Release 2023.2.0

2026-08-07 15:24:46 +00:00 · 2023-02-01 08:19:54 +00:00
416 changed files with 4419 additions and 32212 deletions
@@ -9,10 +9,10 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Install Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v2
      with:
        go-version: ${{ matrix.go-version }}
    - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2
    - name: Test
      run: make test
@@ -3,6 +3,7 @@
 set -euo pipefail

 FILENAME="${PWD}/artifacts/cloudflared-darwin-amd64.tgz"
+
 if ! VERSION="$(git describe --tags --exact-match 2>/dev/null)" ; then
    echo "Skipping public release for an untagged commit."
    echo "##teamcity[buildStatus status='SUCCESS' text='Skipped due to lack of tag']"
@@ -14,24 +15,24 @@ if [[ ! -f "$FILENAME" ]] ; then
    exit 1
 fi

-if [[ "${GITHUB_PRIVATE_KEY_B64:-}" == "" ]] ; then
-    echo "Missing GITHUB_PRIVATE_KEY_B64"
+if [[ "${GITHUB_PRIVATE_KEY:-}" == "" ]] ; then
+    echo "Missing GITHUB_PRIVATE_KEY"
    exit 1
 fi

 # upload to s3 bucket for use by Homebrew formula
 s3cmd \
-    --acl-public --access_key="$AWS_ACCESS_KEY_ID" --secret_key="$AWS_SECRET_ACCESS_KEY" --host-bucket="%(bucket)s.s3.cfdata.org" \
+    --acl-public --signature-v2 --access_key="$AWS_ACCESS_KEY_ID" --secret_key="$AWS_SECRET_ACCESS_KEY" --host-bucket="%(bucket)s.s3.cfdata.org" \
    put "$FILENAME" "s3://cftunnel-docs/dl/cloudflared-$VERSION-darwin-amd64.tgz"
 s3cmd \
-    --acl-public --access_key="$AWS_ACCESS_KEY_ID" --secret_key="$AWS_SECRET_ACCESS_KEY" --host-bucket="%(bucket)s.s3.cfdata.org" \
+    --acl-public --signature-v2 --access_key="$AWS_ACCESS_KEY_ID" --secret_key="$AWS_SECRET_ACCESS_KEY" --host-bucket="%(bucket)s.s3.cfdata.org" \
    cp "s3://cftunnel-docs/dl/cloudflared-$VERSION-darwin-amd64.tgz" "s3://cftunnel-docs/dl/cloudflared-stable-darwin-amd64.tgz"
 SHA256=$(sha256sum "$FILENAME" | cut -b1-64)

 # set up git (note that UserKnownHostsFile is an absolute path so we can cd wherever)
 mkdir -p tmp
 ssh-keyscan -t rsa github.com > tmp/github.txt
-echo "$GITHUB_PRIVATE_KEY_B64" | base64 --decode > tmp/private.key
+echo "$GITHUB_PRIVATE_KEY" > tmp/private.key
 chmod 0400 tmp/private.key
 export GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=$PWD/tmp/github.txt -i $PWD/tmp/private.key -o IdentitiesOnly=yes"

@@ -1,35 +1,6 @@
-## 2023.4.1
-### New Features
- You can now stream your logs from your remote cloudflared to your local terminal with `cloudflared tail <TUNNEL-ID>`. This new feature requires the remote cloudflared to be version 2023.4.1 or higher.
-
-## 2023.3.2
-### Notices
- Due to the nature of QuickTunnels (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/do-more-with-tunnels/trycloudflare/) and its intended usage for testing and experiment of Cloudflare Tunnels, starting from 2023.3.2, QuickTunnels only make a single connection to the edge. If users want to use Tunnels in a production environment, they should move to Named Tunnels instead. (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/remote/#set-up-a-tunnel-remotely-dashboard-setup)
-
-## 2023.3.1
-### Breaking Change
- Running a tunnel without ingress rules defined in configuration file nor from the CLI flags will no longer provide a default ingress rule to localhost:8080 and instead will return HTTP response code 503 for all incoming HTTP requests.
-
-### Security Fixes
- Windows 32 bit machines MSI now defaults to Program Files to install cloudflared. (See CVE-2023-1314). The cloudflared client itself is unaffected. This just changes how the installer works on 32 bit windows machines.
-
-### Bug Fixes
- Fixed a bug that would cause running tunnel on Bastion mode and without ingress rules to crash.
-
-## 2023.2.2
-### Notices
- Legacy tunnels were officially deprecated on December 1, 2022. Starting with this version, cloudflared no longer supports connecting legacy tunnels.
- h2mux tunnel connection protocol is no longer supported. Any tunnels still configured to use this protocol will alert and use http2 tunnel protocol instead. We recommend using quic protocol for all tunnels going forward.
-
-## 2023.2.1
-### Bug fixes
- Fixed a bug in TCP connection proxy that could result in the connection being closed before all data was written.
- cloudflared now correctly aborts body write if connection to origin service fails after response headers were sent already.
- Fixed a bug introduced in the previous release where debug endpoints were removed.
-
 ## 2022.12.0
 ### Improvements
- cloudflared now attempts to try other edge addresses before falling back to a lower protocol.
+- cloudflared now attempts to try other edge addresses before falling back to a lower protoocol.
 - cloudflared tunnel no longer spins up a quick tunnel. The call has to be explicit and provide a --url flag.
 - cloudflared will now randomly pick the first or second region to connect to instead of always connecting to region2 first.

@@ -82,8 +82,6 @@ else ifeq ($(LOCAL_OS),windows)
    TARGET_OS ?= windows
 else ifeq ($(LOCAL_OS),freebsd)
    TARGET_OS ?= freebsd
-else ifeq ($(LOCAL_OS),openbsd)
-    TARGET_OS ?= openbsd
 else
    $(error This system's OS $(LOCAL_OS) isn't supported)
 endif
@@ -1,73 +1,13 @@
-2023.4.2
- 2023-04-24 TUN-7133: Add sampling support for streaming logs
- 2023-04-21 TUN-7141: Add component tests for streaming logs
- 2023-04-21 TUN-7373: Streaming logs override for same actor
- 2023-04-20 TUN-7383: Bump requirements.txt
- 2023-04-19 TUN-7361: Add a label to override hostname
- 2023-04-19 TUN-7378: Remove RPC debug logs
- 2023-04-18 TUN-7360: Add Get Host Details handler in management service
- 2023-04-17 AUTH-3122 Verify that Access tokens are still valid in curl command
- 2023-04-17 TUN-7129: Categorize TCP logs for streaming logs
- 2023-04-17 TUN-7130: Categorize UDP logs for streaming logs
- 2023-04-10 AUTH-4887 Add aud parameter to token transfer url
+2023.2.0
+- 2023-01-31 TUN-7147: Revert wrong removal of debug endpoint from metrics port
+- 2023-01-30 TUN-7146: Avoid data race in closing origin connection too early
+- 2023-01-22 TUN-7097: Fix bug checking proxy-dns config on tunnel cmd execution
+- 2023-01-20 ZTC-446: Allow to force delete a vnet
+- 2023-01-17 TUN-7077: Specific name in cloudflare tunnel route lb command
+- 2023-01-16 TUN-7073: Fix propagating of bad stream request from origin to downstream
+- 2023-01-11 TUN-7065: Remove classic tunnel creation
+- 2023-01-10 TUN-7066: Bump coredns to v1.10.0

-2023.4.1
- 2023-04-13 TUN-7368: Report destination address for TCP requests in logs
- 2023-04-12 TUN-7134: Acquire token for cloudflared tail
- 2023-04-12 TUN-7131: Add cloudflared log event to connection messages and enable streaming logs
- 2023-04-11 TUN-7132 TUN-7136: Add filter support for streaming logs
- 2023-04-06 TUN-7354: Don't warn for empty ingress rules when using --token
- 2023-04-06 TUN-7128: Categorize logs from public hostname locations
- 2023-04-06 TUN-7351: Add streaming logs session ping and timeout
- 2023-04-06 TUN-7335: Fix cloudflared update not working in windows
-
-2023.4.0
- 2023-04-07 TUN-7356: Bump golang.org/x/net package to 0.7.0
- 2023-04-07 TUN-7357: Bump to go 1.19.6
- 2023-04-06 TUN-7127: Disconnect logger level requirement for management
- 2023-04-05 TUN-7332: Remove legacy tunnel force flag
- 2023-04-05 TUN-7135: Add cloudflared tail
- 2023-04-04 Add suport for OpenBSD (#916)
- 2023-04-04 Fix typo (#918)
- 2023-04-04 TUN-7125: Add management streaming logs WebSocket protocol
- 2023-03-30 TUN-9999: Remove classic tunnel component tests
- 2023-03-30 TUN-7126: Add Management logger io.Writer
- 2023-03-29 TUN-7324: Add http.Hijacker to connection.ResponseWriter
- 2023-03-29 TUN-7333: Default features checkable at runtime across all packages
- 2023-03-21 TUN-7124: Add intercept ingress rule for management requests
-
-2023.3.1
- 2023-03-13 TUN-7271: Return 503 status code when no ingress rules configured
- 2023-03-10 TUN-7272: Fix cloudflared returning non supported status service which breaks configuration migration
- 2023-03-09 TUN-7259: Add warning for missing ingress rules
- 2023-03-09 TUN-7268: Default to Program Files as location for win32
- 2023-03-07 TUN-7252: Remove h2mux connection
- 2023-03-07 TUN-7253: Adopt http.ResponseWriter for connection.ResponseWriter
- 2023-03-06 TUN-7245: Add bastion flag to origin service check
- 2023-03-06 EDGESTORE-108: Remove deprecated s3v2 signature
- 2023-03-02 TUN-7226: Fixed a missed rename
-
-2023.3.0
- 2023-03-01 GH-352: Add Tunnel CLI option "edge-bind-address" (#870)
- 2023-03-01 Fixed WIX template to allow MSI upgrades (#838)
- 2023-02-28 TUN-7213: Decode Base64 encoded key before writing it
- 2023-02-28 check.yaml: update actions to v3 (#876)
- 2023-02-27 TUN-7213: Debug homebrew-cloudflare  build
- 2023-02-15 RTG-2476 Add qtls override for Go 1.20
-
-2023.2.2
- 2023-02-22 TUN-7197: Add connIndex tag to debug messages of incoming requests
- 2023-02-08 TUN-7167: Respect protocol overrides with --token
- 2023-02-06 TUN-7065: Remove classic tunnel creation
- 2023-02-06 TUN-6938: Force h2mux protocol to http2 for named tunnels
- 2023-02-06 TUN-6938: Provide QUIC as first in protocol list
- 2023-02-03 TUN-7158: Correct TCP tracing propagation
- 2023-02-01 TUN-7151: Update changes file with latest release notices
-
-2023.2.1
- 2023-02-01 TUN-7065: Revert Ingress Rule check for named tunnel configurations
- 2023-02-01 Revert "TUN-7065: Revert Ingress Rule check for named tunnel configurations"
- 2023-02-01 Revert "TUN-7065: Remove classic tunnel creation"
 2023.1.0
 - 2023-01-10 TUN-7064: RPM digests are now sha256 instead of md5sum
 - 2023-01-04 RTG-2418 Update qtls
@@ -0,0 +1,58 @@
+package certutil
+
+import (
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+)
+
+type namedTunnelToken struct {
+	ZoneID    string `json:"zoneID"`
+	AccountID string `json:"accountID"`
+	APIToken  string `json:"apiToken"`
+}
+
+type OriginCert struct {
+	ZoneID    string
+	APIToken  string
+	AccountID string
+}
+
+func DecodeOriginCert(blocks []byte) (*OriginCert, error) {
+	if len(blocks) == 0 {
+		return nil, fmt.Errorf("Cannot decode empty certificate")
+	}
+	originCert := OriginCert{}
+	block, rest := pem.Decode(blocks)
+	for {
+		if block == nil {
+			break
+		}
+		switch block.Type {
+		case "PRIVATE KEY", "CERTIFICATE":
+			// this is for legacy purposes.
+			break
+		case "ARGO TUNNEL TOKEN":
+			if originCert.ZoneID != "" || originCert.APIToken != "" {
+				return nil, fmt.Errorf("Found multiple tokens in the certificate")
+			}
+			// The token is a string,
+			// Try the newer JSON format
+			ntt := namedTunnelToken{}
+			if err := json.Unmarshal(block.Bytes, &ntt); err == nil {
+				originCert.ZoneID = ntt.ZoneID
+				originCert.APIToken = ntt.APIToken
+				originCert.AccountID = ntt.AccountID
+			}
+		default:
+			return nil, fmt.Errorf("Unknown block %s in the certificate", block.Type)
+		}
+		block, rest = pem.Decode(rest)
+	}
+
+	if originCert.ZoneID == "" || originCert.APIToken == "" {
+		return nil, fmt.Errorf("Missing token in the certificate")
+	}
+
+	return &originCert, nil
+}
@@ -0,0 +1,51 @@
+package certutil
+
+import (
+	"fmt"
+	"io/ioutil"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLoadOriginCert(t *testing.T) {
+	cert, err := DecodeOriginCert([]byte{})
+	assert.Equal(t, fmt.Errorf("Cannot decode empty certificate"), err)
+	assert.Nil(t, cert)
+
+	blocks, err := ioutil.ReadFile("test-cert-unknown-block.pem")
+	assert.Nil(t, err)
+	cert, err = DecodeOriginCert(blocks)
+	assert.Equal(t, fmt.Errorf("Unknown block RSA PRIVATE KEY in the certificate"), err)
+	assert.Nil(t, cert)
+}
+
+func TestJSONArgoTunnelTokenEmpty(t *testing.T) {
+	cert, err := DecodeOriginCert([]byte{})
+	blocks, err := ioutil.ReadFile("test-cert-no-token.pem")
+	assert.Nil(t, err)
+	cert, err = DecodeOriginCert(blocks)
+	assert.Equal(t, fmt.Errorf("Missing token in the certificate"), err)
+	assert.Nil(t, cert)
+}
+
+func TestJSONArgoTunnelToken(t *testing.T) {
+	// The given cert's Argo Tunnel Token was generated by base64 encoding this JSON:
+	// {
+	// "zoneID": "7b0a4d77dfb881c1a3b7d61ea9443e19",
+	// "apiToken": "test-service-key",
+	// "accountID": "abcdabcdabcdabcd1234567890abcdef"
+	// }
+	CloudflareTunnelTokenTest(t, "test-cloudflare-tunnel-cert-json.pem")
+}
+
+func CloudflareTunnelTokenTest(t *testing.T, path string) {
+	blocks, err := ioutil.ReadFile(path)
+	assert.Nil(t, err)
+	cert, err := DecodeOriginCert(blocks)
+	assert.Nil(t, err)
+	assert.NotNil(t, cert)
+	assert.Equal(t, "7b0a4d77dfb881c1a3b7d61ea9443e19", cert.ZoneID)
+	key := "test-service-key"
+	assert.Equal(t, key, cert.APIToken)
+}
@@ -8,7 +8,6 @@ type TunnelClient interface {
 	CreateTunnel(name string, tunnelSecret []byte) (*TunnelWithToken, error)
 	GetTunnel(tunnelID uuid.UUID) (*Tunnel, error)
 	GetTunnelToken(tunnelID uuid.UUID) (string, error)
-	GetManagementToken(tunnelID uuid.UUID) (string, error)
 	DeleteTunnel(tunnelID uuid.UUID) error
 	ListTunnels(filter *TunnelFilter) ([]*Tunnel, error)
 	ListActiveClients(tunnelID uuid.UUID) ([]*ActiveClient, error)
@@ -50,10 +50,6 @@ type newTunnel struct {
 	TunnelSecret []byte `json:"tunnel_secret"`
 }

-type managementRequest struct {
-	Resources []string `json:"resources"`
-}
-
 type CleanupParams struct {
 	queryParams url.Values
 }
@@ -137,28 +133,6 @@ func (r *RESTClient) GetTunnelToken(tunnelID uuid.UUID) (token string, err error
 	return "", r.statusCodeToError("get tunnel token", resp)
 }

-func (r *RESTClient) GetManagementToken(tunnelID uuid.UUID) (token string, err error) {
-	endpoint := r.baseEndpoints.accountLevel
-	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v/management", tunnelID))
-
-	body := &managementRequest{
-		Resources: []string{"logs"},
-	}
-
-	resp, err := r.sendRequest("POST", endpoint, body)
-	if err != nil {
-		return "", errors.Wrap(err, "REST request failed")
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusOK {
-		err = parseResponse(resp.Body, &token)
-		return token, err
-	}
-
-	return "", r.statusCodeToError("get tunnel token", resp)
-}
-
 func (r *RESTClient) DeleteTunnel(tunnelID uuid.UUID) error {
 	endpoint := r.baseEndpoints.accountLevel
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v", tunnelID))
@@ -1,5 +1,5 @@
-pinned_go: &pinned_go go=1.19.6-1
-pinned_go_fips: &pinned_go_fips go-boring=1.19.6-1
+pinned_go: &pinned_go go=1.19.3-1
+pinned_go_fips: &pinned_go_fips go-boring=1.19.3-1

 build_dir: &build_dir /cfsetup_build
 default-flavor: bullseye
@@ -1,64 +1,62 @@
 <?xml version="1.0"?>

