
-// upgrade to streams.
-func (h *HTTPResponseReadWriteAcker) AckConnection() error {
-	resp := &http.Response{
-		Status:        switchingProtocolText,
-		StatusCode:    http.StatusSwitchingProtocols,
-		ContentLength: -1,
-	}
-
-	if secWebsocketKey := h.req.Header.Get("Sec-WebSocket-Key"); secWebsocketKey != "" {
-		resp.Header = websocket.NewResponseHeader(h.req)
-	}
-
-	return h.w.WriteRespHeaders(resp.StatusCode, resp.Header)
+	// If Proxy returns an error, the caller is responsible for writing the error status to ResponseWriter
+	Proxy(w ResponseWriter, req *http.Request, sourceConnectionType Type) error
 }

 type ResponseWriter interface {
@@ -171,11 +112,3 @@ func IsServerSentEvent(headers http.Header) bool {
 func uint8ToString(input uint8) string {
 	return strconv.FormatUint(uint64(input), 10)
 }
-
-func FindCfRayHeader(req *http.Request) string {
-	return req.Header.Get("Cf-Ray")
-}
-
-func IsLBProbeRequest(req *http.Request) bool {
-	return strings.HasPrefix(req.UserAgent(), lbProbeUserAgentPrefix)
-}
@@ -1,7 +1,6 @@
 package connection

 import (
-	"context"
 	"fmt"
 	"io"
 	"net/http"
@@ -12,8 +11,6 @@ import (
 	"github.com/gobwas/ws/wsutil"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
-
-	"github.com/cloudflare/cloudflared/ingress"
 )

 const (
@@ -21,8 +18,7 @@ const (
 )

 var (
-	unusedWarpRoutingService = (*ingress.WarpRoutingService)(nil)
-	testConfig               = &Config{
+	testConfig = &Config{
 		OriginProxy: &mockOriginProxy{},
 		GracePeriod: time.Millisecond * 100,
 	}
@@ -42,17 +38,14 @@ type testRequest struct {
 	isProxyError   bool
 }

-type mockOriginProxy struct{}
+type mockOriginProxy struct {
+}

-func (moc *mockOriginProxy) ProxyHTTP(
-	w ResponseWriter,
-	req *http.Request,
-	isWebsocket bool,
-) error {
-	if isWebsocket {
-		return wsEndpoint(w, req)
+func (moc *mockOriginProxy) Proxy(w ResponseWriter, r *http.Request, sourceConnectionType Type) error {
+	if sourceConnectionType == TypeWebsocket {
+		return wsEndpoint(w, r)
 	}
-	switch req.URL.Path {
+	switch r.URL.Path {
 	case "/ok":
 		originRespEndpoint(w, http.StatusOK, []byte(http.StatusText(http.StatusOK)))
 	case "/large_file":
@@ -67,15 +60,6 @@ func (moc *mockOriginProxy) ProxyHTTP(
 		originRespEndpoint(w, http.StatusNotFound, []byte("page not found"))
 	}
 	return nil
-
-}
-
-func (moc *mockOriginProxy) ProxyTCP(
-	ctx context.Context,
-	rwa ReadWriteAcker,
-	r *TCPRequest,
-) error {
-	return nil
 }

 type nowriter struct {
@@ -18,7 +18,7 @@ const (
 	Connected
 	// Reconnecting means the connection to the edge is being re-established.
 	Reconnecting
-	// SetURL means this connection's tunnel was given a URL by the edge. Used for quick tunnels.
+	// SetURL means this connection's tunnel was given a URL by the edge. Used for free tunnels.
 	SetURL
 	// RegisteringTunnel means the non-named tunnel is registering its connection.
 	RegisteringTunnel
@@ -33,8 +33,6 @@ type h2muxConnection struct {
 	gracefulShutdownC <-chan struct{}
 	stoppedGracefully bool

-	log *zerolog.Logger
-
 	// newRPCClientFunc allows us to mock RPCs during testing
 	newRPCClientFunc func(context.Context, io.ReadWriteCloser, *zerolog.Logger) NamedTunnelRPCClient
 }
@@ -169,8 +167,7 @@ func (h *h2muxConnection) serveMuxer(ctx context.Context) error {
 }

 func (h *h2muxConnection) controlLoop(ctx context.Context, connectedFuse ConnectedFuse, isNamedTunnel bool) {
-	updateMetricsTicker := time.NewTicker(h.muxerConfig.MetricsUpdateFreq)
-	defer updateMetricsTicker.Stop()
+	updateMetricsTickC := time.Tick(h.muxerConfig.MetricsUpdateFreq)
 	var shutdownCompleted <-chan struct{}
 	for {
 		select {
@@ -194,7 +191,7 @@ func (h *h2muxConnection) controlLoop(ctx context.Context, connectedFuse Connect
 			// don't wait for shutdown to finish when context is closed, this is the hard termination path
 			return

-		case <-updateMetricsTicker.C:
+		case <-updateMetricsTickC:
 			h.observer.metrics.updateMuxerMetrics(h.connIndexStr, h.muxer.Metrics())
 		}
 	}
@@ -224,11 +221,12 @@ func (h *h2muxConnection) ServeStream(stream *h2mux.MuxedStream) error {
 		sourceConnectionType = TypeWebsocket
 	}

-	err := h.config.OriginProxy.ProxyHTTP(respWriter, req, sourceConnectionType == TypeWebsocket)
+	err := h.config.OriginProxy.Proxy(respWriter, req, sourceConnectionType)
 	if err != nil {
 		respWriter.WriteErrorResponse()
+		return err
 	}
-	return err
+	return nil
 }

 func (h *h2muxConnection) newRequest(stream *h2mux.MuxedStream) (*http.Request, error) {
@@ -10,7 +10,6 @@ import (
 	"strings"
 	"sync"

-	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
 	"golang.org/x/net/http2"

@@ -27,9 +26,7 @@ const (

 var errEdgeConnectionClosed = fmt.Errorf("connection with edge closed")

-// HTTP2Connection represents a net.Conn that uses HTTP2 frames to proxy traffic from the edge to cloudflared on the
-// origin.
-type HTTP2Connection struct {
+type http2Connection struct {
 	conn         net.Conn
 	server       *http2.Server
 	config       *Config
@@ -41,7 +38,6 @@ type HTTP2Connection struct {
 	// newRPCClientFunc allows us to mock RPCs during testing
 	newRPCClientFunc func(context.Context, io.ReadWriteCloser, *zerolog.Logger) NamedTunnelRPCClient

-	log               *zerolog.Logger
 	activeRequestsWG  sync.WaitGroup
 	connectedFuse     ConnectedFuse
 	gracefulShutdownC <-chan struct{}
@@ -49,7 +45,6 @@ type HTTP2Connection struct {
 	controlStreamErr  error // result of running control stream handler
 }

-// NewHTTP2Connection returns a new instance of HTTP2Connection.
 func NewHTTP2Connection(
 	conn net.Conn,
 	config *Config,
@@ -58,10 +53,9 @@ func NewHTTP2Connection(
 	observer *Observer,
 	connIndex uint8,
 	connectedFuse ConnectedFuse,
-	log *zerolog.Logger,
 	gracefulShutdownC <-chan struct{},
-) *HTTP2Connection {
-	return &HTTP2Connection{
+) *http2Connection {
+	return &http2Connection{
 		conn: conn,
 		server: &http2.Server{
 			MaxConcurrentStreams: math.MaxUint32,
@@ -74,13 +68,11 @@ func NewHTTP2Connection(
 		connIndex:         connIndex,
 		newRPCClientFunc:  newRegistrationRPCClient,
 		connectedFuse:     connectedFuse,
-		log:               log,
 		gracefulShutdownC: gracefulShutdownC,
 	}
 }

-// Serve serves an HTTP2 server that the edge can talk to.
-func (c *HTTP2Connection) Serve(ctx context.Context) error {
+func (c *http2Connection) Serve(ctx context.Context) error {
 	go func() {
 		<-ctx.Done()
 		c.close()
@@ -101,60 +93,34 @@ func (c *HTTP2Connection) Serve(ctx context.Context) error {
 	}
 }

-func (c *HTTP2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+func (c *http2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	c.activeRequestsWG.Add(1)
 	defer c.activeRequestsWG.Done()

 	connType := determineHTTP2Type(r)
-	handleMissingRequestParts(connType, r)
-
 	respWriter, err := newHTTP2RespWriter(r, w, connType)
 	if err != nil {
 		c.observer.log.Error().Msg(err.Error())
 		return
 	}

+	var proxyErr error
 	switch connType {
 	case TypeControlStream:
-		if err := c.serveControlStream(r.Context(), respWriter); err != nil {
-			c.controlStreamErr = err
-			c.log.Error().Err(err)
-			respWriter.WriteErrorResponse()
-		}
-
-	case TypeWebsocket, TypeHTTP:
+		proxyErr = c.serveControlStream(r.Context(), respWriter)
+		c.controlStreamErr = proxyErr
+	case TypeWebsocket:
 		stripWebsocketUpgradeHeader(r)
-		if err := c.config.OriginProxy.ProxyHTTP(respWriter, r, connType == TypeWebsocket); err != nil {
-			err := fmt.Errorf("Failed to proxy HTTP: %w", err)
-			c.log.Error().Err(err)
-			respWriter.WriteErrorResponse()
-		}
-
-	case TypeTCP:
-		host, err := getRequestHost(r)
-		if err != nil {
-			err := fmt.Errorf(`cloudflared recieved a warp-routing request with an empty host value: %w`, err)
-			c.log.Error().Err(err)
-			respWriter.WriteErrorResponse()
-		}
-
-		rws := NewHTTPResponseReadWriterAcker(respWriter, r)
-		if err := c.config.OriginProxy.ProxyTCP(r.Context(), rws, &TCPRequest{
-			Dest:    host,
-			CFRay:   FindCfRayHeader(r),
-			LBProbe: IsLBProbeRequest(r),
-		}); err != nil {
-			respWriter.WriteErrorResponse()
-		}
-
+		proxyErr = c.config.OriginProxy.Proxy(respWriter, r, TypeWebsocket)
 	default:
-		err := fmt.Errorf("Received unknown connection type: %s", connType)
-		c.log.Error().Err(err)
+		proxyErr = c.config.OriginProxy.Proxy(respWriter, r, connType)
+	}
+	if proxyErr != nil {
 		respWriter.WriteErrorResponse()
 	}
 }

-func (c *HTTP2Connection) serveControlStream(ctx context.Context, respWriter *http2RespWriter) error {
+func (c *http2Connection) serveControlStream(ctx context.Context, respWriter *http2RespWriter) error {
 	rpcClient := c.newRPCClientFunc(ctx, respWriter, c.observer.log)
 	defer rpcClient.Close()

@@ -177,7 +143,7 @@ func (c *HTTP2Connection) serveControlStream(ctx context.Context, respWriter *ht
 	return nil
 }

-func (c *HTTP2Connection) close() {
+func (c *http2Connection) close() {
 	// Wait for all serve HTTP handlers to return
 	c.activeRequestsWG.Wait()
 	c.conn.Close()
@@ -289,20 +255,6 @@ func determineHTTP2Type(r *http.Request) Type {
 	}
 }

-func handleMissingRequestParts(connType Type, r *http.Request) {
-	if connType == TypeHTTP {
-		// http library has no guarantees that we receive a filled URL. If not, then we fill it, as we reuse the request
-		// for proxying. We use the same values as we used to in h2mux. For proxying they should not matter since we
-		// control the dialer on every egress proxied.
-		if len(r.URL.Scheme) == 0 {
-			r.URL.Scheme = "http"
-		}
-		if len(r.URL.Host) == 0 {
-			r.URL.Host = "localhost:8080"
-		}
-	}
-}
-
 func isControlStreamUpgrade(r *http.Request) bool {
 	return r.Header.Get(InternalUpgradeHeader) == ControlStreamUpgrade
 }
@@ -319,14 +271,3 @@ func IsTCPStream(r *http.Request) bool {
 func stripWebsocketUpgradeHeader(r *http.Request) {
 	r.Header.Del(InternalUpgradeHeader)
 }
-
-// getRequestHost returns the host of the http.Request.
-func getRequestHost(r *http.Request) (string, error) {
-	if r.Host != "" {
-		return r.Host, nil
-	}
-	if r.URL != nil {
-		return r.URL.Host, nil
-	}
-	return "", errors.New("host not set in incoming request")
-}
@@ -26,10 +26,9 @@ var (
 	testTransport = http2.Transport{}
 )