-<?if $(var.Platform)="x64" ?>
-    <?define Program_Files="ProgramFiles64Folder"?>
-<?else ?>
+<?if $(var.Platform)="x86"?>
    <?define Program_Files="ProgramFilesFolder"?>
-<?endif ?>
+<?else?>
+    <?define Program_Files="ProgramFiles64Folder"?>
+<?endif?>
 <?ifndef var.Version?>
    <?error Undefined Version variable?>
-<?endif ?>
+<?endif?>
 <?ifndef var.Path?>
    <?error Undefined Path variable?>
-<?endif ?>
+<?endif?>

 <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
-    <Product Id="*"
+    <Product Id="35e5e858-9372-4449-bf73-1cd6f7267128" 
        UpgradeCode="23f90fdd-9328-47ea-ab52-5380855a4b12"
        Name="cloudflared"
        Version="$(var.Version)"
        Manufacturer="cloudflare"
        Language="1033">

-        <Package InstallerVersion="200" Compressed="yes" Comments="Windows Installer Package" InstallScope="perMachine" />
+      <Package InstallerVersion="200" Compressed="yes" Comments="Windows Installer Package" InstallScope="perMachine"/>

-        <Media Id="1" Cabinet="product.cab" EmbedCab="yes" />
+      <Media Id="1" Cabinet="product.cab" EmbedCab="yes"/>

-        <MajorUpgrade DowngradeErrorMessage="A later version of [ProductName] is already installed. Setup will now exit." />
+      <Upgrade Id="23f90fdd-9328-47ea-ab52-5380855a4b12">
+         <UpgradeVersion Minimum="$(var.Version)" OnlyDetect="yes" Property="NEWERVERSIONDETECTED"/>
+         <UpgradeVersion Minimum="2020.8.0" Maximum="$(var.Version)" IncludeMinimum="yes" IncludeMaximum="no"
+                         Property="OLDERVERSIONBEINGUPGRADED"/>
+      </Upgrade>
+      <Condition Message="A newer version of this software is already installed.">NOT NEWERVERSIONDETECTED</Condition>

-        <Upgrade Id="23f90fdd-9328-47ea-ab52-5380855a4b12">
-            <UpgradeVersion Minimum="$(var.Version)" OnlyDetect="yes" Property="NEWERVERSIONDETECTED" />
-            <UpgradeVersion Minimum="2020.8.0" Maximum="$(var.Version)" IncludeMinimum="yes" IncludeMaximum="no"
-                Property="OLDERVERSIONBEINGUPGRADED" />
-        </Upgrade>
-        <Condition Message="A newer version of this software is already installed.">NOT NEWERVERSIONDETECTED</Condition>
-
-        <Directory Id="TARGETDIR" Name="SourceDir">
-            <!--This specifies where the cloudflared.exe is moved to in the windows Operation System-->
-            <Directory Id="$(var.Program_Files)">
-                <Directory Id="INSTALLDIR" Name="cloudflared">
-                    <Component Id="ApplicationFiles" Guid="35e5e858-9372-4449-bf73-1cd6f7267128">
-                        <File Id="ApplicationFile0" Source="$(var.Path)" />
-                    </Component>
-                </Directory>
+    <Directory Id="TARGETDIR" Name="SourceDir">
+        <!--This specifies where the cloudflared.exe is moved to in the windows Operation System-->
+        <Directory Id="$(var.Program_Files)">
+            <Directory Id="INSTALLDIR" Name="cloudflared">
+                <Component Id="ApplicationFiles" Guid="35e5e858-9372-4449-bf73-1cd6f7267128">
+                    <File Id="ApplicationFile0" Source="$(var.Path)"/>
+                </Component>
            </Directory>
-            <Component Id="ENVS" Guid="6bb74449-d10d-4f4a-933e-6fc9fa006eae">
-                <!--Set the cloudflared bin location to the Path Environment Variable-->
-                <Environment Id="ENV0"
-                    Name="PATH"
-                    Value="[INSTALLDIR]."
-                    Permanent="no"
-                    Part="last"
-                    Action="create"
-                    System="yes" />
-            </Component>
        </Directory>
+        <Component Id="ENVS" Guid="6bb74449-d10d-4f4a-933e-6fc9fa006eae">
+        <!--Set the cloudflared bin location to the Path Environment Variable-->
+         <Environment Id="ENV0"
+           Name="PATH"
+           Value="[INSTALLDIR]."
+           Permanent="no"
+           Part="last"
+           Action="create"
+           System="yes" />
+        </Component>
+    </Directory>


-        <Feature Id='Complete' Level='1'>
-            <ComponentRef Id="ENVS" />
-            <ComponentRef Id='ApplicationFiles' />
-        </Feature>
+    <Feature Id='Complete' Level='1'>
+      <ComponentRef Id="ENVS"/>
+      <ComponentRef Id='ApplicationFiles' />
+    </Feature>

    </Product>
 </Wix>
@@ -280,13 +280,6 @@ func curl(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-
-	// Verify that the existing token is still good; if not fetch a new one
-	if err := verifyTokenAtEdge(appURL, appInfo, c, log); err != nil {
-		log.Err(err).Msg("Could not verify token")
-		return err
-	}
-
 	tok, err := token.GetAppTokenIfExists(appInfo)
 	if err != nil || tok == "" {
 		if allowRequest {
@@ -47,7 +47,3 @@ func (bi *BuildInfo) GetBuildTypeMsg() string {
 	}
 	return fmt.Sprintf(" with %s", bi.BuildType)
 }
-
-func (bi *BuildInfo) UserAgent() string {
-	return fmt.Sprintf("cloudflared/%s", bi.CloudflaredVersion)
-}
@@ -1,51 +0,0 @@
-package cliutil
-
-import (
-	"github.com/urfave/cli/v2"
-	"github.com/urfave/cli/v2/altsrc"
-
-	"github.com/cloudflare/cloudflared/logger"
-)
-
-var (
-	debugLevelWarning = "At debug level cloudflared will log request URL, method, protocol, content length, as well as, all request and response headers. " +
-		"This can expose sensitive information in your logs."
-)
-
-func ConfigureLoggingFlags(shouldHide bool) []cli.Flag {
-	return []cli.Flag{
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    logger.LogLevelFlag,
-			Value:   "info",
-			Usage:   "Application logging level {debug, info, warn, error, fatal}. " + debugLevelWarning,
-			EnvVars: []string{"TUNNEL_LOGLEVEL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    logger.LogTransportLevelFlag,
-			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
-			Value:   "info",
-			Usage:   "Transport logging level(previously called protocol logging level) {debug, info, warn, error, fatal}",
-			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    logger.LogFileFlag,
-			Usage:   "Save application log to this file for reporting issues.",
-			EnvVars: []string{"TUNNEL_LOGFILE"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    logger.LogDirectoryFlag,
-			Usage:   "Save application log to this directory for reporting issues.",
-			EnvVars: []string{"TUNNEL_LOGDIRECTORY"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "trace-output",
-			Usage:   "Name of trace output file, generated when cloudflared stops.",
-			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
-			Hidden:  shouldHide,
-		}),
-	}
-}
@@ -15,7 +15,6 @@ import (
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/access"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/proxydns"
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/tail"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/tunnel"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
 	"github.com/cloudflare/cloudflared/config"
@@ -90,7 +89,6 @@ func main() {
 	updater.Init(Version)
 	tracing.Init(Version)
 	token.Init(Version)
-	tail.Init(bInfo)
 	runApp(app, graceShutdownC)
 }

@@ -140,7 +138,6 @@ To determine if an update happened in a script, check for error code 11.`,
 	cmds = append(cmds, tunnel.Commands()...)
 	cmds = append(cmds, proxydns.Command(false))
 	cmds = append(cmds, access.Commands()...)
-	cmds = append(cmds, tail.Command())
 	return cmds
 }

@@ -1,395 +0,0 @@
-package tail
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/url"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/mattn/go-colorable"
-	"github.com/rs/zerolog"
-	"github.com/urfave/cli/v2"
-	"nhooyr.io/websocket"
-
-	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
-	"github.com/cloudflare/cloudflared/credentials"
-	"github.com/cloudflare/cloudflared/logger"
-	"github.com/cloudflare/cloudflared/management"
-)
-
-var (
-	buildInfo *cliutil.BuildInfo
-)
-
-func Init(bi *cliutil.BuildInfo) {
-	buildInfo = bi
-}
-
-func Command() *cli.Command {
-	subcommands := []*cli.Command{
-		buildTailManagementTokenSubcommand(),
-	}
-
-	return buildTailCommand(subcommands)
-}
-
-func buildTailManagementTokenSubcommand() *cli.Command {
-	return &cli.Command{
-		Name:        "token",
-		Action:      cliutil.ConfiguredAction(managementTokenCommand),
-		Usage:       "Get management access jwt",
-		UsageText:   "cloudflared tail token TUNNEL_ID",
-		Description: `Get management access jwt for a tunnel`,
-		Hidden:      true,
-	}
-}
-
-func managementTokenCommand(c *cli.Context) error {
-	log := createLogger(c)
-	token, err := getManagementToken(c, log)
-	if err != nil {
-		return err
-	}
-	var tokenResponse = struct {
-		Token string `json:"token"`
-	}{Token: token}
-
-	return json.NewEncoder(os.Stdout).Encode(tokenResponse)
-}
-
-func buildTailCommand(subcommands []*cli.Command) *cli.Command {
-	return &cli.Command{
-		Name:      "tail",
-		Action:    Run,
-		Usage:     "Stream logs from a remote cloudflared",
-		UsageText: "cloudflared tail [tail command options] [TUNNEL-ID]",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "connector-id",
-				Usage:   "Access a specific cloudflared instance by connector id (for when a tunnel has multiple cloudflared's)",
-				Value:   "",
-				EnvVars: []string{"TUNNEL_MANAGEMENT_CONNECTOR"},
-			},
-			&cli.StringSliceFlag{
-				Name:    "event",
-				Usage:   "Filter by specific Events (cloudflared, http, tcp, udp) otherwise, defaults to send all events",
-				EnvVars: []string{"TUNNEL_MANAGEMENT_FILTER_EVENTS"},
-			},
-			&cli.StringFlag{
-				Name:    "level",
-				Usage:   "Filter by specific log levels (debug, info, warn, error). Filters by debug log level by default.",
-				EnvVars: []string{"TUNNEL_MANAGEMENT_FILTER_LEVEL"},
-				Value:   "debug",
-			},
-			&cli.Float64Flag{
-				Name:    "sample",
-				Usage:   "Sample log events by percentage (0.0 .. 1.0). No sampling by default.",
-				EnvVars: []string{"TUNNEL_MANAGEMENT_FILTER_SAMPLE"},
-				Value:   1.0,
-			},
-			&cli.StringFlag{
-				Name:    "token",
-				Usage:   "Access token for a specific tunnel",
-				Value:   "",
-				EnvVars: []string{"TUNNEL_MANAGEMENT_TOKEN"},
-			},
-			&cli.StringFlag{
-				Name:    "management-hostname",
-				Usage:   "Management hostname to signify incoming management requests",
-				EnvVars: []string{"TUNNEL_MANAGEMENT_HOSTNAME"},
-				Hidden:  true,
-				Value:   "management.argotunnel.com",
-			},
-			&cli.StringFlag{
-				Name:   "trace",
-				Usage:  "Set a cf-trace-id for the request",
-				Hidden: true,
-				Value:  "",
-			},
-			&cli.StringFlag{
-				Name:    logger.LogLevelFlag,
-				Value:   "info",
-				Usage:   "Application logging level {debug, info, warn, error, fatal}",
-				EnvVars: []string{"TUNNEL_LOGLEVEL"},
-			},
-			&cli.StringFlag{
-				Name:    credentials.OriginCertFlag,
-				Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
-				EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
-				Value:   credentials.FindDefaultOriginCertPath(),
-			},
-		},
-		Subcommands: subcommands,
-	}
-}
-
-// Middleware validation error struct for returning to the eyeball
-type managementError struct {
-	Code    int    `json:"code,omitempty"`
-	Message string `json:"message,omitempty"`
-}
-
-// Middleware validation error HTTP response JSON for returning to the eyeball
-type managementErrorResponse struct {
-	Success bool              `json:"success,omitempty"`
-	Errors  []managementError `json:"errors,omitempty"`
-}
-
-func handleValidationError(resp *http.Response, log *zerolog.Logger) {
-	if resp.StatusCode == 530 {
-		log.Error().Msgf("no cloudflared connector available or reachable via management request (a recent version of cloudflared is required to use streaming logs)")
-	}
-	var managementErr managementErrorResponse
-	err := json.NewDecoder(resp.Body).Decode(&managementErr)
-	if err != nil {
-		log.Error().Msgf("unable to start management log streaming session: http response code returned %d", resp.StatusCode)
-		return
-	}
-	if managementErr.Success || len(managementErr.Errors) == 0 {
-		log.Error().Msgf("management tunnel validation returned success with invalid HTTP response code to convert to a WebSocket request")
-		return
-	}
-	for _, e := range managementErr.Errors {
-		log.Error().Msgf("management request failed validation: (%d) %s", e.Code, e.Message)
-	}
-}
-
-// logger will be created to emit only against the os.Stderr as to not obstruct with normal output from
-// management requests
-func createLogger(c *cli.Context) *zerolog.Logger {
-	level, levelErr := zerolog.ParseLevel(c.String(logger.LogLevelFlag))
-	if levelErr != nil {
-		level = zerolog.InfoLevel
-	}
-	log := zerolog.New(zerolog.ConsoleWriter{
-		Out:        colorable.NewColorable(os.Stderr),
-		TimeFormat: time.RFC3339,
-	}).With().Timestamp().Logger().Level(level)
-	return &log
-}
-
-// parseFilters will attempt to parse provided filters to send to with the EventStartStreaming
-func parseFilters(c *cli.Context) (*management.StreamingFilters, error) {
-	var level *management.LogLevel
-	var events []management.LogEventType
-	var sample float64
-
-	argLevel := c.String("level")
-	argEvents := c.StringSlice("event")
-	argSample := c.Float64("sample")
-
-	if argLevel != "" {
-		l, ok := management.ParseLogLevel(argLevel)
-		if !ok {
-			return nil, fmt.Errorf("invalid --level filter provided, please use one of the following Log Levels: debug, info, warn, error")
-		}
-		level = &l
-	}
-
-	for _, v := range argEvents {
-		t, ok := management.ParseLogEventType(v)
-		if !ok {
-			return nil, fmt.Errorf("invalid --event filter provided, please use one of the following EventTypes: cloudflared, http, tcp, udp")
-		}
-		events = append(events, t)
-	}
-
-	if argSample <= 0.0 || argSample > 1.0 {
-		return nil, fmt.Errorf("invalid --sample value provided, please make sure it is in the range (0.0 .. 1.0)")
-	}
-	sample = argSample
-
-	if level == nil && len(events) == 0 && argSample != 1.0 {
-		// When no filters are provided, do not return a StreamingFilters struct
-		return nil, nil
-	}
-
-	return &management.StreamingFilters{
-		Level:    level,
-		Events:   events,
-		Sampling: sample,
-	}, nil
-}
-
-// getManagementToken will make a call to the Cloudflare API to acquire a management token for the requested tunnel.
-func getManagementToken(c *cli.Context, log *zerolog.Logger) (string, error) {
-	userCreds, err := credentials.Read(c.String(credentials.OriginCertFlag), log)
-	if err != nil {
-		return "", err
-	}
-
-	client, err := userCreds.Client(c.String("api-url"), buildInfo.UserAgent(), log)
-	if err != nil {
-		return "", err
-	}
-
-	tunnelIDString := c.Args().First()
-	if tunnelIDString == "" {
-		return "", errors.New("no tunnel ID provided")
-	}
-	tunnelID, err := uuid.Parse(tunnelIDString)
-	if err != nil {
-		return "", errors.New("unable to parse provided tunnel id as a valid UUID")
-	}
-
-	token, err := client.GetManagementToken(tunnelID)
-	if err != nil {
-		return "", err
-	}
-
-	return token, nil
-}
-
-// buildURL will build the management url to contain the required query parameters to authenticate the request.
-func buildURL(c *cli.Context, log *zerolog.Logger) (url.URL, error) {
-	var err error
-	managementHostname := c.String("management-hostname")
-	token := c.String("token")
-	if token == "" {
-		token, err = getManagementToken(c, log)
-		if err != nil {
-			return url.URL{}, fmt.Errorf("unable to acquire management token for requested tunnel id: %w", err)
-		}
-	}
-	query := url.Values{}
-	query.Add("access_token", token)
-	connector := c.String("connector-id")
-	if connector != "" {
-		connectorID, err := uuid.Parse(connector)
-		if err != nil {
-			return url.URL{}, fmt.Errorf("unabled to parse 'connector-id' flag into a valid UUID: %w", err)
-		}
-		query.Add("connector_id", connectorID.String())
-	}
-	return url.URL{Scheme: "wss", Host: managementHostname, Path: "/logs", RawQuery: query.Encode()}, nil
-}
-
-// Run implements a foreground runner
-func Run(c *cli.Context) error {
-	log := createLogger(c)
-
-	signals := make(chan os.Signal, 10)
-	signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
-	defer signal.Stop(signals)
-
-	filters, err := parseFilters(c)
-	if err != nil {
-		log.Error().Err(err).Msgf("invalid filters provided")
-		return nil
-	}
-
-	u, err := buildURL(c, log)
-	if err != nil {
-		log.Err(err).Msg("unable to construct management request URL")
-		return nil
-	}
-
-	header := make(http.Header)
-	header.Add("User-Agent", buildInfo.UserAgent())
-	trace := c.String("trace")
-	if trace != "" {
-		header["cf-trace-id"] = []string{trace}
-	}
-	ctx := c.Context
-	conn, resp, err := websocket.Dial(ctx, u.String(), &websocket.DialOptions{
-		HTTPHeader: header,
-	})
-	if err != nil {
-		if resp != nil && resp.StatusCode != http.StatusSwitchingProtocols {
-			handleValidationError(resp, log)
-			return nil
-		}
-		log.Error().Err(err).Msgf("unable to start management log streaming session")
-		return nil
-	}
-	defer conn.Close(websocket.StatusInternalError, "management connection was closed abruptly")
-
-	// Once connection is established, send start_streaming event to begin receiving logs
-	err = management.WriteEvent(conn, ctx, &management.EventStartStreaming{
-		ClientEvent: management.ClientEvent{Type: management.StartStreaming},
-		Filters:     filters,
-	})
-	if err != nil {
-		log.Error().Err(err).Msg("unable to request logs from management tunnel")
-		return nil
-	}
-	log.Debug().
-		Str("tunnel-id", c.Args().First()).
-		Str("connector-id", c.String("connector-id")).
-		Interface("filters", filters).
-		Msg("connected")
-
-	readerDone := make(chan struct{})
-
-	go func() {
-		defer close(readerDone)
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			default:
-				event, err := management.ReadServerEvent(conn, ctx)
-				if err != nil {
-					if closeErr := management.AsClosed(err); closeErr != nil {
-						// If the client (or the server) already closed the connection, don't continue to
-						// attempt to read from the client.
-						if closeErr.Code == websocket.StatusNormalClosure {
-							return
-						}
-						// Only log abnormal closures
-						log.Error().Msgf("received remote closure: (%d) %s", closeErr.Code, closeErr.Reason)
-						return
-					}
-					log.Err(err).Msg("unable to read event from server")
-					return
-				}
-				switch event.Type {
-				case management.Logs:
-					logs, ok := management.IntoServerEvent(event, management.Logs)
-					if !ok {
-						log.Error().Msgf("invalid logs event")
-						continue
-					}
-					// Output all the logs received to stdout
-					for _, l := range logs.Logs {
-						fields, err := json.Marshal(l.Fields)
-						if err != nil {
-							fields = []byte("unable to parse fields")
-							log.Debug().Msgf("unable to parse fields from event %+v", l)
-						}
-						fmt.Printf("%s %s %s %s %s\n", l.Time, l.Level, l.Event, l.Message, fields)
-					}
-				case management.UnknownServerEventType:
-					fallthrough
-				default:
-					log.Debug().Msgf("unexpected log event type: %s", event.Type)
-				}
-			}
-		}
-	}()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return nil
-		case <-readerDone:
-			return nil
-		case <-signals:
-			log.Debug().Msg("closing management connection")
-			// Cleanly close the connection by sending a close message and then
-			// waiting (with timeout) for the server to close the connection.
-			conn.Close(websocket.StatusNormalClosure, "")
-			select {
-			case <-readerDone:
-			case <-time.After(time.Second):
-			}
-			return nil
-		}
-	}
-}
@@ -28,27 +28,19 @@ import (
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/connection"
-	"github.com/cloudflare/cloudflared/credentials"
-	"github.com/cloudflare/cloudflared/edgediscovery"
-	"github.com/cloudflare/cloudflared/features"
 	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/logger"
-	"github.com/cloudflare/cloudflared/management"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/orchestration"
 	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/supervisor"
 	"github.com/cloudflare/cloudflared/tlsconfig"
 	"github.com/cloudflare/cloudflared/tunneldns"
-	"github.com/cloudflare/cloudflared/validation"
 )

 const (
 	sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b:3e8827f6f9f740738eb11138f7bebb68@sentry.io/189878"

-	// ha-Connections specifies how many connections to make to the edge
-	haConnectionsFlag = "ha-connections"
-
 	// sshPortFlag is the port on localhost the cloudflared ssh server will run on
 	sshPortFlag = "local-ssh-port"

@@ -82,21 +74,23 @@ const (
 	// uiFlag is to enable launching cloudflared in interactive UI mode
 	uiFlag = "ui"

+	debugLevelWarning = "At debug level cloudflared will log request URL, method, protocol, content length, as well as, all request and response headers. " +
+		"This can expose sensitive information in your logs."
+
 	LogFieldCommand             = "command"
 	LogFieldExpandedPath        = "expandedPath"
 	LogFieldPIDPathname         = "pidPathname"
 	LogFieldTmpTraceFilename    = "tmpTraceFilename"
 	LogFieldTraceOutputFilepath = "traceOutputFilepath"

-	tunnelCmdErrorMessage = `You did not specify any valid additional argument to the cloudflared tunnel command.
+	tunnelCmdErrorMessage = `You did not specify any valid additional argument to the cloudflared tunnel command. 

-If you are trying to run a Quick Tunnel then you need to explicitly pass the --url flag.
-Eg. cloudflared tunnel --url localhost:8080/.
+If you are trying to run a Quick Tunnel then you need to explicitly pass the --url flag. 
+Eg. cloudflared tunnel --url localhost:8080/. 

-Please note that Quick Tunnels are meant to be ephemeral and should only be used for testing purposes.
+Please note that Quick Tunnels are meant to be ephemeral and should only be used for testing purposes. 
 For production usage, we recommend creating Named Tunnels. (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/)
 `
-	connectorLabelFlag = "label"
 )

 var (
@@ -183,46 +177,26 @@ func TunnelCommand(c *cli.Context) error {
 		return err
 	}

-	// Run a adhoc named tunnel
-	// Allows for the creation, routing (optional), and startup of a tunnel in one command
-	// --name required
-	// --url or --hello-world required
-	// --hostname optional
-	if name := c.String("name"); name != "" {
-		hostname, err := validation.ValidateHostname(c.String("hostname"))
-		if err != nil {
-			return errors.Wrap(err, "Invalid hostname provided")
-		}
-		url := c.String("url")
-		if url == hostname && url != "" && hostname != "" {
-			return fmt.Errorf("hostname and url shouldn't match. See --help for more information")
-		}
-
+	if name := c.String("name"); name != "" { // Start a named tunnel
 		return runAdhocNamedTunnel(sc, name, c.String(CredFileFlag))
 	}

-	// Run a quick tunnel
-	// A unauthenticated named tunnel hosted on <random>.<quick-tunnels-service>.com
-	// We don't support running proxy-dns and a quick tunnel at the same time as the same process
-	shouldRunQuickTunnel := c.IsSet("url") || c.IsSet(ingress.HelloWorldFlag)
-	if !c.IsSet("proxy-dns") && c.String("quick-service") != "" && shouldRunQuickTunnel {
+	// Unauthenticated named tunnel on <random>.<quick-tunnels-service>.com
+	shouldRunQuickTunnel := c.IsSet("url") || c.IsSet("hello-world")
+	if !dnsProxyStandAlone(c, nil) && c.String("quick-service") != "" && shouldRunQuickTunnel {
 		return RunQuickTunnel(sc)
 	}

-	// If user provides a config, check to see if they meant to use `tunnel run` instead
 	if ref := config.GetConfiguration().TunnelID; ref != "" {
 		return fmt.Errorf("Use `cloudflared tunnel run` to start tunnel %s", ref)
 	}

-	// Classic tunnel usage is no longer supported
+	// classic tunnel usage is no longer supported
 	if c.String("hostname") != "" {
 		return deprecatedClassicTunnelErr
 	}

 	if c.IsSet("proxy-dns") {
-		if shouldRunQuickTunnel {
-			return fmt.Errorf("running a quick tunnel with `proxy-dns` is not supported")
-		}
 		// NamedTunnelProperties are nil since proxy dns server does not need it.
 		// This is supported for legacy reasons: dns proxy server is not a tunnel and ideally should
 		// not run as part of cloudflared tunnel.
@@ -365,7 +339,7 @@ func StartServer(
 		errC <- autoupdater.Run(ctx)
 	}()

-	// Serve DNS proxy stand-alone if no tunnel type (quick, adhoc, named) is going to run
+	// Serve DNS proxy stand-alone if no hostname or tag or app is going to run
 	if dnsProxyStandAlone(c, namedTunnel) {
 		connectedSignal.Notify()
 		// no grace period, handle SIGINT/SIGTERM immediately
@@ -399,26 +373,7 @@ func StartServer(
 		}
 	}

-	localRules := []ingress.Rule{}
-	if features.Contains(features.FeatureManagementLogs) {
-		serviceIP := c.String("service-op-ip")
-		if edgeAddrs, err := edgediscovery.ResolveEdge(log, tunnelConfig.Region, tunnelConfig.EdgeIPVersion); err == nil {
-			if serviceAddr, err := edgeAddrs.GetAddrForRPC(); err == nil {
-				serviceIP = serviceAddr.TCP.String()
-			}
-		}
-
-		mgmt := management.New(
-			c.String("management-hostname"),
-			serviceIP,
-			clientID,
-			c.String(connectorLabelFlag),
-			logger.ManagementLogger.Log,
-			logger.ManagementLogger,
-		)
-		localRules = []ingress.Rule{ingress.NewManagementRule(mgmt)}
-	}
-	orchestrator, err := orchestration.NewOrchestrator(ctx, orchestratorConfig, tunnelConfig.Tags, localRules, tunnelConfig.Log)
+	orchestrator, err := orchestration.NewOrchestrator(ctx, orchestratorConfig, tunnelConfig.Tags, tunnelConfig.Log)
 	if err != nil {
 		return err
 	}
@@ -442,7 +397,7 @@ func StartServer(
 		errC <- metrics.ServeMetrics(metricsListener, ctx, metricsConfig, log)
 	}()

-	reconnectCh := make(chan supervisor.ReconnectSignal, c.Int(haConnectionsFlag))
+	reconnectCh := make(chan supervisor.ReconnectSignal, c.Int("ha-connections"))
 	if c.IsSet("stdin-control") {
 		log.Info().Msg("Enabling control through stdin")
 		go stdinControl(reconnectCh, log)
@@ -555,7 +510,7 @@ func addPortIfMissing(uri *url.URL, port int) string {
 func tunnelFlags(shouldHide bool) []cli.Flag {
 	flags := configureCloudflaredFlags(shouldHide)
 	flags = append(flags, configureProxyFlags(shouldHide)...)
-	flags = append(flags, cliutil.ConfigureLoggingFlags(shouldHide)...)
+	flags = append(flags, configureLoggingFlags(shouldHide)...)
 	flags = append(flags, configureProxyDNSFlags(shouldHide)...)
 	flags = append(flags, []cli.Flag{
 		credentialsFileFlag,
@@ -578,17 +533,11 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "edge-ip-version",
-			Usage:   "Cloudflare Edge IP address version to connect with. {4, 6, auto}",
+			Usage:   "Cloudflare Edge ip address version to connect with. {4, 6, auto}",
 			EnvVars: []string{"TUNNEL_EDGE_IP_VERSION"},
 			Value:   "4",
 			Hidden:  false,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "edge-bind-address",
-			Usage:   "Bind to IP address for outgoing connections to Cloudflare Edge.",
-			EnvVars: []string{"TUNNEL_EDGE_BIND_ADDRESS"},
-			Hidden:  false,
-		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    tlsconfig.CaCertFlag,
 			Usage:   "Certificate Authority authenticating connections with Cloudflare's edge network.",
@@ -679,15 +628,10 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:   haConnectionsFlag,
+			Name:   "ha-connections",
 			Value:  4,
 			Hidden: true,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:  connectorLabelFlag,
-			Usage: "Use this option to give a meaningful label to a specific connector. When a tunnel starts up, a connector id unique to the tunnel is generated. This is a uuid. To make it easier to identify a connector, we will use the hostname of the machine the tunnel is running on along with the connector ID. This option exists if one wants to have more control over what their individual connectors are called.",
-			Value: "",
-		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
 			Name:    "grace-period",
 			Usage:   "When cloudflared receives SIGINT/SIGTERM it will stop accepting new requests, wait for in-progress requests to terminate, then shutdown. Waiting for in-progress requests will timeout after this grace period, or when a second SIGTERM/SIGINT is received.",
@@ -773,10 +717,10 @@ func configureCloudflaredFlags(shouldHide bool) []cli.Flag {
 			Hidden: shouldHide,
 		},
 		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    credentials.OriginCertFlag,
+			Name:    "origincert",
 			Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
 			EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
-			Value:   credentials.FindDefaultOriginCertPath(),
+			Value:   findDefaultOriginCertPath(),
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewDurationFlag(&cli.DurationFlag{
@@ -818,7 +762,7 @@ func configureProxyFlags(shouldHide bool) []cli.Flag {
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    ingress.HelloWorldFlag,
+			Name:    "hello-world",
 			Value:   false,
 			Usage:   "Run Hello World Server",
 			EnvVars: []string{"TUNNEL_HELLO_WORLD"},
@@ -921,20 +865,6 @@ func configureProxyFlags(shouldHide bool) []cli.Flag {
 			Hidden:  shouldHide,
 			Value:   false,
 		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "management-hostname",
-			Usage:   "Management hostname to signify incoming management requests",
-			EnvVars: []string{"TUNNEL_MANAGEMENT_HOSTNAME"},
-			Hidden:  true,
-			Value:   "management.argotunnel.com",
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "service-op-ip",
-			Usage:   "Fallback IP for service operations run by the management service.",
-			EnvVars: []string{"TUNNEL_SERVICE_OP_IP"},
-			Hidden:  true,
-			Value:   "198.41.200.113:80",
-		}),
 	}
 	return append(flags, sshFlags(shouldHide)...)
 }
@@ -1043,6 +973,44 @@ func sshFlags(shouldHide bool) []cli.Flag {
 	}
 }

+func configureLoggingFlags(shouldHide bool) []cli.Flag {
+	return []cli.Flag{
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    logger.LogLevelFlag,
+			Value:   "info",
+			Usage:   "Application logging level {debug, info, warn, error, fatal}. " + debugLevelWarning,
+			EnvVars: []string{"TUNNEL_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    logger.LogTransportLevelFlag,
+			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
+			Value:   "info",
+			Usage:   "Transport logging level(previously called protocol logging level) {debug, info, warn, error, fatal}",
+			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    logger.LogFileFlag,
+			Usage:   "Save application log to this file for reporting issues.",
+			EnvVars: []string{"TUNNEL_LOGFILE"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    logger.LogDirectoryFlag,
+			Usage:   "Save application log to this directory for reporting issues.",
+			EnvVars: []string{"TUNNEL_LOGDIRECTORY"},
+			Hidden:  shouldHide,
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "trace-output",
+			Usage:   "Name of trace output file, generated when cloudflared stops.",
+			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
+			Hidden:  shouldHide,
+		}),
+	}
+}
+
 func configureProxyDNSFlags(shouldHide bool) []cli.Flag {
 	return []cli.Flag{
 		altsrc.NewBoolFlag(&cli.BoolFlag{
@@ -3,14 +3,17 @@ package tunnel
 import (
 	"crypto/tls"
 	"fmt"
+	"io/ioutil"
 	mathRand "math/rand"
 	"net"
 	"net/netip"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"

 	"github.com/google/uuid"
+	homedir "github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
 	"github.com/urfave/cli/v2"
@@ -18,11 +21,12 @@ import (
 	"golang.org/x/crypto/ssh/terminal"