-func newTestHTTP2Connection() (*HTTP2Connection, net.Conn) {
+func newTestHTTP2Connection() (*http2Connection, net.Conn) {
 	edgeConn, originConn := net.Pipe()
 	var connIndex = uint8(0)
-	log := zerolog.Nop()
 	return NewHTTP2Connection(
 		originConn,
 		testConfig,
@@ -38,7 +37,6 @@ func newTestHTTP2Connection() (*HTTP2Connection, net.Conn) {
 		NewObserver(&log, &log, false),
 		connIndex,
 		mockConnectedFuse{},
-		&log,
 		nil,
 	), edgeConn
 }
@@ -1,7 +1,13 @@
 package connection

 import (
+	"fmt"
+	"net/url"
+	"strings"
+
 	"github.com/rs/zerolog"
+
+	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )

 const (
@@ -48,6 +54,53 @@ func (o *Observer) logServerInfo(connIndex uint8, location, msg string) {
 	o.metrics.registerServerLocation(uint8ToString(connIndex), location)
 }

+func (o *Observer) logTrialHostname(registration *tunnelpogs.TunnelRegistration) error {
+	// Print out the user's trial zone URL in a nice box (if they requested and got one and UI flag is not set)
+	if !o.uiEnabled {
+		if registrationURL, err := url.Parse(registration.Url); err == nil {
+			for _, line := range asciiBox(trialZoneMsg(registrationURL.String()), 2) {
+				o.log.Info().Msg(line)
+			}
+		} else {
+			o.log.Error().Msg("Failed to connect tunnel, please try again.")
+			return fmt.Errorf("empty URL in response from Cloudflare edge")
+		}
+	}
+	return nil
+}
+
+// Print out the given lines in a nice ASCII box.
+func asciiBox(lines []string, padding int) (box []string) {
+	maxLen := maxLen(lines)
+	spacer := strings.Repeat(" ", padding)
+
+	border := "+" + strings.Repeat("-", maxLen+(padding*2)) + "+"
+
+	box = append(box, border)
+	for _, line := range lines {
+		box = append(box, "|"+spacer+line+strings.Repeat(" ", maxLen-len(line))+spacer+"|")
+	}
+	box = append(box, border)
+	return
+}
+
+func maxLen(lines []string) int {
+	max := 0
+	for _, line := range lines {
+		if len(line) > max {
+			max = len(line)
+		}
+	}
+	return max
+}
+
+func trialZoneMsg(url string) []string {
+	return []string{
+		"Your free tunnel has started! Visit it:",
+		"  " + url,
+	}
+}
+
 func (o *Observer) sendRegisteringEvent(connIndex uint8) {
 	o.sendEvent(Event{Index: connIndex, EventType: RegisteringTunnel})
 }
@@ -56,7 +109,7 @@ func (o *Observer) sendConnectedEvent(connIndex uint8, location string) {
 	o.sendEvent(Event{Index: connIndex, EventType: Connected, Location: location})
 }

-func (o *Observer) SendURL(url string) {
+func (o *Observer) sendURL(url string) {
 	o.sendEvent(Event{EventType: SetURL, URL: url})
 }

@@ -159,6 +159,8 @@ func (h *h2muxConnection) registerTunnel(ctx context.Context, credentialSetter C
 		return h.processRegisterTunnelError(registrationErr, register)
 	}

+	// Send free tunnel URL to UI
+	h.observer.sendURL(registration.Url)
 	credentialSetter.SetEventDigest(h.connIndex, registration.EventDigest)
 	return h.processRegistrationSuccess(registration, register, credentialSetter, classicTunnel)
 }
@@ -185,6 +187,14 @@ func (h *h2muxConnection) processRegistrationSuccess(
 		h.observer.log.Info().Msgf("Each HA connection's tunnel IDs: %v", h.observer.metrics.tunnelsHA.String())
 	}

+	// Print out the user's trial zone URL in a nice box (if they requested and got one and UI flag is not set)
+	if classicTunnel.IsTrialZone() {
+		err := h.observer.logTrialHostname(registration)
+		if err != nil {
+			return err
+		}
+	}
+
 	credentialManager.SetConnDigest(h.connIndex, registration.ConnDigest)
 	h.observer.metrics.userHostnamesCounts.WithLabelValues(registration.Url).Inc()

@@ -10,9 +10,6 @@ import shutil
 import hashlib
 import requests
 import tarfile
-from os import listdir
-from os.path import isfile, join
-import re

 from github import Github, GithubException, UnknownObjectException

@@ -138,7 +135,7 @@ def parse_args():
        logging.error("Missing asset path")
        is_valid = False

-    if not args.name and not os.path.isdir(args.path):
+    if not args.name:
        logging.error("Missing asset name")
        is_valid = False

@@ -164,57 +161,6 @@ def parse_args():
    parser.print_usage()
    exit(1)

-def upload_asset(release, filepath, filename, release_version, kv_account_id, namespace_id, kv_api_token):
-    logging.info("Uploading asset: %s", filename)
-    release.upload_asset(filepath, name=filename)
-
-    # check and extract if the file is a tar and gzipped file (as is the case with the macos builds)
-    binary_path = filepath
-    if binary_path.endswith("tgz"):
-        try:
-            shutil.rmtree('cfd')
-        except OSError:
-            pass
-        zipfile = tarfile.open(binary_path, "r:gz")
-        zipfile.extractall('cfd') # specify which folder to extract to
-        zipfile.close()
-
-        binary_path = os.path.join(os.getcwd(), 'cfd', 'cloudflared')
-
-    # send the sha256 (the checksum) to workers kv
-    pkg_hash = get_sha256(binary_path)
-    send_hash(pkg_hash, filename, release_version, kv_account_id, namespace_id, kv_api_token)
-
-    # create the artifacts directory if it doesn't exist
-    artifact_path = os.path.join(os.getcwd(), 'artifacts')
-    if not os.path.isdir(artifact_path):
-        os.mkdir(artifact_path)
-
-    # copy the binary to the path
-    copy_path = os.path.join(artifact_path, filename)
-    try:
-        shutil.copy(filepath, copy_path)
-    except shutil.SameFileError:
-        pass # the macOS release copy fails with being the same file (already in the artifacts directory)
-
-def compile_regex() :
-    # The capture groups are:
-    # 1: the text cloudflared
-    # 2: compiled architecture
-    # 3: possible extensions
-    capture_string = r'(cloudflared).+(amd64|x86_64|386|arm)(\.msi|\.deb|\.rpm|\.exe)?'
-    return re.compile(capture_string)
-
-def extract_filename(regex, filename):
-    match_groups = regex.match(filename)
-    os = "linux"
-    name = match_groups.group(1)
-    arch = match_groups.group(2)
-    ext = match_groups.group(3)
-    if ext in ['.msi', '.exe']:
-        os = "windows"
-    return "{}-{}-{}{}".format(name, os, arch, ext if ext is not None else "")
-

 def main():
    """ Attempts to upload Asset to Github Release. Creates Release if it doesnt exist """
@@ -228,20 +174,40 @@ def main():
            logging.info("Skipping asset upload because of dry-run")
            return

-        if os.path.isdir(args.path):
-            regexp = compile_regex()
-            onlyfiles = [f for f in listdir(args.path) if isfile(join(args.path, f))]
-            for filename in onlyfiles:
-                binary_path = os.path.join(args.path, filename)
-                filename = extract_filename(regexp, filename)
-                upload_asset(release, binary_path, filename, args.release_version, args.kv_account_id, args.namespace_id,
-                args.kv_api_token)
-        else:
-            upload_asset(release, args.path, args.name, args.release_version, args.kv_account_id, args.namespace_id,
-                args.kv_api_token)
+        release.upload_asset(args.path, name=args.name)
+
+        # check and extract if the file is a tar and gzipped file (as is the case with the macos builds)
+        binary_path = args.path
+        if binary_path.endswith("tgz"):
+            try:
+                shutil.rmtree('cfd') 
+            except OSError as e:
+                pass
+            zipfile = tarfile.open(binary_path, "r:gz")
+            zipfile.extractall('cfd') # specify which folder to extract to
+            zipfile.close()
+
+            binary_path = os.path.join(os.getcwd(), 'cfd', 'cloudflared') 
+
+        # send the sha256 (the checksum) to workers kv
+        pkg_hash = get_sha256(binary_path)
+        send_hash(pkg_hash, args.name, args.release_version, args.kv_account_id, args.namespace_id, args.kv_api_token)
+
+        # create the artifacts directory if it doesn't exist 
+        artifact_path = os.path.join(os.getcwd(), 'artifacts') 
+        if not os.path.isdir(artifact_path):
+            os.mkdir(artifact_path)
+
+        # copy the binary to the path
+        copy_path = os.path.join(artifact_path, args.name)
+        try:
+            shutil.copy(args.path, copy_path)
+        except shutil.SameFileError:
+            pass # the macOS release copy fails with being the same file (already in the artifacts directory). Catching to ignore.

    except Exception as e:
        logging.exception(e)
        exit(1)

+
 main()
@@ -69,13 +69,12 @@ func (r *MuxReader) run(log *zerolog.Logger) error {

 	// routine to periodically update bytesRead
 	go func() {
-		ticker := time.NewTicker(updateFreq)
-		defer ticker.Stop()
+		tickC := time.Tick(updateFreq)
 		for {
 			select {
 			case <-r.abortChan:
 				return
-			case <-ticker.C:
+			case <-tickC:
 				r.metricsUpdater.updateInBoundBytes(r.bytesRead.Count())
 			}
 		}
@@ -78,13 +78,12 @@ func (w *MuxWriter) run(log *zerolog.Logger) error {

 	// routine to periodically communicate bytesWrote
 	go func() {
-		ticker := time.NewTicker(updateFreq)
-		defer ticker.Stop()
+		tickC := time.Tick(updateFreq)
 		for {
 			select {
 			case <-w.abortChan:
 				return
-			case <-ticker.C:
+			case <-tickC:
 				w.metricsUpdater.updateOutBoundBytes(w.bytesWrote.Count())
 			}
 		}
@@ -103,7 +103,7 @@ func NewWarpRoutingService() *WarpRoutingService {
 }

 // Get a single origin service from the CLI/config.
-func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (OriginService, error) {
+func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (originService, error) {
 	if c.IsSet("hello-world") {
 		return new(helloWorld), nil
 	}
@@ -167,7 +167,7 @@ func validate(ingress []config.UnvalidatedIngressRule, defaults OriginRequestCon
 	rules := make([]Rule, len(ingress))
 	for i, r := range ingress {
 		cfg := setConfig(defaults, r.OriginRequest)
-		var service OriginService
+		var service originService

 		if prefix := "unix:"; strings.HasPrefix(r.Service, prefix) {
 			// No validation necessary for unix socket filepath services
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"sync"
 	"testing"
 	"time"

@@ -189,6 +190,71 @@ func TestSocksStreamWSOverTCPConnection(t *testing.T) {
 	}
 }