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
+	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
+
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/edgediscovery"
-	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
-	"github.com/cloudflare/cloudflared/features"
+	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/orchestration"
 	"github.com/cloudflare/cloudflared/supervisor"
@@ -30,6 +34,7 @@ import (
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )

+const LogFieldOriginCertPath = "originCertPath"
 const secretValue = "*****"

 var (
@@ -37,11 +42,24 @@ var (
 	serviceUrl      = developerPortal + "/reference/service/"
 	argumentsUrl    = developerPortal + "/reference/arguments/"

-	secretFlags = [2]*altsrc.StringFlag{credentialsContentsFlag, tunnelTokenFlag}
+	secretFlags     = [2]*altsrc.StringFlag{credentialsContentsFlag, tunnelTokenFlag}
+	defaultFeatures = []string{supervisor.FeatureAllowRemoteConfig, supervisor.FeatureSerializedHeaders, supervisor.FeatureDatagramV2, supervisor.FeatureQUICSupportEOF}

-	configFlags = []string{"autoupdate-freq", "no-autoupdate", "retries", "protocol", "loglevel", "transport-loglevel", "origincert", "metrics", "metrics-update-freq", "edge-ip-version", "edge-bind-address"}
+	configFlags = []string{"autoupdate-freq", "no-autoupdate", "retries", "protocol", "loglevel", "transport-loglevel", "origincert", "metrics", "metrics-update-freq", "edge-ip-version"}
 )

+// returns the first path that contains a cert.pem file. If none of the DefaultConfigSearchDirectories
+// contains a cert.pem file, return empty string
+func findDefaultOriginCertPath() string {
+	for _, defaultConfigDir := range config.DefaultConfigSearchDirectories() {
+		originCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, config.DefaultCredentialFile))
+		if ok, _ := config.FileExists(originCertPath); ok {
+			return originCertPath
+		}
+	}
+	return ""
+}
+
 func generateRandomClientID(log *zerolog.Logger) (string, error) {
 	u, err := uuid.NewRandom()
 	if err != nil {
@@ -106,10 +124,63 @@ func isSecretEnvVar(key string) bool {
 }

 func dnsProxyStandAlone(c *cli.Context, namedTunnel *connection.NamedTunnelProperties) bool {
-	return c.IsSet("proxy-dns") &&
-		!(c.IsSet("name") || // adhoc-named tunnel
-			c.IsSet(ingress.HelloWorldFlag) || // quick or named tunnel
-			namedTunnel != nil) // named tunnel
+	return c.IsSet("proxy-dns") && (!c.IsSet("tag") && !c.IsSet("hello-world") && namedTunnel == nil)
+}
+
+func findOriginCert(originCertPath string, log *zerolog.Logger) (string, error) {
+	if originCertPath == "" {
+		log.Info().Msgf("Cannot determine default origin certificate path. No file %s in %v", config.DefaultCredentialFile, config.DefaultConfigSearchDirectories())
+		if isRunningFromTerminal() {
+			log.Error().Msgf("You need to specify the origin certificate path with --origincert option, or set TUNNEL_ORIGIN_CERT environment variable. See %s for more information.", argumentsUrl)
+			return "", fmt.Errorf("client didn't specify origincert path when running from terminal")
+		} else {
+			log.Error().Msgf("You need to specify the origin certificate path by specifying the origincert option in the configuration file, or set TUNNEL_ORIGIN_CERT environment variable. See %s for more information.", serviceUrl)
+			return "", fmt.Errorf("client didn't specify origincert path")
+		}
+	}
+	var err error
+	originCertPath, err = homedir.Expand(originCertPath)
+	if err != nil {
+		log.Err(err).Msgf("Cannot resolve origin certificate path")
+		return "", fmt.Errorf("cannot resolve path %s", originCertPath)
+	}
+	// Check that the user has acquired a certificate using the login command
+	ok, err := config.FileExists(originCertPath)
+	if err != nil {
+		log.Error().Err(err).Msgf("Cannot check if origin cert exists at path %s", originCertPath)
+		return "", fmt.Errorf("cannot check if origin cert exists at path %s", originCertPath)
+	}
+	if !ok {
+		log.Error().Msgf(`Cannot find a valid certificate for your origin at the path:
+
+    %s
+
+If the path above is wrong, specify the path with the -origincert option.
+If you don't have a certificate signed by Cloudflare, run the command:
+
+	%s login
+`, originCertPath, os.Args[0])
+		return "", fmt.Errorf("cannot find a valid certificate at the path %s", originCertPath)
+	}
+
+	return originCertPath, nil
+}
+
+func readOriginCert(originCertPath string) ([]byte, error) {
+	// Easier to send the certificate as []byte via RPC than decoding it at this point
+	originCert, err := ioutil.ReadFile(originCertPath)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read %s to load origin certificate", originCertPath)
+	}
+	return originCert, nil
+}
+
+func getOriginCert(originCertPath string, log *zerolog.Logger) ([]byte, error) {
+	if originCertPath, err := findOriginCert(originCertPath, log); err != nil {
+		return nil, err
+	} else {
+		return readOriginCert(originCertPath)
+	}
 }

 func prepareTunnelConfig(
@@ -144,23 +215,54 @@ func prepareTunnelConfig(
 		transportProtocol = connection.QUIC.String()
 	}

-	clientFeatures := dedup(append(c.StringSlice("features"), features.DefaultFeatures...))
+	protocolFetcher := edgediscovery.ProtocolPercentage
+
+	features := append(c.StringSlice("features"), defaultFeatures...)
 	if needPQ {
-		clientFeatures = append(clientFeatures, features.FeaturePostQuantum)
+		features = append(features, supervisor.FeaturePostQuantum)
+	}
+	if c.IsSet(TunnelTokenFlag) {
+		if transportProtocol == connection.AutoSelectFlag {
+			protocolFetcher = func() (edgediscovery.ProtocolPercents, error) {
+				// If the Tunnel is remotely managed and no protocol is set, we prefer QUIC, but still allow fall-back.
+				preferQuic := []edgediscovery.ProtocolPercent{
+					{
+						Protocol:   connection.QUIC.String(),
+						Percentage: 100,
+					},
+					{
+						Protocol:   connection.HTTP2.String(),
+						Percentage: 100,
+					},
+				}
+				return preferQuic, nil
+			}
+		}
+		log.Info().Msg("Will be fetching remotely managed configuration from Cloudflare API. Defaulting to protocol: quic")
 	}
 	namedTunnel.Client = tunnelpogs.ClientInfo{
 		ClientID: clientID[:],
-		Features: clientFeatures,
+		Features: dedup(features),
 		Version:  info.Version(),
 		Arch:     info.OSArch(),
 	}
 	cfg := config.GetConfiguration()
-	ingressRules, err := ingress.ParseIngressFromConfigAndCLI(cfg, c, log)
-	if err != nil {
+	ingressRules, err := ingress.ParseIngress(cfg)
+	if err != nil && err != ingress.ErrNoIngressRules {
 		return nil, nil, err
 	}
+	// Only for quick tunnels will we attempt to parse the --url flag for a tunnel ingress rule
+	if ingressRules.IsEmpty() && c.IsSet("url") && namedTunnel.QuickTunnelUrl != "" {
+		ingressRules, err = ingress.NewSingleOrigin(c, true)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	if ingressRules.IsEmpty() {
+		return nil, nil, ingress.ErrNoIngressRules
+	}

-	protocolSelector, err := connection.NewProtocolSelector(transportProtocol, namedTunnel.Credentials.AccountTag, c.IsSet(TunnelTokenFlag), c.Bool("post-quantum"), edgediscovery.ProtocolPercentage, connection.ResolveTTL, log)
+	protocolSelector, err := connection.NewProtocolSelector(transportProtocol, cfg.WarpRouting.Enabled, namedTunnel, protocolFetcher, supervisor.ResolveTTL, log, c.Bool("post-quantum"))
 	if err != nil {
 		return nil, nil, err
 	}
@@ -186,22 +288,18 @@ func prepareTunnelConfig(
 	if err != nil {
 		return nil, nil, err
 	}
+	muxerConfig := &connection.MuxerConfig{
+		HeartbeatInterval: c.Duration("heartbeat-interval"),
+		// Note TUN-3758 , we use Int because UInt is not supported with altsrc
+		MaxHeartbeats: uint64(c.Int("heartbeat-count")),
+		// Note TUN-3758 , we use Int because UInt is not supported with altsrc
+		CompressionSetting: h2mux.CompressionSetting(uint64(c.Int("compression-quality"))),
+		MetricsUpdateFreq:  c.Duration("metrics-update-freq"),
+	}
 	edgeIPVersion, err := parseConfigIPVersion(c.String("edge-ip-version"))
 	if err != nil {
 		return nil, nil, err
 	}
-	edgeBindAddr, err := parseConfigBindAddress(c.String("edge-bind-address"))
-	if err != nil {
-		return nil, nil, err
-	}
-	if err := testIPBindable(edgeBindAddr); err != nil {
-		return nil, nil, fmt.Errorf("invalid edge-bind-address %s: %v", edgeBindAddr, err)
-	}
-	edgeIPVersion, err = adjustIPVersionByBindAddress(edgeIPVersion, edgeBindAddr)
-	if err != nil {
-		// This is not a fatal error, we just overrode edgeIPVersion
-		log.Warn().Str("edgeIPVersion", edgeIPVersion.String()).Err(err).Msg("Overriding edge-ip-version")
-	}

 	var pqKexIdx int
 	if needPQ {
@@ -220,8 +318,7 @@ func prepareTunnelConfig(
 		EdgeAddrs:       c.StringSlice("edge"),
 		Region:          c.String("region"),
 		EdgeIPVersion:   edgeIPVersion,
-		EdgeBindAddr:    edgeBindAddr,
-		HAConnections:   c.Int(haConnectionsFlag),
+		HAConnections:   c.Int("ha-connections"),
 		IncidentLookup:  supervisor.NewIncidentLookup(),
 		IsAutoupdated:   c.Bool("is-autoupdated"),
 		LBPool:          c.String("lb-pool"),
@@ -234,6 +331,7 @@ func prepareTunnelConfig(
 		Retries:            uint(c.Int("retries")),
 		RunFromTerminal:    isRunningFromTerminal(),
 		NamedTunnel:        namedTunnel,
+		MuxerConfig:        muxerConfig,
 		ProtocolSelector:   protocolSelector,
 		EdgeTLSConfigs:     edgeTLSConfigs,
 		NeedPQ:             needPQ,
@@ -312,51 +410,6 @@ func parseConfigIPVersion(version string) (v allregions.ConfigIPVersion, err err
 	return
 }

-func parseConfigBindAddress(ipstr string) (net.IP, error) {
-	// Unspecified - it's fine
-	if ipstr == "" {
-		return nil, nil
-	}
-	ip := net.ParseIP(ipstr)
-	if ip == nil {
-		return nil, fmt.Errorf("invalid value for edge-bind-address: %s", ipstr)
-	}
-	return ip, nil
-}
-
-func testIPBindable(ip net.IP) error {
-	// "Unspecified" = let OS choose, so always bindable
-	if ip == nil {
-		return nil
-	}
-
-	addr := &net.UDPAddr{IP: ip, Port: 0}
-	listener, err := net.ListenUDP("udp", addr)
-	if err != nil {
-		return err
-	}
-	listener.Close()
-	return nil
-}
-
-func adjustIPVersionByBindAddress(ipVersion allregions.ConfigIPVersion, ip net.IP) (allregions.ConfigIPVersion, error) {
-	if ip == nil {
-		return ipVersion, nil
-	}
-	// https://pkg.go.dev/net#IP.To4: "If ip is not an IPv4 address, To4 returns nil."
-	if ip.To4() != nil {
-		if ipVersion == allregions.IPv6Only {
-			return allregions.IPv4Only, fmt.Errorf("IPv4 bind address is specified, but edge-ip-version is IPv6")
-		}
-		return allregions.IPv4Only, nil
-	} else {
-		if ipVersion == allregions.IPv4Only {
-			return allregions.IPv6Only, fmt.Errorf("IPv6 bind address is specified, but edge-ip-version is IPv4")
-		}
-		return allregions.IPv6Only, nil
-	}
-}
-
 func newPacketConfig(c *cli.Context, logger *zerolog.Logger) (*ingress.GlobalRouterConfig, error) {
 	ipv4Src, err := determineICMPv4Src(c.String("icmpv4-src"), logger)
 	if err != nil {
@@ -9,7 +9,6 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
-	"net"
 	"os"
 	"testing"

@@ -215,23 +214,3 @@ func getCertPoolSubjects(certPool *x509.CertPool) ([]*pkix.Name, error) {
 func isUnrecoverableError(err error) bool {
 	return err != nil && err.Error() != "crypto/x509: system root pool is not available on Windows"
 }
-
-func TestTestIPBindable(t *testing.T) {
-	assert.Nil(t, testIPBindable(nil))
-
-	// Public services - if one of these IPs is on the machine, the test environment is too weird
-	assert.NotNil(t, testIPBindable(net.ParseIP("8.8.8.8")))
-	assert.NotNil(t, testIPBindable(net.ParseIP("1.1.1.1")))
-
-	addrs, err := net.InterfaceAddrs()
-	if err != nil {
-		t.Fatal(err)
-	}
-	for i, addr := range addrs {
-		if i >= 3 {
-			break
-		}
-		ip := addr.(*net.IPNet).IP
-		assert.Nil(t, testIPBindable(ip))
-	}
-}
@@ -5,7 +5,6 @@ import (
 	"path/filepath"

 	"github.com/cloudflare/cloudflared/config"
-	"github.com/cloudflare/cloudflared/credentials"

 	"github.com/google/uuid"
 	"github.com/rs/zerolog"
@@ -57,13 +56,13 @@ func newSearchByID(id uuid.UUID, c *cli.Context, log *zerolog.Logger, fs fileSys
 }

 func (s searchByID) Path() (string, error) {
-	originCertPath := s.c.String(credentials.OriginCertFlag)
+	originCertPath := s.c.String("origincert")
 	originCertLog := s.log.With().
-		Str("originCertPath", originCertPath).
+		Str(LogFieldOriginCertPath, originCertPath).
 		Logger()

 	// Fallback to look for tunnel credentials in the origin cert directory
-	if originCertPath, err := credentials.FindOriginCert(originCertPath, &originCertLog); err == nil {
+	if originCertPath, err := findOriginCert(originCertPath, &originCertLog); err == nil {
 		originCertDir := filepath.Dir(originCertPath)
 		if filePath, err := tunnelFilePath(s.id, originCertDir); err == nil {
 			if s.fs.validFilePath(filePath) {
@@ -14,7 +14,6 @@ import (

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/config"
-	"github.com/cloudflare/cloudflared/credentials"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/token"
 )
@@ -53,7 +52,6 @@ func login(c *cli.Context) error {

 	resourceData, err := token.RunTransfer(
 		loginURL,
-		"",
 		"cert",
 		"callback",
 		callbackStoreURL,
@@ -87,7 +85,7 @@ func checkForExistingCert() (string, bool, error) {
 	if err != nil {
 		return "", false, err
 	}
-	path := filepath.Join(configPath, credentials.DefaultCredentialFile)
+	path := filepath.Join(configPath, config.DefaultCredentialFile)
 	fileInfo, err := os.Stat(path)
 	if err == nil && fileInfo.Size() > 0 {
 		return path, true, nil
@@ -73,9 +73,6 @@ func RunQuickTunnel(sc *subcommandContext) error {
 		sc.c.Set("protocol", "quic")
 	}

-	// Override the number of connections used. Quick tunnels shouldn't be used for production usage,
-	// so, use a single connection instead.
-	sc.c.Set(haConnectionsFlag, "1")
 	return StartServer(
 		sc.c,
 		buildInfo,
@@ -13,9 +13,9 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/urfave/cli/v2"

+	"github.com/cloudflare/cloudflared/certutil"
 	"github.com/cloudflare/cloudflared/cfapi"
 	"github.com/cloudflare/cloudflared/connection"
-	"github.com/cloudflare/cloudflared/credentials"
 	"github.com/cloudflare/cloudflared/logger"
 )

@@ -37,7 +37,7 @@ type subcommandContext struct {

 	// These fields should be accessed using their respective Getter
 	tunnelstoreClient cfapi.Client
-	userCredential    *credentials.User
+	userCredential    *userCredential
 }

 func newSubcommandContext(c *cli.Context) (*subcommandContext, error) {
@@ -56,28 +56,65 @@ func (sc *subcommandContext) credentialFinder(tunnelID uuid.UUID) CredFinder {
 	return newSearchByID(tunnelID, sc.c, sc.log, sc.fs)
 }

+type userCredential struct {
+	cert     *certutil.OriginCert
+	certPath string
+}
+
 func (sc *subcommandContext) client() (cfapi.Client, error) {
 	if sc.tunnelstoreClient != nil {
 		return sc.tunnelstoreClient, nil
 	}
-	cred, err := sc.credential()
+	credential, err := sc.credential()
 	if err != nil {
 		return nil, err
 	}
-	sc.tunnelstoreClient, err = cred.Client(sc.c.String("api-url"), buildInfo.UserAgent(), sc.log)
+	userAgent := fmt.Sprintf("cloudflared/%s", buildInfo.Version())
+	client, err := cfapi.NewRESTClient(
+		sc.c.String("api-url"),
+		credential.cert.AccountID,
+		credential.cert.ZoneID,
+		credential.cert.APIToken,
+		userAgent,
+		sc.log,
+	)
+
 	if err != nil {
 		return nil, err
 	}
-	return sc.tunnelstoreClient, nil
+	sc.tunnelstoreClient = client
+	return client, nil
 }

-func (sc *subcommandContext) credential() (*credentials.User, error) {
+func (sc *subcommandContext) credential() (*userCredential, error) {
 	if sc.userCredential == nil {
-		uc, err := credentials.Read(sc.c.String(credentials.OriginCertFlag), sc.log)
+		originCertPath := sc.c.String("origincert")
+		originCertLog := sc.log.With().
+			Str(LogFieldOriginCertPath, originCertPath).
+			Logger()
+
+		originCertPath, err := findOriginCert(originCertPath, &originCertLog)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, "Error locating origin cert")
+		}
+		blocks, err := readOriginCert(originCertPath)
+		if err != nil {
+			return nil, errors.Wrapf(err, "Can't read origin cert from %s", originCertPath)
+		}
+
+		cert, err := certutil.DecodeOriginCert(blocks)
+		if err != nil {
+			return nil, errors.Wrap(err, "Error decoding origin cert")
+		}
+
+		if cert.AccountID == "" {
+			return nil, errors.Errorf(`Origin certificate needs to be refreshed before creating new tunnels.\nDelete %s and run "cloudflared login" to obtain a new cert.`, originCertPath)
+		}
+
+		sc.userCredential = &userCredential{
+			cert:     cert,
+			certPath: originCertPath,
 		}
-		sc.userCredential = uc
 	}
 	return sc.userCredential, nil
 }
@@ -138,13 +175,13 @@ func (sc *subcommandContext) create(name string, credentialsFilePath string, sec
 		return nil, err
 	}
 	tunnelCredentials := connection.Credentials{
-		AccountTag:   credential.AccountID(),
+		AccountTag:   credential.cert.AccountID,
 		TunnelSecret: tunnelSecret,
 		TunnelID:     tunnel.ID,
 	}
 	usedCertPath := false
 	if credentialsFilePath == "" {
-		originCertDir := filepath.Dir(credential.CertPath())
+		originCertDir := filepath.Dir(credential.certPath)
 		credentialsFilePath, err = tunnelFilePath(tunnelCredentials.TunnelID, originCertDir)
 		if err != nil {
 			return nil, err
@@ -16,7 +16,6 @@ import (

 	"github.com/cloudflare/cloudflared/cfapi"
 	"github.com/cloudflare/cloudflared/connection"
-	"github.com/cloudflare/cloudflared/credentials"
 )

 type mockFileSystem struct {
@@ -38,7 +37,7 @@ func Test_subcommandContext_findCredentials(t *testing.T) {
 		log               *zerolog.Logger
 		fs                fileSystem
 		tunnelstoreClient cfapi.Client
-		userCredential    *credentials.User
+		userCredential    *userCredential
 	}
 	type args struct {
 		tunnelID uuid.UUID
@@ -250,7 +249,7 @@ func Test_subcommandContext_Delete(t *testing.T) {
 		isUIEnabled       bool
 		fs                fileSystem
 		tunnelstoreClient *deleteMockTunnelStore
-		userCredential    *credentials.User
+		userCredential    *userCredential
 	}
 	type args struct {
 		tunnelIDs []uuid.UUID
@@ -95,6 +95,14 @@ var (
 		Usage:   "Inverts the sort order of the tunnel list.",
 		EnvVars: []string{"TUNNEL_LIST_INVERT_SORT"},
 	}
+	forceFlag = altsrc.NewBoolFlag(&cli.BoolFlag{
+		Name:    "force",
+		Aliases: []string{"f"},
+		Usage: "By default, if a tunnel is currently being run from a cloudflared, you can't " +
+			"simultaneously rerun it again from a second cloudflared. The --force flag lets you " +
+			"overwrite the previous tunnel. If you want to use a single hostname with multiple " +
+			"tunnels, you can do so with Cloudflare's Load Balancer product.",
+	})
 	featuresFlag = altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
 		Name:    "features",
 		Aliases: []string{"F"},
@@ -608,6 +616,7 @@ func renderOutput(format string, v interface{}) error {

 func buildRunCommand() *cli.Command {
 	flags := []cli.Flag{
+		forceFlag,
 		credentialsFileFlag,
 		credentialsContentsFlag,
 		postQuantumFlag,
@@ -623,7 +632,7 @@ func buildRunCommand() *cli.Command {
 		Action:    cliutil.ConfiguredAction(runCommand),
 		Usage:     "Proxy a local web server by running the given tunnel",
 		UsageText: "cloudflared tunnel [tunnel command options] run [subcommand options] [TUNNEL]",
-		Description: `Runs the tunnel identified by name or UUID, creating highly available connections
+		Description: `Runs the tunnel identified by name or UUUD, creating highly available connections
  between your server and the Cloudflare edge. You can provide name or UUID of tunnel to run either as the
  last command line argument or in the configuration file using "tunnel: TUNNEL".

@@ -932,7 +941,7 @@ func commandHelpTemplate() string {
 	for _, f := range configureCloudflaredFlags(false) {
 		parentFlagsHelp += fmt.Sprintf(" %s\n\t", f)
 	}
-	for _, f := range cliutil.ConfigureLoggingFlags(false) {
+	for _, f := range configureLoggingFlags(false) {
 		parentFlagsHelp += fmt.Sprintf(" %s\n\t", f)
 	}
 	const template = `NAME:
@@ -6,7 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
-	"strings"
 	"time"

 	"github.com/facebookgo/grace/gracenet"
@@ -96,24 +95,11 @@ func CheckForUpdate(options updateOptions) (CheckResult, error) {
 		url = StagingUpdateURL
 	}

-	if runtime.GOOS == "windows" {
-		cfdPath = encodeWindowsPath(cfdPath)
-	}
-
 	s := NewWorkersService(version, url, cfdPath, Options{IsBeta: options.isBeta,
 		IsForced: options.isForced, RequestedVersion: options.intendedVersion})

 	return s.Check()
 }
-func encodeWindowsPath(path string) string {
-	// We do this because Windows allows spaces in directories such as
-	// Program Files but does not allow these directories to be spaced in batch files.
-	targetPath := strings.Replace(path, "Program Files (x86)", "PROGRA~2", -1)
-	// This is to do the same in 32 bit systems. We do this second so that the first
-	// replace is for x86 dirs.
-	targetPath = strings.Replace(targetPath, "Program Files", "PROGRA~1", -1)
-	return targetPath
-}

 func applyUpdate(options updateOptions, update CheckResult) UpdateOutcome {
 	if update.Version() == "" || options.updateDisabled {
@@ -25,13 +25,14 @@ const (
 	// rename cloudflared.exe.new to cloudflared.exe
 	// delete cloudflared.exe.old
 	// start the service
-	// exit with code 0 if we've reached this point indicating success.
-	windowsUpdateCommandTemplate = `sc stop cloudflared >nul 2>&1
+	// delete the batch file
+	windowsUpdateCommandTemplate = `@echo off
+sc stop cloudflared >nul 2>&1
 rename "{{.TargetPath}}" {{.OldName}}
 rename "{{.NewPath}}" {{.BinaryName}}
 del "{{.OldPath}}"
 sc start cloudflared >nul 2>&1
-exit /b 0`
+del {{.BatchName}}`
 	batchFileName = "cfd_update.bat"
 )

@@ -213,9 +214,8 @@ func isValidChecksum(checksum, filePath string) error {
 // writeBatchFile writes a batch file out to disk
 // see the dicussion on why it has to be done this way
 func writeBatchFile(targetPath string, newPath string, oldPath string) error {
-	batchFilePath := filepath.Join(filepath.Dir(targetPath), batchFileName)
-	os.Remove(batchFilePath) //remove any failed updates before download
-	f, err := os.Create(batchFilePath)
+	os.Remove(batchFileName) //remove any failed updates before download
+	f, err := os.Create(batchFileName)
 	if err != nil {
 		return err
 	}
@@ -241,16 +241,6 @@ func writeBatchFile(targetPath string, newPath string, oldPath string) error {

 // run each OS command for windows
 func runWindowsBatch(batchFile string) error {
-	defer os.Remove(batchFile)
-	cmd := exec.Command("cmd", "/C", batchFile)
-	_, err := cmd.Output()
-	// Remove the batch file we created. Don't let this interfere with the error
-	// we report.
-	if err != nil {
-		if exitError, ok := err.(*exec.ExitError); ok {
-			return fmt.Errorf("Error during update : %s;", string(exitError.Stderr))
-		}
-
-	}
-	return err
+	cmd := exec.Command("cmd", "/c", batchFile)
+	return cmd.Start()
 }
@@ -10,6 +10,7 @@
 cloudflared_binary: "cloudflared"
 tunnel: "3d539f97-cd3a-4d8e-c33b-65e9099c7a8d"
 credentials_file: "/Users/tunnel/.cloudflared/3d539f97-cd3a-4d8e-c33b-65e9099c7a8d.json"
+classic_hostname: "classic-tunnel-component-tests.example.com"
 origincert: "/Users/tunnel/.cloudflared/cert.pem"
 ingress:
 - hostname: named-tunnel-component-tests.example.com
@@ -2,9 +2,7 @@ import json
 import subprocess
 from time import sleep

-from constants import MANAGEMENT_HOST_NAME
 from setup import get_config_from_file
-from util import get_tunnel_connector_id

 SINGLE_CASE_TIMEOUT = 600

@@ -30,36 +28,6 @@ class CloudflaredCli:
        listed = self._run_command(cmd_args, "list")
        return json.loads(listed.stdout)

-    def get_management_token(self, config, config_path):
-        basecmd = [config.cloudflared_binary]
-        if config_path is not None:
-            basecmd += ["--config", str(config_path)]
-        origincert = get_config_from_file()["origincert"]
-        if origincert:
-            basecmd += ["--origincert", origincert]
-
-        cmd_args = ["tail", "token", config.get_tunnel_id()]
-        cmd = basecmd + cmd_args
-        result = run_subprocess(cmd, "token", self.logger, check=True, capture_output=True, timeout=15)
-        return json.loads(result.stdout.decode("utf-8").strip())["token"]
-    
-    def get_management_url(self, path, config, config_path):
-        access_jwt = self.get_management_token(config, config_path)
-        connector_id = get_tunnel_connector_id()
-        return f"https://{MANAGEMENT_HOST_NAME}/{path}?connector_id={connector_id}&access_token={access_jwt}"
-    
-    def get_management_wsurl(self, path, config, config_path):
-        access_jwt = self.get_management_token(config, config_path)
-        connector_id = get_tunnel_connector_id()
-        return f"wss://{MANAGEMENT_HOST_NAME}/{path}?connector_id={connector_id}&access_token={access_jwt}"
-
-    def get_connector_id(self, config): 
-        op = self.get_tunnel_info(config.get_tunnel_id())
-        connectors = []
-        for conn in op["conns"]:
-            connectors.append(conn["id"])
-        return connectors
-
    def get_tunnel_info(self, tunnel_id):
        info = self._run_command(["info", "--output", "json", tunnel_id], "info")
        return json.loads(info.stdout)
@@ -30,7 +30,6 @@ class NamedTunnelBaseConfig(BaseConfig):
    tunnel: str = None
    credentials_file: str = None
    ingress: list = None
-    hostname: str = None

    def __post_init__(self):
        if self.tunnel is None:
@@ -42,10 +41,8 @@ class NamedTunnelBaseConfig(BaseConfig):

    def merge_config(self, additional):
        config = super(NamedTunnelBaseConfig, self).merge_config(additional)
-        if 'tunnel' not in config:
-            config['tunnel'] = self.tunnel
-        if 'credentials-file' not in config:
-            config['credentials-file'] = self.credentials_file
+        config['tunnel'] = self.tunnel
+        config['credentials-file'] = self.credentials_file
        # In some cases we want to override default ingress, such as in config tests
        if 'ingress' not in config:
            config['ingress'] = self.ingress
@@ -64,7 +61,7 @@ class NamedTunnelConfig(NamedTunnelBaseConfig):
                           self.merge_config(additional_config))

    def get_url(self):
-        return "https://" + self.hostname
+        return "https://" + self.ingress[0]['hostname']

    def base_config(self):
        config = self.full_config.copy()
@@ -87,9 +84,28 @@ class NamedTunnelConfig(NamedTunnelBaseConfig):
    def get_credentials_json(self):
        with open(self.credentials_file) as json_file:
            return json.load(json_file)
-        
+
+
@dataclass(frozen=True)
-class QuickTunnelConfig(BaseConfig):
+class ClassicTunnelBaseConfig(BaseConfig):
+    hostname: str = None
+    origincert: str = None
+
+    def __post_init__(self):
+        if self.hostname is None:
+            raise TypeError("Field tunnel is not set")
+        if self.origincert is None:
+            raise TypeError("Field credentials_file is not set")
+
+    def merge_config(self, additional):
+        config = super(ClassicTunnelBaseConfig, self).merge_config(additional)
+        config['hostname'] = self.hostname
+        config['origincert'] = self.origincert
+        return config
+
+
+@dataclass(frozen=True)
+class ClassicTunnelConfig(ClassicTunnelBaseConfig):
    full_config: dict = None
    additional_config: InitVar[dict] = {}

@@ -99,6 +115,10 @@ class QuickTunnelConfig(BaseConfig):
        object.__setattr__(self, 'full_config',
                           self.merge_config(additional_config))

+    def get_url(self):
+        return "https://" + self.hostname
+
+
@dataclass(frozen=True)
 class ProxyDnsConfig(BaseConfig):
    full_config = {
@@ -1,8 +0,0 @@
-cloudflared_binary: "cloudflared"
-tunnel: "ae21a96c-24d1-4ce8-a6ba-962cba5976d3"
-credentials_file: "/Users/sudarsan/.cloudflared/ae21a96c-24d1-4ce8-a6ba-962cba5976d3.json"
-origincert: "/Users/sudarsan/.cloudflared/cert.pem"
-ingress:
- hostname: named-tunnel-component-tests.example.com
-  service: hello_world
- service: http_status:404
@@ -5,14 +5,14 @@ from time import sleep
 import pytest
 import yaml

-from config import NamedTunnelConfig, ProxyDnsConfig, QuickTunnelConfig
+from config import NamedTunnelConfig, ClassicTunnelConfig, ProxyDnsConfig
 from constants import BACKOFF_SECS, PROXY_DNS_PORT
 from util import LOGGER


 class CfdModes(Enum):
    NAMED = auto()
-    QUICK = auto()
+    CLASSIC = auto()
    PROXY_DNS = auto()


@@ -26,7 +26,7 @@ def component_tests_config():
        config = yaml.safe_load(stream)
        LOGGER.info(f"component tests base config {config}")

-        def _component_tests_config(additional_config={}, cfd_mode=CfdModes.NAMED, run_proxy_dns=True, provide_ingress=True):
+        def _component_tests_config(additional_config={}, cfd_mode=CfdModes.NAMED, run_proxy_dns=True):
            if run_proxy_dns:
                # Regression test for TUN-4177, running with proxy-dns should not prevent tunnels from running.
                # So we run all tests with it.
@@ -36,25 +36,18 @@ def component_tests_config():
                additional_config.pop("proxy-dns", None)
                additional_config.pop("proxy-dns-port", None)

-            # Allows the ingress rules to be omitted from the provided config
-            ingress = []
-            if provide_ingress:
-                ingress = config['ingress']
-
-            # Provide the hostname to allow routing to the tunnel even if the ingress rule isn't defined in the config
-            hostname = config['ingress'][0]['hostname']
-
            if cfd_mode is CfdModes.NAMED:
                return NamedTunnelConfig(additional_config=additional_config,
                                         cloudflared_binary=config['cloudflared_binary'],
                                         tunnel=config['tunnel'],
                                         credentials_file=config['credentials_file'],
-                                         ingress=ingress,
-                                         hostname=hostname)
+                                         ingress=config['ingress'])
+            elif cfd_mode is CfdModes.CLASSIC:
+                return ClassicTunnelConfig(
+                    additional_config=additional_config, cloudflared_binary=config['cloudflared_binary'],
+                    hostname=config['classic_hostname'], origincert=config['origincert'])
            elif cfd_mode is CfdModes.PROXY_DNS:
                return ProxyDnsConfig(cloudflared_binary=config['cloudflared_binary'])
-            elif cfd_mode is CfdModes.QUICK:
-                return QuickTunnelConfig(additional_config=additional_config, cloudflared_binary=config['cloudflared_binary'])
            else:
                raise Exception(f"Unknown cloudflared mode {cfd_mode}")

@@ -4,8 +4,7 @@ BACKOFF_SECS = 7
 MAX_LOG_LINES = 50

 PROXY_DNS_PORT = 9053
-MANAGEMENT_HOST_NAME = "management.argotunnel.com"


 def protocols():
-    return ["http2", "quic"]
+    return ["h2mux", "http2", "quic"]
@@ -1,8 +1,6 @@
 cloudflare==2.8.15
 flaky==3.7.0
-pytest==7.3.1
-pytest-asyncio==0.21.0
+pytest==6.2.2
 pyyaml==5.4.1
-requests==2.28.2
-retrying==1.3.4
-websockets==11.0.1
+requests==2.25.1
+retrying==1.3.3
@@ -81,6 +81,12 @@ def create_dns(config, hostname, type, content):
    )


+def create_classic_dns(config, random_uuid):
+    classic_hostname = "classic-" + random_uuid + "." + config["zone_domain"]
+    create_dns(config, classic_hostname, "AAAA", "fd10:aec2:5dae::")
+    return classic_hostname
+
+
 def create_named_dns(config, random_uuid):
    hostname = "named-" + random_uuid + "." + config["zone_domain"]
    create_dns(config, hostname, "CNAME", config["tunnel"] + ".cfargotunnel.com")
@@ -113,6 +119,7 @@ def create():
    Creates the necessary resources for the components test to run.
     - Creates a named tunnel with a random name.
     - Creates a random CNAME DNS entry for that tunnel.
+     - Creates a random AAAA DNS entry for a classic tunnel.