+func TestStreamWSConnection(t *testing.T) {
+	eyeballConn, edgeConn := net.Pipe()
+
+	origin := echoWSOrigin(t, true)
+	defer origin.Close()
+
+	var svc httpService
+	err := svc.start(&sync.WaitGroup{}, testLogger, nil, nil, OriginRequestConfig{
+		NoTLSVerify: true,
+	})
+	require.NoError(t, err)
+
+	req, err := http.NewRequest(http.MethodGet, origin.URL, nil)
+	require.NoError(t, err)
+	req.Header.Set("Sec-Websocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+	req.Header.Set("Connection", "Upgrade")
+	req.Header.Set("Upgrade", "websocket")
+
+	conn, resp, err := svc.newWebsocketProxyConnection(req)
+
+	require.NoError(t, err)
+	defer conn.Close()
+
+	require.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
+	require.Equal(t, "Upgrade", resp.Header.Get("Connection"))
+	require.Equal(t, "s3pPLMBiTxaQ9kYGzzhZRbK+xOo=", resp.Header.Get("Sec-Websocket-Accept"))
+	require.Equal(t, "websocket", resp.Header.Get("Upgrade"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), testStreamTimeout)
+	defer cancel()
+
+	connClosed := make(chan struct{})
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		select {
+		case <-connClosed:
+		case <-ctx.Done():
+		}
+		if ctx.Err() == context.DeadlineExceeded {
+			eyeballConn.Close()
+			edgeConn.Close()
+			conn.Close()
+		}
+
+		return ctx.Err()
+	})
+
+	errGroup.Go(func() error {
+		echoWSEyeball(t, eyeballConn)
+		fmt.Println("closing pipe")
+		edgeConn.Close()
+		return eyeballConn.Close()
+	})
+
+	errGroup.Go(func() error {
+		defer conn.Close()
+		conn.Stream(ctx, edgeConn, testLogger)
+		close(connClosed)
+		return nil
+	})
+
+	require.NoError(t, errGroup.Wait())
+}
+
 type wsEyeball struct {
 	conn net.Conn
 }
@@ -1,13 +1,20 @@
 package ingress

 import (
+	"fmt"
+	"io"
 	"net"
 	"net/http"
+	"strings"

 	"github.com/pkg/errors"
+
+	"github.com/cloudflare/cloudflared/carrier"
+	"github.com/cloudflare/cloudflared/websocket"
 )

 var (
+	switchingProtocolText        = fmt.Sprintf("%d %s", http.StatusSwitchingProtocols, http.StatusText(http.StatusSwitchingProtocols))
 	errUnsupportedConnectionType = errors.New("internal error: unsupported connection type")
 )

@@ -19,7 +26,7 @@ type HTTPOriginProxy interface {

 // StreamBasedOriginProxy can be implemented by origin services that want to proxy ws/TCP.
 type StreamBasedOriginProxy interface {
-	EstablishConnection(dest string) (OriginConnection, error)
+	EstablishConnection(r *http.Request) (OriginConnection, *http.Response, error)
 }

 func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) {
@@ -29,15 +36,7 @@ func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) {
 func (o *httpService) RoundTrip(req *http.Request) (*http.Response, error) {
 	// Rewrite the request URL so that it goes to the origin service.
 	req.URL.Host = o.url.Host
-	switch o.url.Scheme {
-	case "ws":
-		req.URL.Scheme = "http"
-	case "wss":
-		req.URL.Scheme = "https"
-	default:
-		req.URL.Scheme = o.url.Scheme
-	}
-
+	req.URL.Scheme = o.url.Scheme
 	if o.hostHeader != "" {
 		// For incoming requests, the Host header is promoted to the Request.Host field and removed from the Header map.
 		req.Host = o.hostHeader
@@ -45,40 +44,138 @@ func (o *httpService) RoundTrip(req *http.Request) (*http.Response, error) {
 	return o.transport.RoundTrip(req)
 }

+func (o *httpService) EstablishConnection(req *http.Request) (OriginConnection, *http.Response, error) {
+	req = req.Clone(req.Context())
+
+	req.URL.Host = o.url.Host
+	req.URL.Scheme = o.url.Scheme
+	// allow ws(s) scheme for websocket-only origins, normal http(s) requests will fail
+	switch req.URL.Scheme {
+	case "ws":
+		req.URL.Scheme = "http"
+	case "wss":
+		req.URL.Scheme = "https"
+	}
+
+	if o.hostHeader != "" {
+		// For incoming requests, the Host header is promoted to the Request.Host field and removed from the Header map.
+		req.Host = o.hostHeader
+	}
+
+	return o.newWebsocketProxyConnection(req)
+}
+
+func (o *httpService) newWebsocketProxyConnection(req *http.Request) (OriginConnection, *http.Response, error) {
+	req.Header.Set("Connection", "Upgrade")
+	req.Header.Set("Upgrade", "websocket")
+	req.Header.Set("Sec-WebSocket-Version", "13")
+
+	req.ContentLength = 0
+	req.Body = nil
+
+	resp, err := o.transport.RoundTrip(req)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	toClose := resp.Body
+	defer func() {
+		if toClose != nil {
+			_ = toClose.Close()
+		}
+	}()
+
+	if resp.StatusCode != http.StatusSwitchingProtocols {
+		return nil, nil, fmt.Errorf("unexpected origin response: %s", resp.Status)
+	}
+	if strings.ToLower(resp.Header.Get("Upgrade")) != "websocket" {
+		return nil, nil, fmt.Errorf("unexpected upgrade: %q", resp.Header.Get("Upgrade"))
+	}
+
+	rwc, ok := resp.Body.(io.ReadWriteCloser)
+	if !ok {
+		return nil, nil, errUnsupportedConnectionType
+	}
+	conn := wsProxyConnection{
+		rwc: rwc,
+	}
+	// clear to prevent defer from closing
+	toClose = nil
+
+	return &conn, resp, nil
+}
+
 func (o *statusCode) RoundTrip(_ *http.Request) (*http.Response, error) {
 	return o.resp, nil
 }

-func (o *rawTCPService) EstablishConnection(dest string) (OriginConnection, error) {
+func (o *rawTCPService) EstablishConnection(r *http.Request) (OriginConnection, *http.Response, error) {
+	dest, err := getRequestHost(r)
+	if err != nil {
+		return nil, nil, err
+	}
 	conn, err := net.Dial("tcp", dest)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}

 	originConn := &tcpConnection{
 		conn: conn,
 	}
-	return originConn, nil
+	resp := &http.Response{
+		Status:        switchingProtocolText,
+		StatusCode:    http.StatusSwitchingProtocols,
+		ContentLength: -1,
+	}
+	return originConn, resp, nil
 }

-func (o *tcpOverWSService) EstablishConnection(dest string) (OriginConnection, error) {
+// getRequestHost returns the host of the http.Request.
+func getRequestHost(r *http.Request) (string, error) {
+	if r.Host != "" {
+		return r.Host, nil
+	}
+	if r.URL != nil {
+		return r.URL.Host, nil
+	}
+	return "", errors.New("host not found")
+}
+
+func (o *tcpOverWSService) EstablishConnection(r *http.Request) (OriginConnection, *http.Response, error) {
 	var err error
-	if !o.isBastion {
-		dest = o.dest
+	dest := o.dest
+	if o.isBastion {
+		dest, err = carrier.ResolveBastionDest(r)
+		if err != nil {
+			return nil, nil, err
+		}
 	}

 	conn, err := net.Dial("tcp", dest)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	originConn := &tcpOverWSConnection{
 		conn:          conn,
 		streamHandler: o.streamHandler,
 	}
-	return originConn, nil
+	resp := &http.Response{
+		Status:        switchingProtocolText,
+		StatusCode:    http.StatusSwitchingProtocols,
+		Header:        websocket.NewResponseHeader(r),
+		ContentLength: -1,
+	}
+	return originConn, resp, nil

 }

-func (o *socksProxyOverWSService) EstablishConnection(dest string) (OriginConnection, error) {
-	return o.conn, nil
+func (o *socksProxyOverWSService) EstablishConnection(r *http.Request) (OriginConnection, *http.Response, error) {
+	originConn := o.conn
+	resp := &http.Response{
+		Status:        switchingProtocolText,
+		StatusCode:    http.StatusSwitchingProtocols,
+		Header:        websocket.NewResponseHeader(r),
+		ContentLength: -1,
+	}
+	return originConn, resp, nil
 }
@@ -2,6 +2,7 @@ package ingress

 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
 	"net/http"
@@ -17,6 +18,71 @@ import (
 	"github.com/cloudflare/cloudflared/websocket"
 )

+// TestEstablishConnectionResponse ensures each implementation of StreamBasedOriginProxy returns
+// the expected response
+func assertEstablishConnectionResponse(t *testing.T,
+	originProxy StreamBasedOriginProxy,
+	req *http.Request,
+	expectHeader http.Header,
+) {
+	_, resp, err := originProxy.EstablishConnection(req)
+	assert.NoError(t, err)
+	assert.Equal(t, switchingProtocolText, resp.Status)
+	assert.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
+	assert.Equal(t, expectHeader, resp.Header)
+}
+
+func TestHTTPServiceEstablishConnection(t *testing.T) {
+	origin := echoWSOrigin(t, false)
+	defer origin.Close()
+	originURL, err := url.Parse(origin.URL)
+	require.NoError(t, err)
+
+	httpService := &httpService{
+		url:        originURL,
+		hostHeader: origin.URL,
+		transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+		},
+	}
+	req, err := http.NewRequest(http.MethodGet, origin.URL, nil)
+	require.NoError(t, err)
+	req.Header.Set("Sec-Websocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+	req.Header.Set("Test-Cloudflared-Echo", t.Name())
+
+	expectHeader := http.Header{
+		"Connection":            {"Upgrade"},
+		"Sec-Websocket-Accept":  {"s3pPLMBiTxaQ9kYGzzhZRbK+xOo="},
+		"Upgrade":               {"websocket"},
+		"Test-Cloudflared-Echo": {t.Name()},
+	}
+	assertEstablishConnectionResponse(t, httpService, req, expectHeader)
+}
+
+func TestHelloWorldEstablishConnection(t *testing.T) {
+	var wg sync.WaitGroup
+	shutdownC := make(chan struct{})
+	errC := make(chan error)
+	helloWorldSerivce := &helloWorld{}
+	helloWorldSerivce.start(&wg, testLogger, shutdownC, errC, OriginRequestConfig{})
+
+	// Scheme and Host of URL will be override by the Scheme and Host of the helloWorld service
+	req, err := http.NewRequest(http.MethodGet, "https://place-holder/ws", nil)
+	require.NoError(t, err)
+	req.Header.Set("Sec-Websocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+
+	expectHeader := http.Header{
+		"Connection":           {"Upgrade"},
+		"Sec-Websocket-Accept": {"s3pPLMBiTxaQ9kYGzzhZRbK+xOo="},
+		"Upgrade":              {"websocket"},
+	}
+	assertEstablishConnectionResponse(t, helloWorldSerivce, req, expectHeader)
+
+	close(shutdownC)
+}
+
 func TestRawTCPServiceEstablishConnection(t *testing.T) {
 	originListener, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
@@ -29,6 +95,8 @@ func TestRawTCPServiceEstablishConnection(t *testing.T) {
 	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("http://%s", originListener.Addr()), nil)
 	require.NoError(t, err)

+	assertEstablishConnectionResponse(t, rawTCPService, req, nil)
+
 	originListener.Close()
 	<-listenerClosed

@@ -36,8 +104,9 @@ func TestRawTCPServiceEstablishConnection(t *testing.T) {
 	require.NoError(t, err)

 	// Origin not listening for new connection, should return an error
-	_, err = rawTCPService.EstablishConnection(req.URL.String())
+	_, resp, err := rawTCPService.EstablishConnection(req)
 	require.Error(t, err)
+	require.Nil(t, resp)
 }

 func TestTCPOverWSServiceEstablishConnection(t *testing.T) {
@@ -59,6 +128,12 @@ func TestTCPOverWSServiceEstablishConnection(t *testing.T) {
 	bastionReq := baseReq.Clone(context.Background())
 	carrier.SetBastionDest(bastionReq.Header, originListener.Addr().String())

+	expectHeader := http.Header{
+		"Connection":           {"Upgrade"},
+		"Sec-Websocket-Accept": {"s3pPLMBiTxaQ9kYGzzhZRbK+xOo="},
+		"Upgrade":              {"websocket"},
+	}
+
 	tests := []struct {
 		testCase  string
 		service   *tcpOverWSService
@@ -86,9 +161,11 @@ func TestTCPOverWSServiceEstablishConnection(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.testCase, func(t *testing.T) {
 			if test.expectErr {
-				bastionHost, _ := carrier.ResolveBastionDest(test.req)
-				_, err := test.service.EstablishConnection(bastionHost)
+				_, resp, err := test.service.EstablishConnection(test.req)
 				assert.Error(t, err)
+				assert.Nil(t, resp)
+			} else {
+				assertEstablishConnectionResponse(t, test.service, test.req, expectHeader)
 			}
 		})
 	}
@@ -98,9 +175,9 @@ func TestTCPOverWSServiceEstablishConnection(t *testing.T) {

 	for _, service := range []*tcpOverWSService{newTCPOverWSService(originURL), newBastionService()} {
 		// Origin not listening for new connection, should return an error
-		bastionHost, _ := carrier.ResolveBastionDest(bastionReq)
-		_, err := service.EstablishConnection(bastionHost)
+		_, resp, err := service.EstablishConnection(bastionReq)
 		assert.Error(t, err)
+		assert.Nil(t, resp)
 	}
 }

@@ -141,6 +218,10 @@ func TestHTTPServiceHostHeaderOverride(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, http.StatusOK, resp.StatusCode)

+	req = req.Clone(context.Background())
+	_, resp, err = httpService.EstablishConnection(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
 }

 func tcpListenRoutine(listener net.Listener, closeChan chan struct{}) {
@@ -20,8 +20,8 @@ import (
 	"github.com/cloudflare/cloudflared/tlsconfig"
 )

-// OriginService is something a tunnel can proxy traffic to.
-type OriginService interface {
+// originService is something a tunnel can proxy traffic to.
+type originService interface {
 	String() string
 	// Start the origin service if it's managed by cloudflared, e.g. proxy servers or Hello World.
 	// If it's not managed by cloudflared, this is a no-op because the user is responsible for
@@ -238,7 +238,7 @@ func (nrc *NopReadCloser) Close() error {
 	return nil
 }

-func newHTTPTransport(service OriginService, cfg OriginRequestConfig, log *zerolog.Logger) (*http.Transport, error) {
+func newHTTPTransport(service originService, cfg OriginRequestConfig, log *zerolog.Logger) (*http.Transport, error) {
 	originCertPool, err := tlsconfig.LoadOriginCA(cfg.CAPool, log)
 	if err != nil {
 		return nil, errors.Wrap(err, "Error loading cert pool")
@@ -17,7 +17,7 @@ type Rule struct {
 	// A (probably local) address. Requests for a hostname which matches this
 	// rule's hostname pattern will be proxied to the service running on this
 	// address.
-	Service OriginService
+	Service originService

 	// Configure the request cloudflared sends to this specific origin.
 	Config OriginRequestConfig
@@ -14,7 +14,7 @@ func Test_rule_matches(t *testing.T) {
 	type fields struct {
 		Hostname string
 		Path     *regexp.Regexp
-		Service  OriginService
+		Service  originService
 	}
 	type args struct {
 		requestURL *url.URL
@@ -22,7 +22,7 @@ const (
 	startupTime     = time.Millisecond * 500
 )

-func newMetricsHandler(readyServer *ReadyServer, quickTunnelHostname string) *mux.Router {
+func newMetricsHandler(readyServer *ReadyServer) *mux.Router {
 	router := mux.NewRouter()
 	router.PathPrefix("/debug/").Handler(http.DefaultServeMux)

@@ -33,9 +33,6 @@ func newMetricsHandler(readyServer *ReadyServer, quickTunnelHostname string) *mu
 	if readyServer != nil {
 		router.Handle("/ready", readyServer)
 	}
-	router.HandleFunc("/quicktunnel", func(w http.ResponseWriter, r *http.Request) {
-		_, _ = fmt.Fprintf(w, `{"hostname":"%s"}`, quickTunnelHostname)
-	})

 	return router
 }
@@ -44,7 +41,6 @@ func ServeMetrics(
 	l net.Listener,
 	shutdownC <-chan struct{},
 	readyServer *ReadyServer,
-	quickTunnelHostname string,
 	log *zerolog.Logger,
 ) (err error) {
 	var wg sync.WaitGroup
@@ -52,7 +48,7 @@ func ServeMetrics(
 	trace.AuthRequest = func(*http.Request) (bool, bool) { return true, true }
 	// TODO: parameterize ReadTimeout and WriteTimeout. The maximum time we can
 	// profile CPU usage depends on WriteTimeout
-	h := newMetricsHandler(readyServer, quickTunnelHostname)
+	h := newMetricsHandler(readyServer)
 	server := &http.Server{
 		ReadTimeout:  10 * time.Second,
 		WriteTimeout: 10 * time.Second,
@@ -36,6 +36,8 @@ func (rs *ReadyServer) OnTunnelEvent(c conn.Event) {
 		rs.Lock()
 		rs.isConnected[int(c.Index)] = false
 		rs.Unlock()
+	case conn.SetURL:
+		break
 	default:
 		rs.log.Error().Msgf("Unknown connection event case %v", c)
 	}
@@ -7,27 +7,23 @@ import (
 	"io"
 	"net/http"
 	"strconv"
+	"strings"

 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"

-	"github.com/cloudflare/cloudflared/carrier"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/ingress"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
-	"github.com/cloudflare/cloudflared/websocket"
 )

 const (
-	// TagHeaderNamePrefix indicates a Cloudflared Warp Tag prefix that gets appended for warp traffic stream headers.
-	TagHeaderNamePrefix   = "Cf-Warp-Tag-"
-	LogFieldCFRay         = "cfRay"
-	LogFieldRule          = "ingressRule"
-	LogFieldOriginService = "originService"
+	TagHeaderNamePrefix = "Cf-Warp-Tag-"
+	LogFieldCFRay       = "cfRay"
+	LogFieldRule        = "ingressRule"
 )

-// Proxy represents a means to Proxy between cloudflared and the origin services.
-type Proxy struct {
+type proxy struct {
 	ingressRules ingress.Ingress
 	warpRouting  *ingress.WarpRoutingService
 	tags         []tunnelpogs.Tag
@@ -35,14 +31,13 @@ type Proxy struct {
 	bufferPool   *bufferPool
 }

-// NewOriginProxy returns a new instance of the Proxy struct.
 func NewOriginProxy(
 	ingressRules ingress.Ingress,
 	warpRouting *ingress.WarpRoutingService,
 	tags []tunnelpogs.Tag,
-	log *zerolog.Logger,
-) *Proxy {
-	return &Proxy{
+	log *zerolog.Logger) connection.OriginProxy {
+
+	return &proxy{
 		ingressRules: ingressRules,
 		warpRouting:  warpRouting,
 		tags:         tags,
@@ -51,18 +46,35 @@ func NewOriginProxy(
 	}
 }

-// ProxyHTTP further depends on ingress rules to establish a connection with the origin service. This may be
-// a simple roundtrip or a tcp/websocket dial depending on ingres rule setup.
-func (p *Proxy) ProxyHTTP(
-	w connection.ResponseWriter,
-	req *http.Request,
-	isWebsocket bool,
-) error {
+// Caller is responsible for writing any error to ResponseWriter
+func (p *proxy) Proxy(w connection.ResponseWriter, req *http.Request, sourceConnectionType connection.Type) error {
 	incrementRequests()
 	defer decrementConcurrentRequests()

-	cfRay := connection.FindCfRayHeader(req)
-	lbProbe := connection.IsLBProbeRequest(req)
+	cfRay := findCfRayHeader(req)
+	lbProbe := isLBProbeRequest(req)
+
+	serveCtx, cancel := context.WithCancel(req.Context())
+	defer cancel()
+
+	p.appendTagHeaders(req)
+	if sourceConnectionType == connection.TypeTCP {
+		if p.warpRouting == nil {
+			err := errors.New(`cloudflared received a request from WARP client, but your configuration has disabled ingress from WARP clients. To enable this, set "warp-routing:\n\t enabled: true" in your config.yaml`)
+			p.log.Error().Msg(err.Error())
+			return err
+		}
+		logFields := logFields{
+			cfRay:   cfRay,
+			lbProbe: lbProbe,
+			rule:    ingress.ServiceWarpRouting,
+		}
+		if err := p.proxyStreamRequest(serveCtx, w, req, p.warpRouting.Proxy, logFields); err != nil {
+			p.logRequestError(err, cfRay, ingress.ServiceWarpRouting)
+			return err
+		}
+		return nil
+	}

 	rule, ruleNum := p.ingressRules.FindMatchingRule(req.Host, req.URL.Path)
 	logFields := logFields{
@@ -72,113 +84,56 @@ func (p *Proxy) ProxyHTTP(
 	}
 	p.logRequest(req, logFields)

-	switch originProxy := rule.Service.(type) {
-	case ingress.HTTPOriginProxy:
-		if err := p.proxyHTTPRequest(
-			w,
-			req,
-			originProxy,
-			isWebsocket,
-			rule.Config.DisableChunkedEncoding,
-			logFields,
-		); err != nil {
-			rule, srv := ruleField(p.ingressRules, ruleNum)
-			p.logRequestError(err, cfRay, rule, srv)
+	if sourceConnectionType == connection.TypeHTTP {
+		if err := p.proxyHTTPRequest(w, req, rule, logFields); err != nil {
+			p.logRequestError(err, cfRay, ruleField(p.ingressRules, ruleNum))
 			return err
 		}
 		return nil
-
-	case ingress.StreamBasedOriginProxy:
-		dest, err := getDestFromRule(rule, req)
-		if err != nil {
-			return err
-		}
-
-		rws := connection.NewHTTPResponseReadWriterAcker(w, req)
-		if err := p.proxyStream(req.Context(), rws, dest, originProxy, logFields); err != nil {
-			rule, srv := ruleField(p.ingressRules, ruleNum)
-			p.logRequestError(err, cfRay, rule, srv)
-			return err
-		}
-		return nil
-	default:
-		return fmt.Errorf("Unrecognized service: %s, %t", rule.Service, originProxy)
 	}
-}

-// ProxyTCP proxies to a TCP connection between the origin service and cloudflared.
-func (p *Proxy) ProxyTCP(
-	ctx context.Context,
-	rwa connection.ReadWriteAcker,
-	req *connection.TCPRequest,
-) error {
-	incrementRequests()
-	defer decrementConcurrentRequests()
+	connectionProxy, ok := rule.Service.(ingress.StreamBasedOriginProxy)
+	if !ok {
+		p.log.Error().Msgf("%s is not a connection-oriented service", rule.Service)
+		return fmt.Errorf("Not a connection-oriented service")
+	}

-	if p.warpRouting == nil {
-		err := errors.New(`cloudflared received a request from WARP client, but your configuration has disabled ingress from WARP clients. To enable this, set "warp-routing:\n\t enabled: true" in your config.yaml`)
-		p.log.Error().Msg(err.Error())
+	if err := p.proxyStreamRequest(serveCtx, w, req, connectionProxy, logFields); err != nil {
+		p.logRequestError(err, cfRay, ruleField(p.ingressRules, ruleNum))
 		return err
 	}
-
-	serveCtx, cancel := context.WithCancel(ctx)
-	defer cancel()
-
-	logFields := logFields{
-		cfRay:   req.CFRay,
-		lbProbe: req.LBProbe,
-		rule:    ingress.ServiceWarpRouting,
-	}
-
-	if err := p.proxyStream(serveCtx, rwa, req.Dest, p.warpRouting.Proxy, logFields); err != nil {
-		p.logRequestError(err, req.CFRay, "", ingress.ServiceWarpRouting)
-		return err
-	}
-
 	return nil
 }

-func ruleField(ing ingress.Ingress, ruleNum int) (ruleID string, srv string) {
-	srv = ing.Rules[ruleNum].Service.String()
+func ruleField(ing ingress.Ingress, ruleNum int) string {
 	if ing.IsSingleRule() {
-		return "", srv
+		return ""
 	}
-	return fmt.Sprintf("%d", ruleNum), srv
+	return fmt.Sprintf("%d", ruleNum)
 }