    Those created resources are added to the config (obtained from an environment variable).
    The resulting configuration is persisted for the tests to use.
@@ -122,6 +129,7 @@ def create():

    random_uuid = str(uuid.uuid4())
    config["tunnel"] = create_tunnel(config, origincert_path, random_uuid)
+    config["classic_hostname"] = create_classic_dns(config, random_uuid)
    config["ingress"] = [
        {
            "hostname": create_named_dns(config, random_uuid),
@@ -142,6 +150,7 @@ def cleanup():
    """
    config = get_config_from_file()
    delete_tunnel(config)
+    delete_dns(config, config["classic_hostname"])
    delete_dns(config, config["ingress"][0]["hostname"])


@@ -74,7 +74,7 @@ def assert_log_to_dir(config, log_dir):
 class TestLogging:
    def test_logging_to_terminal(self, tmp_path, component_tests_config):
        config = component_tests_config()
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True) as cloudflared:
+        with start_cloudflared(tmp_path, config, new_process=True) as cloudflared:
            wait_tunnel_ready(tunnel_url=config.get_url())
            assert_log_to_terminal(cloudflared)

@@ -85,7 +85,7 @@ class TestLogging:
            "logfile": str(log_file),
        }
        config = component_tests_config(extra_config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True, capture_output=False):
+        with start_cloudflared(tmp_path, config, new_process=True, capture_output=False):
            wait_tunnel_ready(tunnel_url=config.get_url(), cfd_logs=str(log_file))
            assert_log_in_file(log_file)
            assert_json_log(log_file)
@@ -98,6 +98,6 @@ class TestLogging:
            "log-directory": str(log_dir),
        }
        config = component_tests_config(extra_config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True, capture_output=False):
+        with start_cloudflared(tmp_path, config, new_process=True, capture_output=False):
            wait_tunnel_ready(tunnel_url=config.get_url(), cfd_logs=str(log_dir))
            assert_log_to_dir(config, log_dir)
@@ -12,6 +12,6 @@ class TestPostQuantum:
    def test_post_quantum(self, tmp_path, component_tests_config):
        config = component_tests_config(self._extra_config())
        LOGGER.debug(config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], cfd_args=["run", "--post-quantum"], new_process=True):
+        with start_cloudflared(tmp_path, config, cfd_args=["run", "--post-quantum"], new_process=True):
            wait_tunnel_ready(tunnel_url=config.get_url(),
-                              require_min_connections=1)
+                              require_min_connections=4)
@@ -25,7 +25,7 @@ def run_test_scenario(tmp_path, component_tests_config, cfd_mode, run_proxy_dns)

    if cfd_mode == CfdModes.NAMED:
        expect_tunnel = True
-        pre_args = ["tunnel", "--ha-connections", "1"]
+        pre_args = ["tunnel"]
        args = ["run"]
    elif cfd_mode == CfdModes.PROXY_DNS:
        expect_proxy_dns = True
@@ -1,33 +0,0 @@
-#!/usr/bin/env python
-from conftest import CfdModes
-from constants import METRICS_PORT
-from util import LOGGER, start_cloudflared, wait_tunnel_ready, get_quicktunnel_url, send_requests
-
-class TestQuickTunnels:
-    def test_quick_tunnel(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=False)
-        LOGGER.debug(config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], cfd_args=["--hello-world"], new_process=True):
-            wait_tunnel_ready(require_min_connections=1)
-            url = get_quicktunnel_url()
-            send_requests(url, 3, True)
-    
-    def test_quick_tunnel_url(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=False)
-        LOGGER.debug(config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], cfd_args=["--url", f"http://localhost:{METRICS_PORT}/"], new_process=True):
-            wait_tunnel_ready(require_min_connections=1)
-            url = get_quicktunnel_url()
-            send_requests(url+"/ready", 3, True)
-
-    def test_quick_tunnel_proxy_dns_url(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=True)
-        LOGGER.debug(config)
-        failed_start = start_cloudflared(tmp_path, config, cfd_args=["--url", f"http://localhost:{METRICS_PORT}/"], expect_success=False)
-        assert failed_start.returncode == 1, "Expected cloudflared to fail to run with `proxy-dns` and `hello-world`"
-    
-    def test_quick_tunnel_proxy_dns_hello_world(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=True)
-        LOGGER.debug(config)
-        failed_start = start_cloudflared(tmp_path, config, cfd_args=["--hello-world"], expect_success=False)
-        assert failed_start.returncode == 1, "Expected cloudflared to fail to run with `proxy-dns` and `url`"
@@ -13,7 +13,7 @@ from util import start_cloudflared, wait_tunnel_ready, check_tunnel_not_connecte

@flaky(max_runs=3, min_passes=1)
 class TestReconnect:
-    default_ha_conns = 1
+    default_ha_conns = 4
    default_reconnect_secs = 15
    extra_config = {
        "stdin-control": True,
@@ -29,7 +29,7 @@ class TestReconnect:
    @pytest.mark.parametrize("protocol", protocols())
    def test_named_reconnect(self, tmp_path, component_tests_config, protocol):
        config = component_tests_config(self._extra_config(protocol))
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True, allow_input=True, capture_output=False) as cloudflared:
+        with start_cloudflared(tmp_path, config, new_process=True, allow_input=True, capture_output=False) as cloudflared:
            # Repeat the test multiple times because some issues only occur after multiple reconnects
            self.assert_reconnect(config, cloudflared, 5)

@@ -1,182 +0,0 @@
-#!/usr/bin/env python
-import asyncio
-import json
-import pytest
-import requests
-import websockets
-from websockets.client import connect, WebSocketClientProtocol
-from conftest import CfdModes
-from constants import MAX_RETRIES, BACKOFF_SECS
-from retrying import retry
-from cli import CloudflaredCli
-from util import LOGGER, start_cloudflared, write_config, wait_tunnel_ready
-
-class TestTail:
-    @pytest.mark.asyncio
-    async def test_start_stop_streaming(self, tmp_path, component_tests_config):
-        """
-        Validates that a websocket connection to management.argotunnel.com/logs can be opened
-        with the access token and start and stop streaming on-demand.
-        """
-        print("test_start_stop_streaming")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        config_path = write_config(tmp_path, config.full_config)
-        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
-            wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=1)
-            cfd_cli = CloudflaredCli(config, config_path, LOGGER)
-            url = cfd_cli.get_management_wsurl("logs", config, config_path)
-            async with connect(url, open_timeout=5, close_timeout=3) as websocket:
-                await websocket.send('{"type": "start_streaming"}')
-                await websocket.send('{"type": "stop_streaming"}')
-                await websocket.send('{"type": "start_streaming"}')
-                await websocket.send('{"type": "stop_streaming"}')
-
-    @pytest.mark.asyncio
-    async def test_streaming_logs(self, tmp_path, component_tests_config):
-        """
-        Validates that a streaming logs connection will stream logs
-        """
-        print("test_streaming_logs")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        config_path = write_config(tmp_path, config.full_config)
-        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
-            wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=1)
-            cfd_cli = CloudflaredCli(config, config_path, LOGGER)
-            url = cfd_cli.get_management_wsurl("logs", config, config_path)
-            async with connect(url, open_timeout=5, close_timeout=5) as websocket:
-                # send start_streaming
-                await websocket.send('{"type": "start_streaming"}')
-                # send some http requests to the tunnel to trigger some logs
-                await generate_and_validate_http_events(websocket, config.get_url(), 10)
-                # send stop_streaming
-                await websocket.send('{"type": "stop_streaming"}')
-
-    @pytest.mark.asyncio
-    async def test_streaming_logs_filters(self, tmp_path, component_tests_config):
-        """
-        Validates that a streaming logs connection will stream logs 
-        but not http when filters applied.
-        """
-        print("test_streaming_logs_filters")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        config_path = write_config(tmp_path, config.full_config)
-        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
-            wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=1)
-            cfd_cli = CloudflaredCli(config, config_path, LOGGER)
-            url = cfd_cli.get_management_wsurl("logs", config, config_path)
-            async with connect(url, open_timeout=5, close_timeout=5) as websocket:
-                # send start_streaming with tcp logs only
-                await websocket.send(json.dumps({
-                    "type": "start_streaming",
-                    "filters": {
-                        "events": ["tcp"],
-                        "level": "debug"
-                    }
-                }))
-                # don't expect any http logs
-                await generate_and_validate_no_log_event(websocket, config.get_url())
-                # send stop_streaming
-                await websocket.send('{"type": "stop_streaming"}')
-    
-    @pytest.mark.asyncio
-    async def test_streaming_logs_sampling(self, tmp_path, component_tests_config):
-        """
-        Validates that a streaming logs connection will stream logs with sampling.
-        """
-        print("test_streaming_logs_sampling")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        config_path = write_config(tmp_path, config.full_config)
-        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
-            wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=1)
-            cfd_cli = CloudflaredCli(config, config_path, LOGGER)
-            url = cfd_cli.get_management_wsurl("logs", config, config_path)
-            async with connect(url, open_timeout=5, close_timeout=5) as websocket:
-                # send start_streaming with info logs only
-                await websocket.send(json.dumps({
-                    "type": "start_streaming",
-                    "filters": {
-                        "sampling": 0.5
-                    }
-                }))
-                # don't expect any http logs
-                count = await generate_and_validate_http_events(websocket, config.get_url(), 10)
-                assert count < (10 * 2) # There are typically always two log lines for http requests (request and response)
-                # send stop_streaming
-                await websocket.send('{"type": "stop_streaming"}')
-
-    @pytest.mark.asyncio
-    async def test_streaming_logs_actor_override(self, tmp_path, component_tests_config):
-        """
-        Validates that a streaming logs session can be overriden by the same actor 
-        """
-        print("test_streaming_logs_actor_override")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        config_path = write_config(tmp_path, config.full_config)
-        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
-            wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=1)
-            cfd_cli = CloudflaredCli(config, config_path, LOGGER)
-            url = cfd_cli.get_management_wsurl("logs", config, config_path)
-            task = asyncio.ensure_future(start_streaming_to_be_remotely_closed(url))
-            override_task = asyncio.ensure_future(start_streaming_override(url))
-            await asyncio.wait([task, override_task])
-            assert task.exception() == None, task.exception()
-            assert override_task.exception() == None, override_task.exception()
-
-async def start_streaming_to_be_remotely_closed(url):
-    async with connect(url, open_timeout=5, close_timeout=5) as websocket:
-        try:
-            await websocket.send(json.dumps({"type": "start_streaming"}))
-            await asyncio.sleep(10)
-            assert websocket.closed, "expected this request to be forcibly closed by the override"
-        except websockets.ConnectionClosed:
-            # we expect the request to be closed
-            pass
-
-async def start_streaming_override(url):
-    # wait for the first connection to be established
-    await asyncio.sleep(1)
-    async with connect(url, open_timeout=5, close_timeout=5) as websocket:
-        await websocket.send(json.dumps({"type": "start_streaming"}))
-        await asyncio.sleep(1)
-        await websocket.send(json.dumps({"type": "stop_streaming"}))
-        await asyncio.sleep(1)
-
-# Every http request has two log lines sent
-async def generate_and_validate_http_events(websocket: WebSocketClientProtocol, url: str, count_send: int):
-    for i in range(count_send):
-        send_request(url)
-    # There are typically always two log lines for http requests (request and response)
-    count = 0
-    while True:
-        try:
-            req_line = await asyncio.wait_for(websocket.recv(), 2)
-            log_line = json.loads(req_line)
-            assert log_line["type"] == "logs"
-            assert log_line["logs"][0]["event"] == "http"
-            count += 1
-        except asyncio.TimeoutError:
-            # ignore timeout from waiting for recv
-            break
-    return count
-
-# Every http request has two log lines sent
-async def generate_and_validate_no_log_event(websocket: WebSocketClientProtocol, url: str):
-    send_request(url)
-    try:
-        # wait for 5 seconds and make sure we hit the timeout and not recv any events
-        req_line = await asyncio.wait_for(websocket.recv(), 5)
-        assert req_line == None, "expected no logs for the specified filters"
-    except asyncio.TimeoutError:
-        pass
-
-@retry(stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
-def send_request(url, headers={}):
-    with requests.Session() as s:
-        resp = s.get(url, timeout=BACKOFF_SECS, headers=headers)
-        assert resp.status_code == 200, f"{url} returned {resp}"
-        return resp.status_code == 200
@@ -34,7 +34,7 @@ class TestTermination:
    def test_graceful_shutdown(self, tmp_path, component_tests_config, signal, protocol):
        config = component_tests_config(self._extra_config(protocol))
        with start_cloudflared(
-                tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"],  new_process=True, capture_output=False) as cloudflared:
+                tmp_path, config, new_process=True, capture_output=False) as cloudflared:
            wait_tunnel_ready(tunnel_url=config.get_url())

            connected = threading.Condition()
@@ -56,7 +56,7 @@ class TestTermination:
    def test_shutdown_once_no_connection(self, tmp_path, component_tests_config, signal, protocol):
        config = component_tests_config(self._extra_config(protocol))
        with start_cloudflared(
-                tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True, capture_output=False) as cloudflared:
+                tmp_path, config, new_process=True, capture_output=False) as cloudflared:
            wait_tunnel_ready(tunnel_url=config.get_url())