-// ProxyHTTPRequest proxies requests of underlying type http and websocket to the origin service.
-func (p *Proxy) proxyHTTPRequest(
-	w connection.ResponseWriter,
-	req *http.Request,
-	httpService ingress.HTTPOriginProxy,
-	isWebsocket bool,
-	disableChunkedEncoding bool,
-	fields logFields,
-) error {
-	roundTripReq := req
-	if isWebsocket {
-		roundTripReq = req.Clone(req.Context())
-		roundTripReq.Header.Set("Connection", "Upgrade")
-		roundTripReq.Header.Set("Upgrade", "websocket")
-		roundTripReq.Header.Set("Sec-Websocket-Version", "13")
-		roundTripReq.ContentLength = 0
-		roundTripReq.Body = nil
-	} else {
-		// Support for WSGI Servers by switching transfer encoding from chunked to gzip/deflate
-		if disableChunkedEncoding {
-			roundTripReq.TransferEncoding = []string{"gzip", "deflate"}
-			cLength, err := strconv.Atoi(req.Header.Get("Content-Length"))
-			if err == nil {
-				roundTripReq.ContentLength = int64(cLength)
-			}
+func (p *proxy) proxyHTTPRequest(w connection.ResponseWriter, req *http.Request, rule *ingress.Rule, fields logFields) error {
+	// Support for WSGI Servers by switching transfer encoding from chunked to gzip/deflate
+	if rule.Config.DisableChunkedEncoding {
+		req.TransferEncoding = []string{"gzip", "deflate"}
+		cLength, err := strconv.Atoi(req.Header.Get("Content-Length"))
+		if err == nil {
+			req.ContentLength = int64(cLength)
 		}
-		// Request origin to keep connection alive to improve performance
-		roundTripReq.Header.Set("Connection", "keep-alive")
 	}

-	resp, err := httpService.RoundTrip(roundTripReq)
+	// Request origin to keep connection alive to improve performance
+	req.Header.Set("Connection", "keep-alive")
+
+	httpService, ok := rule.Service.(ingress.HTTPOriginProxy)
+	if !ok {
+		p.log.Error().Msgf("%s is not a http service", rule.Service)
+		return fmt.Errorf("Not a http service")
+	}
+
+	resp, err := httpService.RoundTrip(req)
 	if err != nil {
-		return errors.Wrap(err, "Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared")
+		return errors.Wrap(err, "Error proxying request to origin")
 	}
 	defer resp.Body.Close()

@@ -186,23 +141,6 @@ func (p *Proxy) proxyHTTPRequest(
 	if err != nil {
 		return errors.Wrap(err, "Error writing response header")
 	}
-
-	if resp.StatusCode == http.StatusSwitchingProtocols {
-		rwc, ok := resp.Body.(io.ReadWriteCloser)
-		if !ok {
-			return errors.New("internal error: unsupported connection type")
-		}
-		defer rwc.Close()
-
-		eyeballStream := &bidirectionalStream{
-			writer: w,
-			reader: req.Body,
-		}
-
-		websocket.Stream(eyeballStream, rwc, p.log)
-		return nil
-	}
-
 	if connection.IsServerSentEvent(resp.Header) {
 		p.log.Debug().Msg("Detected Server-Side Events from Origin")
 		p.writeEventStream(w, resp.Body)
@@ -213,30 +151,32 @@ func (p *Proxy) proxyHTTPRequest(
 		defer p.bufferPool.Put(buf)
 		_, _ = io.CopyBuffer(w, resp.Body, buf)
 	}
-
 	p.logOriginResponse(resp, fields)
 	return nil
 }

-// proxyStream proxies type TCP and other underlying types if the connection is defined as a stream oriented
-// ingress rule.
-func (p *Proxy) proxyStream(
-	ctx context.Context,
-	rwa connection.ReadWriteAcker,
-	dest string,
+// proxyStreamRequest first establish a connection with origin, then it writes the status code and headers, and finally it streams data between
+// eyeball and origin.
+func (p *proxy) proxyStreamRequest(
+	serveCtx context.Context,
+	w connection.ResponseWriter,
+	req *http.Request,
 	connectionProxy ingress.StreamBasedOriginProxy,
 	fields logFields,
 ) error {
-	originConn, err := connectionProxy.EstablishConnection(dest)
+	originConn, resp, err := connectionProxy.EstablishConnection(req)
 	if err != nil {
 		return err
 	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}

-	if err := rwa.AckConnection(); err != nil {
+	if err = w.WriteRespHeaders(resp.StatusCode, resp.Header); err != nil {
 		return err
 	}

-	streamCtx, cancel := context.WithCancel(ctx)
+	streamCtx, cancel := context.WithCancel(serveCtx)
 	defer cancel()

 	go func() {
@@ -245,7 +185,12 @@ func (p *Proxy) proxyStream(
 		originConn.Close()
 	}()

-	originConn.Stream(ctx, rwa, p.log)
+	eyeballStream := &bidirectionalStream{
+		writer: w,
+		reader: req.Body,
+	}
+	originConn.Stream(serveCtx, eyeballStream, p.log)
+	p.logOriginResponse(resp, fields)
 	return nil
 }

@@ -262,7 +207,7 @@ func (wr *bidirectionalStream) Write(p []byte) (n int, err error) {
 	return wr.writer.Write(p)
 }

-func (p *Proxy) writeEventStream(w connection.ResponseWriter, respBody io.ReadCloser) {
+func (p *proxy) writeEventStream(w connection.ResponseWriter, respBody io.ReadCloser) {
 	reader := bufio.NewReader(respBody)
 	for {
 		line, err := reader.ReadBytes('\n')
@@ -273,7 +218,7 @@ func (p *Proxy) writeEventStream(w connection.ResponseWriter, respBody io.ReadCl
 	}
 }

-func (p *Proxy) appendTagHeaders(r *http.Request) {
+func (p *proxy) appendTagHeaders(r *http.Request) {
 	for _, tag := range p.tags {
 		r.Header.Add(TagHeaderNamePrefix+tag.Name, tag.Value)
 	}
@@ -285,7 +230,7 @@ type logFields struct {
 	rule    interface{}
 }

-func (p *Proxy) logRequest(r *http.Request, fields logFields) {
+func (p *proxy) logRequest(r *http.Request, fields logFields) {
 	if fields.cfRay != "" {
 		p.log.Debug().Msgf("CF-RAY: %s %s %s %s", fields.cfRay, r.Method, r.URL, r.Proto)
 	} else if fields.lbProbe {
@@ -308,7 +253,7 @@ func (p *Proxy) logRequest(r *http.Request, fields logFields) {
 	}
 }

-func (p *Proxy) logOriginResponse(resp *http.Response, fields logFields) {
+func (p *proxy) logOriginResponse(resp *http.Response, fields logFields) {
 	responseByCode.WithLabelValues(strconv.Itoa(resp.StatusCode)).Inc()
 	if fields.cfRay != "" {
 		p.log.Debug().Msgf("CF-RAY: %s Status: %s served by ingress %d", fields.cfRay, resp.Status, fields.rule)
@@ -326,7 +271,7 @@ func (p *Proxy) logOriginResponse(resp *http.Response, fields logFields) {
 	}
 }

-func (p *Proxy) logRequestError(err error, cfRay string, rule, service string) {
+func (p *proxy) logRequestError(err error, cfRay string, rule string) {
 	requestErrors.Inc()
 	log := p.log.Error().Err(err)
 	if cfRay != "" {
@@ -335,17 +280,13 @@ func (p *Proxy) logRequestError(err error, cfRay string, rule, service string) {
 	if rule != "" {
 		log = log.Str(LogFieldRule, rule)
 	}
-	if service != "" {
-		log = log.Str(LogFieldOriginService, service)
-	}
 	log.Msg("")
 }

-func getDestFromRule(rule *ingress.Rule, req *http.Request) (string, error) {
-	switch rule.Service.String() {
-	case ingress.ServiceBastion:
-		return carrier.ResolveBastionDest(req)
-	default:
-		return rule.Service.String(), nil
-	}
+func findCfRayHeader(req *http.Request) string {
+	return req.Header.Get("Cf-Ray")
+}
+
+func isLBProbeRequest(req *http.Request) bool {
+	return strings.HasPrefix(req.UserAgent(), lbProbeUserAgentPrefix)
 }
@@ -6,11 +6,9 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"sync"
 	"testing"
 	"time"
@@ -46,10 +44,6 @@ func newMockHTTPRespWriter() *mockHTTPRespWriter {
 	}
 }

-func (w *mockHTTPRespWriter) WriteResponse() error {
-	return nil
-}
-
 func (w *mockHTTPRespWriter) WriteRespHeaders(status int, header http.Header) error {
 	w.WriteHeader(status)
 	for header, val := range header {
@@ -150,7 +144,7 @@ func testProxyHTTP(proxy connection.OriginProxy) func(t *testing.T) {
 		req, err := http.NewRequest(http.MethodGet, "http://localhost:8080", nil)
 		require.NoError(t, err)

-		err = proxy.ProxyHTTP(responseWriter, req, false)
+		err = proxy.Proxy(responseWriter, req, connection.TypeHTTP)
 		require.NoError(t, err)

 		assert.Equal(t, http.StatusOK, responseWriter.Code)
@@ -174,7 +168,7 @@ func testProxyWebsocket(proxy connection.OriginProxy) func(t *testing.T) {

 		errGroup, ctx := errgroup.WithContext(ctx)
 		errGroup.Go(func() error {
-			err = proxy.ProxyHTTP(responseWriter, req, true)
+			err = proxy.Proxy(responseWriter, req, connection.TypeWebsocket)
 			require.NoError(t, err)

 			require.Equal(t, http.StatusSwitchingProtocols, responseWriter.Code)
@@ -235,7 +229,7 @@ func testProxySSE(proxy connection.OriginProxy) func(t *testing.T) {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			err = proxy.ProxyHTTP(responseWriter, req, false)
+			err = proxy.Proxy(responseWriter, req, connection.TypeHTTP)
 			require.NoError(t, err)

 			require.Equal(t, http.StatusOK, responseWriter.Code)
@@ -279,7 +273,26 @@ func TestProxyMultipleOrigins(t *testing.T) {
 		},
 	}

-	tests := []MultipleIngressTest{
+	ingress, err := ingress.ParseIngress(&config.Configuration{
+		TunnelID: t.Name(),
+		Ingress:  unvalidatedIngress,
+	})
+	require.NoError(t, err)
+
+	log := zerolog.Nop()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	errC := make(chan error)
+	var wg sync.WaitGroup
+	require.NoError(t, ingress.StartOrigins(&wg, &log, ctx.Done(), errC))
+
+	proxy := NewOriginProxy(ingress, unusedWarpRoutingService, testTags, &log)
+
+	tests := []struct {
+		url            string
+		expectedStatus int
+		expectedBody   []byte
+	}{
 		{
 			url:            "http://api.example.com",
 			expectedStatus: http.StatusCreated,
@@ -304,37 +317,12 @@ func TestProxyMultipleOrigins(t *testing.T) {
 		},
 	}

-	runIngressTestScenarios(t, unvalidatedIngress, tests)
-}
-
-type MultipleIngressTest struct {
-	url            string
-	expectedStatus int
-	expectedBody   []byte
-}
-
-func runIngressTestScenarios(t *testing.T, unvalidatedIngress []config.UnvalidatedIngressRule, tests []MultipleIngressTest) {
-	ingress, err := ingress.ParseIngress(&config.Configuration{
-		TunnelID: t.Name(),
-		Ingress:  unvalidatedIngress,
-	})
-	require.NoError(t, err)
-
-	log := zerolog.Nop()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	errC := make(chan error)
-	var wg sync.WaitGroup
-	require.NoError(t, ingress.StartOrigins(&wg, &log, ctx.Done(), errC))
-
-	proxy := NewOriginProxy(ingress, unusedWarpRoutingService, testTags, &log)
-
 	for _, test := range tests {
 		responseWriter := newMockHTTPRespWriter()
 		req, err := http.NewRequest(http.MethodGet, test.url, nil)
 		require.NoError(t, err)