            connected = threading.Condition()
@@ -76,7 +76,7 @@ class TestTermination:
    def test_no_connection_shutdown(self, tmp_path, component_tests_config, signal, protocol):
        config = component_tests_config(self._extra_config(protocol))
        with start_cloudflared(
-                tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True, capture_output=False) as cloudflared:
+                tmp_path, config, new_process=True, capture_output=False) as cloudflared:
            wait_tunnel_ready(tunnel_url=config.get_url())
            with self.within_grace_period():
                self.terminate_by_signal(cloudflared, signal)
@@ -1,77 +0,0 @@
-#!/usr/bin/env python
-import requests
-from conftest import CfdModes
-from constants import METRICS_PORT, MAX_RETRIES, BACKOFF_SECS
-from retrying import retry
-from cli import CloudflaredCli
-from util import LOGGER, write_config, start_cloudflared, wait_tunnel_ready, send_requests
-import platform
-
-class TestTunnel:
-    '''Test tunnels with no ingress rules from config.yaml but ingress rules from CLI only'''
-
-    def test_tunnel_hello_world(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"],  cfd_args=["run", "--hello-world"], new_process=True):
-            wait_tunnel_ready(tunnel_url=config.get_url(),
-                              require_min_connections=1)
-
-    """
-        test_get_host_details does the following:
-        1. It gets a management token from Tunnelstore using cloudflared tail token <tunnel_id>
-        2. It gets the connector_id after starting a cloudflare tunnel
-        3. It sends a request to the management host with the connector_id and management token
-        4. Asserts that the response has a hostname and ip.
-    """
-    def test_get_host_details(self, tmp_path, component_tests_config):
-        # TUN-7377 : wait_tunnel_ready does not work properly in windows.
-        # Skipping this test for windows for now and will address it as part of tun-7377
-        if platform.system() == "Windows":
-            return
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        headers = {}
-        headers["Content-Type"] = "application/json"
-        config_path = write_config(tmp_path, config.full_config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1", "--label" , "test"], cfd_args=["run", "--hello-world"], new_process=True):
-            wait_tunnel_ready(tunnel_url=config.get_url(),
-                              require_min_connections=1)
-            cfd_cli = CloudflaredCli(config, config_path, LOGGER)
-            connector_id = cfd_cli.get_connector_id(config)[0]
-            url = cfd_cli.get_management_url("host_details", config, config_path)
-            resp = send_request(url, headers=headers)
-            
-            # Assert response json.
-            assert resp.status_code == 200, "Expected cloudflared to return 200 for host details"
-            assert resp.json()["hostname"] == "custom:test", "Expected cloudflared to return hostname"
-            assert resp.json()["ip"] != "", "Expected cloudflared to return ip"
-            assert resp.json()["connector_id"] == connector_id, "Expected cloudflared to return connector_id"
-
-    
-    def test_tunnel_url(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"],  cfd_args=["run", "--url", f"http://localhost:{METRICS_PORT}/"], new_process=True):
-            wait_tunnel_ready(require_min_connections=1)
-            send_requests(config.get_url()+"/ready", 3, True)
-
-    def test_tunnel_no_ingress(self, tmp_path, component_tests_config):
-        '''
-        Running a tunnel with no ingress rules provided from either config.yaml or CLI will still work but return 503
-        for all incoming requests.
-        '''
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
-        LOGGER.debug(config)
-        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"],  cfd_args=["run"], new_process=True):
-            wait_tunnel_ready(require_min_connections=1)
-            resp = send_request(config.get_url()+"/")
-            assert resp.status_code == 503, "Expected cloudflared to return 503 for all requests with no ingress defined"
-            resp = send_request(config.get_url()+"/test")
-            assert resp.status_code == 503, "Expected cloudflared to return 503 for all requests with no ingress defined"
-
-
-@retry(stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
-def send_request(url, headers={}):
-    with requests.Session() as s:
-        return s.get(url, timeout=BACKOFF_SECS, headers=headers)
@@ -9,7 +9,6 @@ import pytest

 import requests
 import yaml
-import json
 from retrying import retry

 from constants import METRICS_PORT, MAX_RETRIES, BACKOFF_SECS
@@ -36,7 +35,7 @@ def write_config(directory, config):


 def start_cloudflared(directory, config, cfd_args=["run"], cfd_pre_args=["tunnel"], new_process=False,
-                      allow_input=False, capture_output=True, root=False, skip_config_flag=False, expect_success=True):
+                      allow_input=False, capture_output=True, root=False, skip_config_flag=False):

    config_path = None
    if not skip_config_flag:
@@ -47,7 +46,8 @@ def start_cloudflared(directory, config, cfd_args=["run"], cfd_pre_args=["tunnel
    if new_process:
        return run_cloudflared_background(cmd, allow_input, capture_output)
    # By setting check=True, it will raise an exception if the process exits with non-zero exit code
-    return subprocess.run(cmd, check=expect_success, capture_output=capture_output)
+    return subprocess.run(cmd, check=True, capture_output=capture_output)
+

 def cloudflared_cmd(config, config_path, cfd_args, cfd_pre_args, root):
    cmd = []
@@ -77,18 +77,7 @@ def run_cloudflared_background(cmd, allow_input, capture_output):
            cfd.terminate()
            if capture_output:
                LOGGER.info(f"cloudflared log: {cfd.stderr.read()}")
-    

-def get_quicktunnel_url():
-    quicktunnel_url = f'http://localhost:{METRICS_PORT}/quicktunnel'
-    with requests.Session() as s:
-        resp = send_request(s, quicktunnel_url, True)
-
-        hostname = resp.json()["hostname"]
-        assert hostname, \
-            f"Quicktunnel endpoint returned {hostname} but we expected a url"
-
-        return f"https://{hostname}"

 def wait_tunnel_ready(tunnel_url=None, require_min_connections=1, cfd_logs=None):
    try:
@@ -106,14 +95,13 @@ def inner_wait_tunnel_ready(tunnel_url=None, require_min_connections=1):
    with requests.Session() as s:
        resp = send_request(s, metrics_url, True)

-        ready_connections = resp.json()["readyConnections"]
-
-        assert ready_connections >= require_min_connections, \
+        assert resp.json()["readyConnections"] >= require_min_connections, \
            f"Ready endpoint returned {resp.json()} but we expect at least {require_min_connections} connections"

        if tunnel_url is not None:
            send_request(s, tunnel_url, True)

+
 def _log_cloudflared_logs(cfd_logs):
    log_file = cfd_logs
    if os.path.isdir(cfd_logs):
@@ -39,6 +39,8 @@ var (
 )

 const (
+	DefaultCredentialFile = "cert.pem"
+
 	// BastionFlag is to enable bastion, or jump host, operation
 	BastionFlag = "bastion"
 )
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"math"
-	"net"
 	"net/http"
 	"strconv"
 	"strings"
@@ -143,7 +142,6 @@ type TCPRequest struct {
 	LBProbe   bool
 	FlowID    string
 	CfTraceID string
-	ConnIndex uint8
 }

 // ReadWriteAcker is a readwriter with the ability to Acknowledge to the downstream (edge) that the origin has
@@ -198,55 +196,9 @@ func (h *HTTPResponseReadWriteAcker) AckConnection(tracePropagation string) erro
 	return h.w.WriteRespHeaders(resp.StatusCode, resp.Header)
 }

-// localProxyConnection emulates an incoming connection to cloudflared as a net.Conn.
-// Used when handling a "hijacked" connection from connection.ResponseWriter
-type localProxyConnection struct {
-	io.ReadWriteCloser
-}
-
-func (c *localProxyConnection) Read(b []byte) (int, error) {
-	return c.ReadWriteCloser.Read(b)
-}
-
-func (c *localProxyConnection) Write(b []byte) (int, error) {
-	return c.ReadWriteCloser.Write(b)
-}
-
-func (c *localProxyConnection) Close() error {
-	return c.ReadWriteCloser.Close()
-}
-
-func (c *localProxyConnection) LocalAddr() net.Addr {
-	// Unused LocalAddr
-	return &net.TCPAddr{IP: net.IPv6loopback, Port: 0, Zone: ""}
-}
-
-func (c *localProxyConnection) RemoteAddr() net.Addr {
-	// Unused RemoteAddr
-	return &net.TCPAddr{IP: net.IPv6loopback, Port: 0, Zone: ""}
-}
-
-func (c *localProxyConnection) SetDeadline(t time.Time) error {
-	// ignored since we can't set the read/write Deadlines for the tunnel back to origintunneld
-	return nil
-}
-
-func (c *localProxyConnection) SetReadDeadline(t time.Time) error {
-	// ignored since we can't set the read/write Deadlines for the tunnel back to origintunneld
-	return nil
-}
-
-func (c *localProxyConnection) SetWriteDeadline(t time.Time) error {
-	// ignored since we can't set the read/write Deadlines for the tunnel back to origintunneld
-	return nil
-}
-
-// ResponseWriter is the response path for a request back through cloudflared's tunnel.
 type ResponseWriter interface {
 	WriteRespHeaders(status int, header http.Header) error
 	AddTrailer(trailerName, trailerValue string)
-	http.ResponseWriter
-	http.Hijacker
 	io.Writer
 }

@@ -2,13 +2,13 @@ package connection

 import (
 	"context"
+	"fmt"
 	"io"
 	"net"
 	"time"

 	"github.com/rs/zerolog"

-	"github.com/cloudflare/cloudflared/management"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )

@@ -85,7 +85,7 @@ func (c *controlStream) ServeControlStream(
 		return err
 	}

-	c.observer.logConnected(registrationDetails.UUID, c.connIndex, registrationDetails.Location, c.edgeAddress, c.protocol)
+	c.observer.logServerInfo(c.connIndex, registrationDetails.Location, c.edgeAddress, fmt.Sprintf("Connection %s registered with protocol: %s", registrationDetails.UUID, c.protocol))
 	c.observer.sendConnectedEvent(c.connIndex, c.protocol, registrationDetails.Location)
 	c.connectedFuse.Connected()

@@ -116,11 +116,7 @@ func (c *controlStream) waitForUnregister(ctx context.Context, rpcClient NamedTu

 	c.observer.sendUnregisteringEvent(c.connIndex)
 	rpcClient.GracefulShutdown(ctx, c.gracePeriod)
-	c.observer.log.Info().
-		Int(management.EventTypeKey, int(management.Cloudflared)).
-		Uint8(LogFieldConnIndex, c.connIndex).
-		IPAddr(LogFieldIPAddress, c.edgeAddress).
-		Msg("Unregistered tunnel connection")
+	c.observer.log.Info().Uint8(LogFieldConnIndex, c.connIndex).Msg("Unregistered tunnel connection")
 }

 func (c *controlStream) IsStopped() bool {
@@ -1,17 +1,46 @@
 package connection

 import (
+	"context"
+	"io"
+	"net"
+	"net/http"
 	"time"

+	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
+	"golang.org/x/sync/errgroup"

 	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/tracing"
+	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
+	"github.com/cloudflare/cloudflared/websocket"
 )

 const (
-	muxerTimeout = 5 * time.Second
+	muxerTimeout      = 5 * time.Second
+	openStreamTimeout = 30 * time.Second
 )