-		err = proxy.ProxyHTTP(responseWriter, req, false)
+		err = proxy.Proxy(responseWriter, req, connection.TypeHTTP)
 		require.NoError(t, err)

 		assert.Equal(t, test.expectedStatus, responseWriter.Code)
@@ -362,7 +350,7 @@ func (errorOriginTransport) RoundTrip(*http.Request) (*http.Response, error) {
 }

 func TestProxyError(t *testing.T) {
-	ing := ingress.Ingress{
+	ingress := ingress.Ingress{
 		Rules: []ingress.Rule{
 			{
 				Hostname: "*",
@@ -376,13 +364,13 @@ func TestProxyError(t *testing.T) {

 	log := zerolog.Nop()

-	proxy := NewOriginProxy(ing, unusedWarpRoutingService, testTags, &log)
+	proxy := NewOriginProxy(ingress, unusedWarpRoutingService, testTags, &log)

 	responseWriter := newMockHTTPRespWriter()
 	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1", nil)
 	assert.NoError(t, err)

-	assert.Error(t, proxy.ProxyHTTP(responseWriter, req, false))
+	assert.Error(t, proxy.Proxy(responseWriter, req, connection.TypeHTTP))
 }

 type replayer struct {
@@ -575,14 +563,8 @@ func TestConnections(t *testing.T) {
 				},
 			},
 			want: want{
-				message: []byte("Forbidden\n"),
-				err:     false,
-				headers: map[string][]string{
-					"Content-Length":         {"10"},
-					"Content-Type":           {"text/plain; charset=utf-8"},
-					"Sec-Websocket-Version":  {"13"},
-					"X-Content-Type-Options": {"nosniff"},
-				},
+				message: []byte{},
+				err:     true,
 			},
 		},
 		{
@@ -621,7 +603,6 @@ func TestConnections(t *testing.T) {
 			ingressRule.StartOrigins(&wg, logger, ctx.Done(), errC)
 			proxy := NewOriginProxy(ingressRule, test.args.warpRoutingService, testTags, logger)

-			dest := ln.Addr().String()
 			req, err := http.NewRequest(
 				http.MethodGet,
 				test.args.ingressServiceScheme+ln.Addr().String(),
@@ -639,12 +620,8 @@ func TestConnections(t *testing.T) {
 					replayer.Write(resp)
 				}()
 			}
-			if test.args.connectionType == connection.TypeTCP {
-				rws := connection.NewHTTPResponseReadWriterAcker(respWriter, req)
-				err = proxy.ProxyTCP(ctx, rws, &connection.TCPRequest{Dest: dest})
-			} else {
-				err = proxy.ProxyHTTP(respWriter, req, test.args.connectionType == connection.TypeWebsocket)
-			}
+
+			err = proxy.Proxy(respWriter, req, test.args.connectionType)

 			cancel()
 			assert.Equal(t, test.want.err, err != nil)
@@ -656,45 +633,6 @@ func TestConnections(t *testing.T) {
 	}
 }

-func TestUnixSocketOrigin(t *testing.T) {
-	file, err := ioutil.TempFile("", "unix.sock")
-	require.NoError(t, err)
-	os.Remove(file.Name()) // remove the file since binding the socket expects to create it
-
-	l, err := net.Listen("unix", file.Name())
-	require.NoError(t, err)
-	defer l.Close()
-	defer os.Remove(file.Name())
-
-	api := &httptest.Server{
-		Listener: l,
-		Config:   &http.Server{Handler: mockAPI{}},
-	}
-	api.Start()
-	defer api.Close()
-
-	unvalidatedIngress := []config.UnvalidatedIngressRule{
-		{
-			Hostname: "unix.example.com",
-			Service:  "unix:" + file.Name(),
-		},
-		{
-			Hostname: "*",
-			Service:  "http_status:404",
-		},
-	}
-
-	tests := []MultipleIngressTest{
-		{
-			url:            "http://unix.example.com",
-			expectedStatus: http.StatusCreated,
-			expectedBody:   []byte("Created"),
-		},
-	}
-
-	runIngressTestScenarios(t, unvalidatedIngress, tests)
-}
-
 type requestBody struct {
 	pw *io.PipeWriter
 	pr *io.PipeReader
@@ -821,8 +759,6 @@ func (w *wsRespWriter) WriteRespHeaders(status int, header http.Header) error {

 // respHeaders is a test function to read respHeaders
 func (w *wsRespWriter) headers() http.Header {
-	// Removing indeterminstic header because it cannot be asserted.
-	w.responseHeaders.Del("Date")
 	return w.responseHeaders
 }

@@ -838,10 +774,6 @@ func newTCPRespWriter(w io.Writer) *mockTCPRespWriter {
 	}
 }

-func (m *mockTCPRespWriter) Read(p []byte) (n int, err error) {
-	return len(p), nil
-}
-
 func (m *mockTCPRespWriter) Write(p []byte) (n int, err error) {
 	return m.w.Write(p)
 }
@@ -26,6 +26,7 @@ import (

 const (
 	dialTimeout              = 15 * time.Second
+	lbProbeUserAgentPrefix   = "Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/;"
 	FeatureSerializedHeaders = "serialized_headers"
 	FeatureQuickReconnects   = "quick_reconnects"
 )
@@ -46,6 +47,7 @@ type TunnelConfig struct {
 	HAConnections    int
 	IncidentLookup   IncidentLookup
 	IsAutoupdated    bool
+	IsFreeTunnel     bool
 	LBPool           string
 	Tags             []tunnelpogs.Tag
 	Log              *zerolog.Logger
@@ -415,7 +417,6 @@ func ServeHTTP2(
 		config.Observer,
 		connIndex,
 		connectedFuse,
-		config.Log,
 		gracefulShutdownC,
 	)

@@ -1,88 +0,0 @@
-package quic
-
-import (
-	capnp "zombiezen.com/go/capnproto2"
-	"zombiezen.com/go/capnproto2/pogs"
-
-	"github.com/cloudflare/cloudflared/quic/schema"
-)
-
-// ConnectionType indicates the type of underlying connection proxied within the QUIC stream.
-type ConnectionType uint16
-
-const (
-	ConnectionTypeHTTP ConnectionType = iota
-	ConnectionTypeWebsocket
-	ConnectionTypeTCP
-)
-
-// ConnectRequest is the representation of metadata sent at the start of a QUIC application handshake.
-type ConnectRequest struct {
-	Dest     string         `capnp:"dest"`
-	Type     ConnectionType `capnp:"type"`
-	Metadata []Metadata     `capnp:"metadata"`
-}
-
-// Metadata is a representation of key value based data sent via RequestMeta.
-type Metadata struct {
-	Key string `capnp:"key"`
-	Val string `capnp:"val"`
-}
-
-func (r *ConnectRequest) fromPogs(msg *capnp.Message) error {
-	metadata, err := schema.ReadRootConnectRequest(msg)
-	if err != nil {
-		return err
-	}
-	return pogs.Extract(r, schema.ConnectRequest_TypeID, metadata.Struct)
-}
-
-func (r *ConnectRequest) toPogs() (*capnp.Message, error) {
-	msg, seg, err := capnp.NewMessage(capnp.SingleSegment(nil))
-	if err != nil {
-		return nil, err
-	}
-
-	root, err := schema.NewRootConnectRequest(seg)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := pogs.Insert(schema.ConnectRequest_TypeID, root.Struct, r); err != nil {
-		return nil, err
-	}
-
-	return msg, nil
-}
-
-// ConnectResponse is a representation of metadata sent as a response to a QUIC application handshake.
-type ConnectResponse struct {
-	Error    string     `capnp:"error"`
-	Metadata []Metadata `capnp:"metadata"`
-}
-
-func (r *ConnectResponse) fromPogs(msg *capnp.Message) error {
-	metadata, err := schema.ReadRootConnectResponse(msg)
-	if err != nil {
-		return err
-	}
-	return pogs.Extract(r, schema.ConnectResponse_TypeID, metadata.Struct)
-}
-
-func (r *ConnectResponse) toPogs() (*capnp.Message, error) {
-	msg, seg, err := capnp.NewMessage(capnp.SingleSegment(nil))
-	if err != nil {
-		return nil, err
-	}
-
-	root, err := schema.NewRootConnectResponse(seg)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := pogs.Insert(schema.ConnectResponse_TypeID, root.Struct, r); err != nil {
-		return nil, err
-	}
-
-	return msg, nil
-}
@@ -1,115 +0,0 @@
-package quic
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-
-	capnp "zombiezen.com/go/capnproto2"
-)
-
-// protocolSignature is a custom protocol signature to ensure that whoever performs a handshake does not write data
-// before writing the metadata.
-var protocolSignature = []byte{0x0A, 0x36, 0xCD, 0x12, 0xA1, 0x3E}
-
-// ReadConnectRequestData reads the handshake data from a QUIC stream.
-func ReadConnectRequestData(stream io.Reader) (*ConnectRequest, error) {
-	if err := verifySignature(stream); err != nil {
-		return nil, err
-	}
-
-	msg, err := capnp.NewDecoder(stream).Decode()
-	if err != nil {
-		return nil, err
-	}
-
-	r := &ConnectRequest{}
-	if err := r.fromPogs(msg); err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
-// WriteConnectRequestData writes requestMeta to a stream.
-func WriteConnectRequestData(stream io.Writer, dest string, connectionType ConnectionType, metadata ...Metadata) error {
-	connectRequest := &ConnectRequest{
-		Dest:     dest,
-		Type:     connectionType,
-		Metadata: metadata,
-	}
-
-	msg, err := connectRequest.toPogs()
-	if err != nil {
-		return err
-	}
-
-	if err := writePreamble(stream); err != nil {
-		return err
-	}
-	return capnp.NewEncoder(stream).Encode(msg)
-}
-
-// ReadConnectResponseData reads the response to a RequestMeta in a stream.
-func ReadConnectResponseData(stream io.Reader) (*ConnectResponse, error) {
-	if err := verifySignature(stream); err != nil {
-		return nil, err
-	}
-
-	msg, err := capnp.NewDecoder(stream).Decode()
-	if err != nil {
-		return nil, err
-	}
-
-	r := &ConnectResponse{}
-	if err := r.fromPogs(msg); err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
-// WriteConnectResponseData writes response to a QUIC stream.
-func WriteConnectResponseData(stream io.Writer, respErr error, metadata ...Metadata) error {
-	var connectResponse *ConnectResponse
-	if respErr != nil {
-		connectResponse = &ConnectResponse{
-			Error: respErr.Error(),
-		}
-	} else {
-		connectResponse = &ConnectResponse{
-			Metadata: metadata,
-		}
-	}
-
-	msg, err := connectResponse.toPogs()
-	if err != nil {
-		return err
-	}
-
-	if err := writePreamble(stream); err != nil {
-		return err
-	}
-	return capnp.NewEncoder(stream).Encode(msg)
-}
-
-func writePreamble(stream io.Writer) error {
-	return writeSignature(stream)
-	// TODO : TUN-4613 Write protocol version here
-}
-
-func writeSignature(stream io.Writer) error {
-	_, err := stream.Write(protocolSignature)
-	return err
-}
-
-func verifySignature(stream io.Reader) error {
-	signature := make([]byte, len(protocolSignature))
-	if _, err := io.ReadFull(stream, signature); err != nil {
-		return err
-	}
-
-	if !bytes.Equal(signature[0:], protocolSignature) {
-		return fmt.Errorf("Wrong signature: %v", signature)
-	}
-
-	return nil
-}
@@ -1,88 +0,0 @@
-package quic
-
-import (
-	"bytes"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestConnectRequestData(t *testing.T) {
-	var tests = []struct {
-		name           string
-		hostname       string
-		connectionType ConnectionType
-		metadata       []Metadata
-	}{
-		{
-			name:           "Signature verified and request metadata is unmarshaled and read correctly",
-			hostname:       "tunnel.com",
-			connectionType: ConnectionTypeHTTP,
-			metadata: []Metadata{
-				Metadata{
-					Key: "key",
-					Val: "1234",
-				},
-			},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			b := &bytes.Buffer{}
-			err := WriteConnectRequestData(b, test.hostname, test.connectionType, test.metadata...)
-			require.NoError(t, err)
-			reqMeta, err := ReadConnectRequestData(b)
-			require.NoError(t, err)
-
-			assert.Equal(t, test.metadata, reqMeta.Metadata)
-			assert.Equal(t, test.hostname, reqMeta.Dest)
-			assert.Equal(t, test.connectionType, reqMeta.Type)
-		})
-	}
-}
-
-func TestConnectResponseMeta(t *testing.T) {
-	var tests = []struct {
-		name     string
-		err      error
-		metadata []Metadata
-	}{
-		{
-			name: "Signature verified and response metadata is unmarshaled and read correctly",
-			metadata: []Metadata{
-				Metadata{
-					Key: "key",
-					Val: "1234",
-				},
-			},
-		},
-		{
-			name: "If error is not empty, other fields should be blank",
-			err:  errors.New("something happened"),
-			metadata: []Metadata{
-				Metadata{
-					Key: "key",
-					Val: "1234",
-				},
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			b := &bytes.Buffer{}
-			err := WriteConnectResponseData(b, test.err, test.metadata...)
-			require.NoError(t, err)
-			respMeta, err := ReadConnectResponseData(b)
-			require.NoError(t, err)
-
-			if respMeta.Error == "" {
-				assert.Equal(t, test.metadata, respMeta.Metadata)
-			} else {
-				assert.Equal(t, 0, len(respMeta.Metadata))
-			}
-		})
-	}
-}
@@ -1,28 +0,0 @@
-using Go = import "/go.capnp";
-@0xb29021ef7421cc32;
-
-$Go.package("schema");
-$Go.import("schema");
-
-
-struct ConnectRequest{
-	dest @0 :Text;
-	type @1 :ConnectionType;
-	metadata @2 :List(Metadata);
-}
-
-enum ConnectionType{
-	http @0;
-	websocket @1;
-	tcp @2;
-}
-
-struct Metadata {
-    key @0 :Text;
-	val @1 :Text;
-}
-
-struct ConnectResponse{
-	error @0 :Text;
-	metadata @1 :List(Metadata);
-}
@@ -1,395 +0,0 @@
-// Code generated by capnpc-go. DO NOT EDIT.
-
-package schema
-
-import (
-	capnp "zombiezen.com/go/capnproto2"
-	text "zombiezen.com/go/capnproto2/encoding/text"
-	schemas "zombiezen.com/go/capnproto2/schemas"
-)
-
-type ConnectRequest struct{ capnp.Struct }
-
-// ConnectRequest_TypeID is the unique identifier for the type ConnectRequest.
-const ConnectRequest_TypeID = 0xc47116a1045e4061
-
-func NewConnectRequest(s *capnp.Segment) (ConnectRequest, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 2})
-	return ConnectRequest{st}, err
-}
-
-func NewRootConnectRequest(s *capnp.Segment) (ConnectRequest, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 8, PointerCount: 2})
-	return ConnectRequest{st}, err
-}
-
-func ReadRootConnectRequest(msg *capnp.Message) (ConnectRequest, error) {
-	root, err := msg.RootPtr()
-	return ConnectRequest{root.Struct()}, err
-}
-
-func (s ConnectRequest) String() string {
-	str, _ := text.Marshal(0xc47116a1045e4061, s.Struct)
-	return str
-}
-
-func (s ConnectRequest) Dest() (string, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.Text(), err
-}
-
-func (s ConnectRequest) HasDest() bool {
-	p, err := s.Struct.Ptr(0)
-	return p.IsValid() || err != nil
-}
-
-func (s ConnectRequest) DestBytes() ([]byte, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.TextBytes(), err
-}
-
-func (s ConnectRequest) SetDest(v string) error {
-	return s.Struct.SetText(0, v)
-}
-
-func (s ConnectRequest) Type() ConnectionType {
-	return ConnectionType(s.Struct.Uint16(0))
-}
-
-func (s ConnectRequest) SetType(v ConnectionType) {
-	s.Struct.SetUint16(0, uint16(v))
-}
-
-func (s ConnectRequest) Metadata() (Metadata_List, error) {
-	p, err := s.Struct.Ptr(1)
-	return Metadata_List{List: p.List()}, err
-}
-
-func (s ConnectRequest) HasMetadata() bool {
-	p, err := s.Struct.Ptr(1)
-	return p.IsValid() || err != nil
-}
-
-func (s ConnectRequest) SetMetadata(v Metadata_List) error {
-	return s.Struct.SetPtr(1, v.List.ToPtr())
-}
-
-// NewMetadata sets the metadata field to a newly
-// allocated Metadata_List, preferring placement in s's segment.
-func (s ConnectRequest) NewMetadata(n int32) (Metadata_List, error) {
-	l, err := NewMetadata_List(s.Struct.Segment(), n)
-	if err != nil {
-		return Metadata_List{}, err
-	}
-	err = s.Struct.SetPtr(1, l.List.ToPtr())
-	return l, err
-}
-
-// ConnectRequest_List is a list of ConnectRequest.
-type ConnectRequest_List struct{ capnp.List }
-
-// NewConnectRequest creates a new list of ConnectRequest.
-func NewConnectRequest_List(s *capnp.Segment, sz int32) (ConnectRequest_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 8, PointerCount: 2}, sz)
-	return ConnectRequest_List{l}, err
-}
-
-func (s ConnectRequest_List) At(i int) ConnectRequest { return ConnectRequest{s.List.Struct(i)} }
-
-func (s ConnectRequest_List) Set(i int, v ConnectRequest) error { return s.List.SetStruct(i, v.Struct) }
-
-func (s ConnectRequest_List) String() string {
-	str, _ := text.MarshalList(0xc47116a1045e4061, s.List)
-	return str
-}
-
-// ConnectRequest_Promise is a wrapper for a ConnectRequest promised by a client call.
-type ConnectRequest_Promise struct{ *capnp.Pipeline }
-
-func (p ConnectRequest_Promise) Struct() (ConnectRequest, error) {
-	s, err := p.Pipeline.Struct()
-	return ConnectRequest{s}, err
-}
-
-type ConnectionType uint16
-
-// ConnectionType_TypeID is the unique identifier for the type ConnectionType.
-const ConnectionType_TypeID = 0xc52e1bac26d379c8
-
-// Values of ConnectionType.
-const (
-	ConnectionType_http      ConnectionType = 0
-	ConnectionType_websocket ConnectionType = 1
-	ConnectionType_tcp       ConnectionType = 2
-)
-
-// String returns the enum's constant name.
-func (c ConnectionType) String() string {
-	switch c {
-	case ConnectionType_http:
-		return "http"
-	case ConnectionType_websocket:
-		return "websocket"
-	case ConnectionType_tcp:
-		return "tcp"
-
-	default:
-		return ""
-	}
-}
-
-// ConnectionTypeFromString returns the enum value with a name,
-// or the zero value if there's no such value.
-func ConnectionTypeFromString(c string) ConnectionType {
-	switch c {
-	case "http":
-		return ConnectionType_http
-	case "websocket":
-		return ConnectionType_websocket
-	case "tcp":
-		return ConnectionType_tcp
-
-	default:
-		return 0
-	}
-}
-
-type ConnectionType_List struct{ capnp.List }
-
-func NewConnectionType_List(s *capnp.Segment, sz int32) (ConnectionType_List, error) {
-	l, err := capnp.NewUInt16List(s, sz)
-	return ConnectionType_List{l.List}, err
-}
-
-func (l ConnectionType_List) At(i int) ConnectionType {
-	ul := capnp.UInt16List{List: l.List}
-	return ConnectionType(ul.At(i))
-}
-
-func (l ConnectionType_List) Set(i int, v ConnectionType) {
-	ul := capnp.UInt16List{List: l.List}
-	ul.Set(i, uint16(v))
-}
-
-type Metadata struct{ capnp.Struct }
-
-// Metadata_TypeID is the unique identifier for the type Metadata.
-const Metadata_TypeID = 0xe1446b97bfd1cd37
-
-func NewMetadata(s *capnp.Segment) (Metadata, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2})
-	return Metadata{st}, err
-}
-
-func NewRootMetadata(s *capnp.Segment) (Metadata, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2})
-	return Metadata{st}, err
-}
-
-func ReadRootMetadata(msg *capnp.Message) (Metadata, error) {
-	root, err := msg.RootPtr()
-	return Metadata{root.Struct()}, err
-}
-
-func (s Metadata) String() string {
-	str, _ := text.Marshal(0xe1446b97bfd1cd37, s.Struct)
-	return str
-}
-
-func (s Metadata) Key() (string, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.Text(), err
-}
-
-func (s Metadata) HasKey() bool {
-	p, err := s.Struct.Ptr(0)
-	return p.IsValid() || err != nil
-}
-
-func (s Metadata) KeyBytes() ([]byte, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.TextBytes(), err
-}
-
-func (s Metadata) SetKey(v string) error {
-	return s.Struct.SetText(0, v)
-}
-
-func (s Metadata) Val() (string, error) {
-	p, err := s.Struct.Ptr(1)
-	return p.Text(), err
-}
-
-func (s Metadata) HasVal() bool {
-	p, err := s.Struct.Ptr(1)
-	return p.IsValid() || err != nil
-}
-
-func (s Metadata) ValBytes() ([]byte, error) {
-	p, err := s.Struct.Ptr(1)
-	return p.TextBytes(), err
-}
-
-func (s Metadata) SetVal(v string) error {
-	return s.Struct.SetText(1, v)
-}
-
-// Metadata_List is a list of Metadata.
-type Metadata_List struct{ capnp.List }
-
-// NewMetadata creates a new list of Metadata.
-func NewMetadata_List(s *capnp.Segment, sz int32) (Metadata_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2}, sz)
-	return Metadata_List{l}, err
-}
-
-func (s Metadata_List) At(i int) Metadata { return Metadata{s.List.Struct(i)} }
-
-func (s Metadata_List) Set(i int, v Metadata) error { return s.List.SetStruct(i, v.Struct) }
-
-func (s Metadata_List) String() string {
-	str, _ := text.MarshalList(0xe1446b97bfd1cd37, s.List)
-	return str
-}
-
-// Metadata_Promise is a wrapper for a Metadata promised by a client call.
-type Metadata_Promise struct{ *capnp.Pipeline }
-
-func (p Metadata_Promise) Struct() (Metadata, error) {
-	s, err := p.Pipeline.Struct()
-	return Metadata{s}, err
-}
-
-type ConnectResponse struct{ capnp.Struct }
-
-// ConnectResponse_TypeID is the unique identifier for the type ConnectResponse.
-const ConnectResponse_TypeID = 0xb1032ec91cef8727
-
-func NewConnectResponse(s *capnp.Segment) (ConnectResponse, error) {
-	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2})
-	return ConnectResponse{st}, err
-}
-
-func NewRootConnectResponse(s *capnp.Segment) (ConnectResponse, error) {
-	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2})
-	return ConnectResponse{st}, err
-}
-
-func ReadRootConnectResponse(msg *capnp.Message) (ConnectResponse, error) {
-	root, err := msg.RootPtr()
-	return ConnectResponse{root.Struct()}, err
-}
-
-func (s ConnectResponse) String() string {
-	str, _ := text.Marshal(0xb1032ec91cef8727, s.Struct)
-	return str
-}
-
-func (s ConnectResponse) Error() (string, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.Text(), err
-}
-
-func (s ConnectResponse) HasError() bool {
-	p, err := s.Struct.Ptr(0)
-	return p.IsValid() || err != nil
-}
-
-func (s ConnectResponse) ErrorBytes() ([]byte, error) {
-	p, err := s.Struct.Ptr(0)
-	return p.TextBytes(), err
-}
-
-func (s ConnectResponse) SetError(v string) error {
-	return s.Struct.SetText(0, v)
-}
-
-func (s ConnectResponse) Metadata() (Metadata_List, error) {
-	p, err := s.Struct.Ptr(1)
-	return Metadata_List{List: p.List()}, err
-}
-
-func (s ConnectResponse) HasMetadata() bool {
-	p, err := s.Struct.Ptr(1)
-	return p.IsValid() || err != nil
-}
-
-func (s ConnectResponse) SetMetadata(v Metadata_List) error {
-	return s.Struct.SetPtr(1, v.List.ToPtr())
-}
-
-// NewMetadata sets the metadata field to a newly
-// allocated Metadata_List, preferring placement in s's segment.
-func (s ConnectResponse) NewMetadata(n int32) (Metadata_List, error) {
-	l, err := NewMetadata_List(s.Struct.Segment(), n)
-	if err != nil {
-		return Metadata_List{}, err
-	}
-	err = s.Struct.SetPtr(1, l.List.ToPtr())
-	return l, err
-}
-
-// ConnectResponse_List is a list of ConnectResponse.
-type ConnectResponse_List struct{ capnp.List }
-
-// NewConnectResponse creates a new list of ConnectResponse.
-func NewConnectResponse_List(s *capnp.Segment, sz int32) (ConnectResponse_List, error) {
-	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 2}, sz)
-	return ConnectResponse_List{l}, err
-}
-
-func (s ConnectResponse_List) At(i int) ConnectResponse { return ConnectResponse{s.List.Struct(i)} }
-
-func (s ConnectResponse_List) Set(i int, v ConnectResponse) error {
-	return s.List.SetStruct(i, v.Struct)
-}
-
-func (s ConnectResponse_List) String() string {
-	str, _ := text.MarshalList(0xb1032ec91cef8727, s.List)
-	return str
-}
-
-// ConnectResponse_Promise is a wrapper for a ConnectResponse promised by a client call.
-type ConnectResponse_Promise struct{ *capnp.Pipeline }
-
-func (p ConnectResponse_Promise) Struct() (ConnectResponse, error) {
-	s, err := p.Pipeline.Struct()
-	return ConnectResponse{s}, err
-}
-
-const schema_b29021ef7421cc32 = "x\xda\xb4\x91\xcfk\x13A\x1c\xc5\xdf\x9bI\xba\x1e\xa2" +
-	"\x9b!\xd5\x8b\x8a\xa4\xf8+ES\xdb(\xa2\xa7\x80\x15" +
-	"TZ\xcc\x14\xcf\x96u;\x98\x92vw\x92\x9dZ\xf2" +
-	"\x17x\x15/\xe2\xd1\xbb \x15<\x0b\xa2\xa0\xa2\x07\x11" +
-	"\xff\x80\xfe\x05=y\xf0\xb42)\xdb@)\x08Bo" +
-	"\xdfy<\xe6}\xbe\xdfW\xfd\xd5\x16\xb3\xe5\xc7\x04t" +
-	"\xb5<\x91_x\xbas\xeaKSnA5\x98\xcf}" +
-	"\xab\xbb\x9d\xfa\xb3\xb7(\x8b\x00\x98}\xf9\x95\xea]\x00" +
-	"\xa8\xadM0\x8f\xda\x0fK\xafN\xf4?B7\xb8\xdf" +
-	"\xda\xaa\xf3\x03k7\x18\x00\xb5k|\x03\xe6\x9f\x87?" +
-	"\xcf\xbf>\xd9\xfc\x04\xd5\x10c3\xd8\xda\xf6\xce?#" +
-	"\xe7o\xde\x07\xf3\xeb\xdf\x7f\xbc\x7f\xd1\x9b\xdf>\x80\xa0" +
-	"uT<g\xed\x9c\x1fku\xe1!\xfa\x1b\xab\xf1L" +
-	"\x16w'\xccz4\xe3\x1f\xcb\xeb\xc6E+\x91\x8b\x96" +
-	"\xed ui\x9c\xae5\xe3\xc8&\xf6\xe6\xad4IL" +
-	"\xec\x96Lf\xd3$3@\x87\xd4Gd\x09(\x11P" +
-	"\x8d9@\x9f\x95\xd4W\x04\x159I/^\xbe\x07\xe8" +
-	"K\x92\xfa\x8e\xe0\x193\x18\xa4\x03V X\x01\xf3\"" +
-	"\x06\x00\x8f\x81\x1dIV\xc7\xe8\xa0\x17\xff\x87\xae\xbfa" +
-	"27b\xab\xec\xb1\xdd\x9e\x06t[R/\x08\x16h" +
-	"w\xbd6/\xa9;\x82Jp\x92\x02P\x8b\x9ewA" +
-	"Rw\x05\xc3\x15\x93\xb9\x027tCk\x18\x8e[\x00" +
-	"\x19\x1e\xda\x16\xabi\xf2`h\xcd\xee\x16#\xb0\xd3\xd3" +
-	"\xfe3u|\x09\xa0Pj\x0a\x08\xbb\xce\xd9|\xd3<" +
-	"\xca\xd2\xb8g@\x17\xb8\xd8\xeeE\x95\xff\x19\xb5\xb8\xab" +
-	"3\xdaW\xe3\xd4A5z\xf1\xa2\xa4\xbe*\x18\xf4\xcc" +
-	"\xb0\xb8J\xf0$Z+\xe6\xbf\x01\x00\x00\xff\xff\xf5\xed" +
-	"\xc9\xfe"
-
-func init() {
-	schemas.Register(schema_b29021ef7421cc32,
-		0xb1032ec91cef8727,
-		0xc47116a1045e4061,
-		0xc52e1bac26d379c8,
-		0xe1446b97bfd1cd37)
-}
@@ -278,7 +278,7 @@ func GetAppInfo(reqURL *url.URL) (*AppInfo, error) {
 		// 403/401 from the edge will have aud in a header
 		aud = audHeader
 	} else {
-		return nil, fmt.Errorf("failed to find Access application at %s", reqURL.String())
+		return nil, fmt.Errorf("failed to get Access app info for %s", reqURL.String())
 	}

 	domain := resp.Header.Get(appDomainHeader)
@@ -15,7 +15,7 @@ import (
 )

 const (
-	baseStoreURL  = "https://login.cloudflareaccess.org/"
+	baseStoreURL  = "https://login.argotunnel.com/"
 	clientTimeout = time.Second * 60
 )

@@ -83,13 +83,11 @@ func buildRequestURL(baseURL *url.URL, key, value string, cli, useHostOnly bool)
 	if useHostOnly {
 		baseURL.Path = ""
 	}
-	// TODO: pass arg for tunnel login
 	if !cli {
 		return baseURL.String(), nil
 	}
 	q.Set("redirect_url", baseURL.String()) // we add the token as a query param on both the redirect_url and the main url
 	q.Set("send_org_token", "true")         // indicates that the cli endpoint should return both the org and app token
-	q.Set("edge_token_transfer", "true")    // use new LoginHelper service built on workers
 	baseURL.RawQuery = q.Encode()           // and this actual baseURL.
 	baseURL.Path = "cdn-cgi/access/cli"
 	return baseURL.String(), nil
@@ -105,6 +103,9 @@ func transferRequest(requestURL string, log *zerolog.Logger) ([]byte, string, er
 		if err != nil {
 			return nil, "", err
 		} else if len(buf) > 0 {
+			if err := putSuccess(client, requestURL); err != nil {
+				log.Err(err).Msg("Failed to update resource success")
+			}
 			return buf, key, nil
 		}
 	}
@@ -135,3 +136,22 @@ func poll(client *http.Client, requestURL string, log *zerolog.Logger) ([]byte,
 	}
 	return buf.Bytes(), resp.Header.Get("service-public-key"), nil
 }
+
+// putSuccess tells the server we successfully downloaded the resource
+func putSuccess(client *http.Client, requestURL string) error {
+	req, err := http.NewRequest("PUT", requestURL+"/ok", nil)
+	if err != nil {
+		return err
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+
+	resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return fmt.Errorf("HTTP Response Status Code: %d", resp.StatusCode)
+	}
+	return nil
+}
@@ -81,32 +81,27 @@ type RouteResult interface {
 }

 type DNSRoute struct {
-	userHostname      string
-	overwriteExisting bool
+	userHostname string
 }

 type DNSRouteResult struct {
 	route *DNSRoute
 	CName Change `json:"cname"`
-	Name  string `json:"name"`
 }

-func NewDNSRoute(userHostname string, overwriteExisting bool) Route {
+func NewDNSRoute(userHostname string) Route {
 	return &DNSRoute{
-		userHostname:      userHostname,
-		overwriteExisting: overwriteExisting,
+		userHostname: userHostname,
 	}
 }

 func (dr *DNSRoute) MarshalJSON() ([]byte, error) {
 	s := struct {
-		Type              string `json:"type"`
-		UserHostname      string `json:"user_hostname"`
-		OverwriteExisting bool   `json:"overwrite_existing"`
+		Type         string `json:"type"`
+		UserHostname string `json:"user_hostname"`
 	}{
-		Type:              dr.RecordType(),
-		UserHostname:      dr.userHostname,
-		OverwriteExisting: dr.overwriteExisting,
+		Type:         dr.RecordType(),
+		UserHostname: dr.userHostname,
 	}
 	return json.Marshal(&s)
 }
@@ -136,16 +131,7 @@ func (res *DNSRouteResult) SuccessSummary() string {
 	case ChangeUnchanged:
 		msgFmt = "%s is already configured to route to your tunnel"
 	}
-	return fmt.Sprintf(msgFmt, res.hostname())
-}
-
-// hostname yields the resulting name for the DNS route; if that is not available from Cloudflare API, then the
-// requested name is returned instead (should not be the common path, it is just a fall-back).
-func (res *DNSRouteResult) hostname() string {
-	if res.Name != "" {
-		return res.Name
-	}
-	return res.route.userHostname
+	return fmt.Sprintf(msgFmt, res.route.userHostname)
 }

 type LBRoute struct {
Author	SHA1	Message	Date
Adam Chalmers	a4097ee1c6	Release 2021.5.2	2021-05-13 17:31:00 -05:00
Areg Harutyunyan	0aca9d5c23	Setup a Github action for checking the cloudflared build	2021-05-13 01:43:08 +01:00
Adam Chalmers	21efb39a9d	Release 2021.5.1	2021-05-12 12:42:15 -05:00
Adam Chalmers	736a1f1b58	Release 2021.5.0	2021-05-11 19:26:05 +00:00
Nuno Diegues	1274da091a	TUN-4342: Fix false positive warning about unused hostname property	2021-05-11 06:55:59 +00:00
Michael Borkenstein	ea54ed62ba	AUTH-3537: AUDs in JWTs are now always arrays	2021-05-10 20:37:24 +00:00
Adam Chalmers	4f362c97f6	TUN-4384: Silence log from automaxprocs	2021-05-10 13:33:47 -05:00
Adam Chalmers	f5f9efa459	TUN-4359: Warn about unused keys in 'tunnel ingress validate'	2021-05-06 17:29:18 -05:00
Adam Chalmers	3dc095b4ce	TUN-4357: Bump Go to 1.16	2021-05-06 20:53:32 +00:00
Adam Chalmers	76a1997b82	TUN-4356: Set AUTOMAXPROCS to the CPU limit when running in a Linux container	2021-05-06 15:08:50 -05:00
Adam Chalmers	c010e10f7c	TUN-4343: Fix broken build by setting debug field correctly	2021-05-03 16:46:43 -05:00
Daniel Hwang	c605780c95	debug: log host / path to help understand why the ingress rule logged is being selected. in addition, combine "Request Headers..." and "Serving with ingress..." logs into this updated log. Co-authored-by: Silver <sssilver@users.noreply.github.com>	2021-05-03 15:47:42 +01:00
abelinkinbio	336dd7cd10	TUN-4000: Release notes for cloudflared replica model	2021-04-30 16:21:17 -05:00