+type h2muxConnection struct {
+	orchestrator Orchestrator
+	gracePeriod  time.Duration
+	muxerConfig  *MuxerConfig
+	muxer        *h2mux.Muxer
+	// connectionID is only used by metrics, and prometheus requires labels to be string
+	connIndexStr string
+	connIndex    uint8
+
+	observer          *Observer
+	gracefulShutdownC <-chan struct{}
+	stoppedGracefully bool
+
+	log *zerolog.Logger
+
+	// newRPCClientFunc allows us to mock RPCs during testing
+	newRPCClientFunc func(context.Context, io.ReadWriteCloser, *zerolog.Logger) NamedTunnelRPCClient
+}
+
 type MuxerConfig struct {
 	HeartbeatInterval  time.Duration
 	MaxHeartbeats      uint64
@@ -30,3 +59,180 @@ func (mc *MuxerConfig) H2MuxerConfig(h h2mux.MuxedStreamHandler, log *zerolog.Lo
 		CompressionQuality: mc.CompressionSetting,
 	}
 }
+
+// NewTunnelHandler returns a TunnelHandler, origin LAN IP and error
+func NewH2muxConnection(
+	orchestrator Orchestrator,
+	gracePeriod time.Duration,
+	muxerConfig *MuxerConfig,
+	edgeConn net.Conn,
+	connIndex uint8,
+	observer *Observer,
+	gracefulShutdownC <-chan struct{},
+	log *zerolog.Logger,
+) (*h2muxConnection, error, bool) {
+	h := &h2muxConnection{
+		orchestrator:      orchestrator,
+		gracePeriod:       gracePeriod,
+		muxerConfig:       muxerConfig,
+		connIndexStr:      uint8ToString(connIndex),
+		connIndex:         connIndex,
+		observer:          observer,
+		gracefulShutdownC: gracefulShutdownC,
+		newRPCClientFunc:  newRegistrationRPCClient,
+		log:               log,
+	}
+
+	// Establish a muxed connection with the edge
+	// Client mux handshake with agent server
+	muxer, err := h2mux.Handshake(edgeConn, edgeConn, *muxerConfig.H2MuxerConfig(h, observer.logTransport), h2mux.ActiveStreams)
+	if err != nil {
+		recoverable := isHandshakeErrRecoverable(err, connIndex, observer)
+		return nil, err, recoverable
+	}
+	h.muxer = muxer
+	return h, nil, false
+}
+
+func (h *h2muxConnection) ServeNamedTunnel(ctx context.Context, namedTunnel *NamedTunnelProperties, connOptions *tunnelpogs.ConnectionOptions, connectedFuse ConnectedFuse) error {
+	errGroup, serveCtx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		return h.serveMuxer(serveCtx)
+	})
+
+	errGroup.Go(func() error {
+		if err := h.registerNamedTunnel(serveCtx, namedTunnel, connOptions); err != nil {
+			return err
+		}
+		connectedFuse.Connected()
+		return nil
+	})
+
+	errGroup.Go(func() error {
+		h.controlLoop(serveCtx, connectedFuse, true)
+		return nil
+	})
+
+	err := errGroup.Wait()
+	if err == errMuxerStopped {
+		if h.stoppedGracefully {
+			return nil
+		}
+		h.observer.log.Info().Uint8(LogFieldConnIndex, h.connIndex).Msg("Unexpected muxer shutdown")
+	}
+	return err
+}
+
+func (h *h2muxConnection) serveMuxer(ctx context.Context) error {
+	// All routines should stop when muxer finish serving. When muxer is shutdown
+	// gracefully, it doesn't return an error, so we need to return errMuxerShutdown
+	// here to notify other routines to stop
+	err := h.muxer.Serve(ctx)
+	if err == nil {
+		return errMuxerStopped
+	}
+	return err
+}
+
+func (h *h2muxConnection) controlLoop(ctx context.Context, connectedFuse ConnectedFuse, isNamedTunnel bool) {
+	updateMetricsTicker := time.NewTicker(h.muxerConfig.MetricsUpdateFreq)
+	defer updateMetricsTicker.Stop()
+	var shutdownCompleted <-chan struct{}
+	for {
+		select {
+		case <-h.gracefulShutdownC:
+			if connectedFuse.IsConnected() {
+				h.unregister(isNamedTunnel)
+			}
+			h.stoppedGracefully = true
+			h.gracefulShutdownC = nil
+			shutdownCompleted = h.muxer.Shutdown()
+
+		case <-shutdownCompleted:
+			return
+
+		case <-ctx.Done():
+			// UnregisterTunnel blocks until the RPC call returns
+			if !h.stoppedGracefully && connectedFuse.IsConnected() {
+				h.unregister(isNamedTunnel)
+			}
+			h.muxer.Shutdown()
+			// don't wait for shutdown to finish when context is closed, this is the hard termination path
+			return
+
+		case <-updateMetricsTicker.C:
+			h.observer.metrics.updateMuxerMetrics(h.connIndexStr, h.muxer.Metrics())
+		}
+	}
+}
+
+func (h *h2muxConnection) newRPCStream(ctx context.Context, rpcName rpcName) (*h2mux.MuxedStream, error) {
+	openStreamCtx, openStreamCancel := context.WithTimeout(ctx, openStreamTimeout)
+	defer openStreamCancel()
+	stream, err := h.muxer.OpenRPCStream(openStreamCtx)
+	if err != nil {
+		return nil, err
+	}
+	return stream, nil
+}
+
+func (h *h2muxConnection) ServeStream(stream *h2mux.MuxedStream) error {
+	respWriter := &h2muxRespWriter{stream}
+
+	req, reqErr := h.newRequest(stream)
+	if reqErr != nil {
+		respWriter.WriteErrorResponse()
+		return reqErr
+	}
+
+	var sourceConnectionType = TypeHTTP
+	if websocket.IsWebSocketUpgrade(req) {
+		sourceConnectionType = TypeWebsocket
+	}
+
+	originProxy, err := h.orchestrator.GetOriginProxy()
+	if err != nil {
+		respWriter.WriteErrorResponse()
+		return err
+	}
+
+	err = originProxy.ProxyHTTP(respWriter, tracing.NewTracedHTTPRequest(req, h.log), sourceConnectionType == TypeWebsocket)
+	if err != nil {
+		respWriter.WriteErrorResponse()
+	}
+	return err
+}
+
+func (h *h2muxConnection) newRequest(stream *h2mux.MuxedStream) (*http.Request, error) {
+	req, err := http.NewRequest("GET", "http://localhost:8080", h2mux.MuxedStreamReader{MuxedStream: stream})
+	if err != nil {
+		return nil, errors.Wrap(err, "Unexpected error from http.NewRequest")
+	}
+	err = H2RequestHeadersToH1Request(stream.Headers, req)
+	if err != nil {
+		return nil, errors.Wrap(err, "invalid request received")
+	}
+	return req, nil
+}
+
+type h2muxRespWriter struct {
+	*h2mux.MuxedStream
+}
+
+func (rp *h2muxRespWriter) AddTrailer(trailerName, trailerValue string) {
+	// do nothing. we don't support trailers over h2mux
+}
+
+func (rp *h2muxRespWriter) WriteRespHeaders(status int, header http.Header) error {
+	headers := H1ResponseToH2ResponseHeaders(status, header)
+	headers = append(headers, h2mux.Header{Name: ResponseMetaHeader, Value: responseMetaHeaderOrigin})
+	return rp.WriteHeaders(headers)
+}
+
+func (rp *h2muxRespWriter) WriteErrorResponse() {
+	_ = rp.WriteHeaders([]h2mux.Header{
+		{Name: ":status", Value: "502"},
+		{Name: ResponseMetaHeader, Value: responseMetaHeaderCfd},
+	})
+	_, _ = rp.Write([]byte("502 Bad Gateway"))
+}
@@ -0,0 +1,301 @@
+package connection
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gobwas/ws/wsutil"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+)
+
+var (
+	testMuxerConfig = &MuxerConfig{
+		HeartbeatInterval:  time.Second * 5,
+		MaxHeartbeats:      5,
+		CompressionSetting: 0,
+		MetricsUpdateFreq:  time.Second * 5,
+	}
+)
+
+func newH2MuxConnection(t require.TestingT) (*h2muxConnection, *h2mux.Muxer) {
+	edgeConn, originConn := net.Pipe()
+	edgeMuxChan := make(chan *h2mux.Muxer)
+	go func() {
+		edgeMuxConfig := h2mux.MuxerConfig{
+			Log: &log,
+			Handler: h2mux.MuxedStreamFunc(func(stream *h2mux.MuxedStream) error {
+				// we only expect RPC traffic in client->edge direction, provide minimal support for mocking
+				require.True(t, stream.IsRPCStream())
+				return stream.WriteHeaders([]h2mux.Header{
+					{Name: ":status", Value: "200"},
+				})
+			}),
+		}
+		edgeMux, err := h2mux.Handshake(edgeConn, edgeConn, edgeMuxConfig, h2mux.ActiveStreams)
+		require.NoError(t, err)
+		edgeMuxChan <- edgeMux
+	}()
+	var connIndex = uint8(0)
+	testObserver := NewObserver(&log, &log)
+	h2muxConn, err, _ := NewH2muxConnection(testOrchestrator, testGracePeriod, testMuxerConfig, originConn, connIndex, testObserver, nil, &log)
+	require.NoError(t, err)
+	return h2muxConn, <-edgeMuxChan
+}
+
+func TestServeStreamHTTP(t *testing.T) {
+	tests := []testRequest{
+		{
+			name:           "ok",
+			endpoint:       "/ok",
+			expectedStatus: http.StatusOK,
+			expectedBody:   []byte(http.StatusText(http.StatusOK)),
+		},
+		{
+			name:           "large_file",
+			endpoint:       "/large_file",
+			expectedStatus: http.StatusOK,
+			expectedBody:   testLargeResp,
+		},
+		{
+			name:           "Bad request",
+			endpoint:       "/400",
+			expectedStatus: http.StatusBadRequest,
+			expectedBody:   []byte(http.StatusText(http.StatusBadRequest)),
+		},
+		{
+			name:           "Internal server error",
+			endpoint:       "/500",
+			expectedStatus: http.StatusInternalServerError,
+			expectedBody:   []byte(http.StatusText(http.StatusInternalServerError)),
+		},
+		{
+			name:           "Proxy error",
+			endpoint:       "/error",
+			expectedStatus: http.StatusBadGateway,
+			expectedBody:   nil,
+			isProxyError:   true,
+		},
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h2muxConn, edgeMux := newH2MuxConnection(t)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		_ = edgeMux.Serve(ctx)
+	}()
+	go func() {
+		defer wg.Done()
+		err := h2muxConn.serveMuxer(ctx)
+		require.Error(t, err)
+	}()
+
+	for _, test := range tests {
+		headers := []h2mux.Header{
+			{
+				Name:  ":path",
+				Value: test.endpoint,
+			},
+		}
+		stream, err := edgeMux.OpenStream(ctx, headers, nil)
+		require.NoError(t, err)
+		require.True(t, hasHeader(stream, ":status", strconv.Itoa(test.expectedStatus)))
+
+		if test.isProxyError {
+			assert.True(t, hasHeader(stream, ResponseMetaHeader, responseMetaHeaderCfd))
+		} else {
+			assert.True(t, hasHeader(stream, ResponseMetaHeader, responseMetaHeaderOrigin))
+			body := make([]byte, len(test.expectedBody))
+			_, err = stream.Read(body)
+			require.NoError(t, err)
+			require.Equal(t, test.expectedBody, body)
+		}
+	}
+	cancel()
+	wg.Wait()
+}
+
+func TestServeStreamWS(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	h2muxConn, edgeMux := newH2MuxConnection(t)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		edgeMux.Serve(ctx)
+	}()
+	go func() {
+		defer wg.Done()
+		err := h2muxConn.serveMuxer(ctx)
+		require.Error(t, err)
+	}()
+
+	headers := []h2mux.Header{
+		{
+			Name:  ":path",
+			Value: "/ws/echo",
+		},
+		{
+			Name:  "connection",
+			Value: "upgrade",
+		},
+		{
+			Name:  "upgrade",
+			Value: "websocket",
+		},
+	}
+
+	readPipe, writePipe := io.Pipe()
+	stream, err := edgeMux.OpenStream(ctx, headers, readPipe)
+	require.NoError(t, err)
+
+	require.True(t, hasHeader(stream, ":status", strconv.Itoa(http.StatusSwitchingProtocols)))
+	assert.True(t, hasHeader(stream, ResponseMetaHeader, responseMetaHeaderOrigin))
+
+	data := []byte("test websocket")
+	err = wsutil.WriteClientBinary(writePipe, data)
+	require.NoError(t, err)
+
+	respBody, err := wsutil.ReadServerBinary(stream)
+	require.NoError(t, err)
+	require.Equal(t, data, respBody, fmt.Sprintf("Expect %s, got %s", string(data), string(respBody)))
+
+	cancel()
+	wg.Wait()
+}
+
+func TestGracefulShutdownH2Mux(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	h2muxConn, edgeMux := newH2MuxConnection(t)
+
+	shutdownC := make(chan struct{})
+	unregisteredC := make(chan struct{})
+	h2muxConn.gracefulShutdownC = shutdownC
+	h2muxConn.newRPCClientFunc = func(_ context.Context, _ io.ReadWriteCloser, _ *zerolog.Logger) NamedTunnelRPCClient {
+		return &mockNamedTunnelRPCClient{
+			registered:   nil,
+			unregistered: unregisteredC,
+		}
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(3)
+	go func() {
+		defer wg.Done()
+		_ = edgeMux.Serve(ctx)
+	}()
+	go func() {
+		defer wg.Done()
+		_ = h2muxConn.serveMuxer(ctx)
+	}()
+
+	go func() {
+		defer wg.Done()
+		h2muxConn.controlLoop(ctx, &mockConnectedFuse{}, true)
+	}()
+
+	time.Sleep(100 * time.Millisecond)
+	close(shutdownC)
+
+	select {
+	case <-unregisteredC:
+		break // ok
+	case <-time.Tick(time.Second):
+		assert.Fail(t, "timed out waiting for control loop to unregister")
+	}
+
+	cancel()
+	wg.Wait()
+
+	assert.True(t, h2muxConn.stoppedGracefully)
+	assert.Nil(t, h2muxConn.gracefulShutdownC)
+}
+
+func hasHeader(stream *h2mux.MuxedStream, name, val string) bool {
+	for _, header := range stream.Headers {
+		if header.Name == name && header.Value == val {
+			return true
+		}
+	}
+	return false
+}
+
+func benchmarkServeStreamHTTPSimple(b *testing.B, test testRequest) {
+	ctx, cancel := context.WithCancel(context.Background())
+	h2muxConn, edgeMux := newH2MuxConnection(b)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		edgeMux.Serve(ctx)
+	}()
+	go func() {
+		defer wg.Done()
+		err := h2muxConn.serveMuxer(ctx)
+		require.Error(b, err)
+	}()
+
+	headers := []h2mux.Header{
+		{
+			Name:  ":path",
+			Value: test.endpoint,
+		},
+	}
+
+	body := make([]byte, len(test.expectedBody))
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		b.StartTimer()
+		stream, openstreamErr := edgeMux.OpenStream(ctx, headers, nil)
+		_, readBodyErr := stream.Read(body)
+		b.StopTimer()
+
+		require.NoError(b, openstreamErr)
+		assert.True(b, hasHeader(stream, ResponseMetaHeader, responseMetaHeaderOrigin))
+		require.True(b, hasHeader(stream, ":status", strconv.Itoa(http.StatusOK)))
+		require.NoError(b, readBodyErr)
+		require.Equal(b, test.expectedBody, body)
+	}
+
+	cancel()
+	wg.Wait()
+}
+
+func BenchmarkServeStreamHTTPSimple(b *testing.B) {
+	test := testRequest{
+		name:           "ok",
+		endpoint:       "/ok",
+		expectedStatus: http.StatusOK,
+		expectedBody:   []byte(http.StatusText(http.StatusOK)),
+	}
+
+	benchmarkServeStreamHTTPSimple(b, test)
+}
+
+func BenchmarkServeStreamHTTPLargeFile(b *testing.B) {
+	test := testRequest{
+		name:           "large_file",
+		endpoint:       "/large_file",
+		expectedStatus: http.StatusOK,
+		expectedBody:   testLargeResp,
+	}
+
+	benchmarkServeStreamHTTPSimple(b, test)
+}
@@ -1,7 +1,6 @@
 package connection

 import (
-	"bufio"
 	"context"
 	gojson "encoding/json"
 	"fmt"
@@ -130,7 +129,7 @@ func (c *HTTP2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case TypeWebsocket, TypeHTTP:
 		stripWebsocketUpgradeHeader(r)
 		// Check for tracing on request
-		tr := tracing.NewTracedHTTPRequest(r, c.connIndex, c.log)
+		tr := tracing.NewTracedHTTPRequest(r, c.log)
 		if err := originProxy.ProxyHTTP(respWriter, tr, connType == TypeWebsocket); err != nil {
 			requestErr = fmt.Errorf("Failed to proxy HTTP: %w", err)
 		}
@@ -148,7 +147,6 @@ func (c *HTTP2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			CFRay:     FindCfRayHeader(r),
 			LBProbe:   IsLBProbeRequest(r),
 			CfTraceID: r.Header.Get(tracing.TracerContextName),
-			ConnIndex: c.connIndex,
 		})

 	default:
@@ -198,9 +196,6 @@ type http2RespWriter struct {
 	flusher       http.Flusher
 	shouldFlush   bool
 	statusWritten bool
-	respHeaders   http.Header
-	hijackedMutex sync.Mutex
-	hijackedv     bool
 	log           *zerolog.Logger
 }

@@ -221,7 +216,6 @@ func NewHTTP2RespWriter(r *http.Request, w http.ResponseWriter, connType Type, l
 		w:           w,
 		flusher:     flusher,
 		shouldFlush: connType.shouldFlush(),
-		respHeaders: make(http.Header),
 		log:         log,
 	}, nil
 }
@@ -236,10 +230,6 @@ func (rp *http2RespWriter) AddTrailer(trailerName, trailerValue string) {
 }

 func (rp *http2RespWriter) WriteRespHeaders(status int, header http.Header) error {
-	if rp.hijacked() {
-		rp.log.Warn().Msg("WriteRespHeaders after hijack")
-		return nil
-	}
 	dest := rp.w.Header()
 	userHeaders := make(http.Header, len(header))
 	for name, values := range header {
@@ -285,48 +275,6 @@ func (rp *http2RespWriter) WriteRespHeaders(status int, header http.Header) erro
 	return nil
 }

-func (rp *http2RespWriter) Header() http.Header {
-	return rp.respHeaders
-}
-
-func (rp *http2RespWriter) WriteHeader(status int) {
-	if rp.hijacked() {
-		rp.log.Warn().Msg("WriteHeader after hijack")
-		return
-	}
-	rp.WriteRespHeaders(status, rp.respHeaders)
-}
-
-func (rp *http2RespWriter) hijacked() bool {
-	rp.hijackedMutex.Lock()
-	defer rp.hijackedMutex.Unlock()
-	return rp.hijackedv
-}
-
-func (rp *http2RespWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	if !rp.statusWritten {
-		return nil, nil, fmt.Errorf("status not yet written before attempting to hijack connection")
-	}
-	// Make sure to flush anything left in the buffer before hijacking
-	if rp.shouldFlush {
-		rp.flusher.Flush()
-	}
-	rp.hijackedMutex.Lock()
-	defer rp.hijackedMutex.Unlock()
-	if rp.hijackedv {
-		return nil, nil, http.ErrHijacked
-	}
-	rp.hijackedv = true
-	conn := &localProxyConnection{rp}
-	// We return the http2RespWriter here because we want to make sure that we flush after every write
-	// otherwise the HTTP2 write buffer waits a few seconds before sending.
-	readWriter := bufio.NewReadWriter(
-		bufio.NewReader(rp),
-		bufio.NewWriter(rp),
-	)
-	return conn, readWriter, nil
-}
-
 func (rp *http2RespWriter) WriteErrorResponse() bool {
 	if rp.statusWritten {
 		return false
@@ -4,17 +4,12 @@ import (
 	"net"
 	"strings"

-	"github.com/google/uuid"
 	"github.com/rs/zerolog"
-
-	"github.com/cloudflare/cloudflared/management"
 )

 const (
-	LogFieldConnectionID      = "connection"
 	LogFieldLocation          = "location"
 	LogFieldIPAddress         = "ip"
-	LogFieldProtocol          = "protocol"
 	observerChannelBufferSize = 16
 )

@@ -46,16 +41,13 @@ func (o *Observer) RegisterSink(sink EventSink) {
 	o.addSinkChan <- sink
 }

-func (o *Observer) logConnected(connectionID uuid.UUID, connIndex uint8, location string, address net.IP, protocol Protocol) {
+func (o *Observer) logServerInfo(connIndex uint8, location string, address net.IP, msg string) {
 	o.sendEvent(Event{Index: connIndex, EventType: Connected, Location: location})
 	o.log.Info().
-		Int(management.EventTypeKey, int(management.Cloudflared)).
-		Str(LogFieldConnectionID, connectionID.String()).
 		Uint8(LogFieldConnIndex, connIndex).
 		Str(LogFieldLocation, location).
 		IPAddr(LogFieldIPAddress, address).
-		Str(LogFieldProtocol, protocol.String()).
-		Msg("Registered tunnel connection")
+		Msg(msg)
 	o.metrics.registerServerLocation(uint8ToString(connIndex), location)
 }

@@ -1,6 +1,7 @@
 package connection

 import (
+	"errors"
 	"fmt"
 	"hash/fnv"
 	"sync"
@@ -12,7 +13,7 @@ import (
 )

 const (
-	AvailableProtocolFlagMessage = "Available protocols: 'auto' - automatically chooses the best protocol over time (the default; and also the recommended one); 'quic' - based on QUIC, relying on UDP egress to Cloudflare edge; 'http2' - using Go's HTTP2 library, relying on TCP egress to Cloudflare edge"
+	AvailableProtocolFlagMessage = "Available protocols: 'auto' - automatically chooses the best protocol over time (the default; and also the recommended one); 'quic' - based on QUIC, relying on UDP egress to Cloudflare edge; 'http2' - using Go's HTTP2 library, relying on TCP egress to Cloudflare edge; 'h2mux' - Cloudflare's implementation of HTTP/2, deprecated"
 	// edgeH2muxTLSServerName is the server name to establish h2mux connection with edge
 	edgeH2muxTLSServerName = "cftunnel.com"
 	// edgeH2TLSServerName is the server name to establish http2 connection with edge
@@ -20,32 +21,43 @@ const (
 	// edgeQUICServerName is the server name to establish quic connection with edge.
 	edgeQUICServerName = "quic.cftunnel.com"
 	AutoSelectFlag     = "auto"
-	// SRV and TXT record resolution TTL
-	ResolveTTL = time.Hour
 )

 var (
-	// ProtocolList represents a list of supported protocols for communication with the edge
-	// in order of precedence for remote percentage fetcher.
-	ProtocolList = []Protocol{QUIC, HTTP2}
+	// ProtocolList represents a list of supported protocols for communication with the edge.
+	ProtocolList = []Protocol{H2mux, HTTP2, HTTP2Warp, QUIC, QUICWarp}
 )

 type Protocol int64

 const (
-	// HTTP2 using golang HTTP2 library for edge connections.
-	HTTP2 Protocol = iota
-	// QUIC using quic-go for edge connections.
+	// H2mux protocol can be used both with Classic and Named Tunnels. .
+	H2mux Protocol = iota
+	// HTTP2 is used only with named tunnels. It's more efficient than H2mux for L4 proxying.
+	HTTP2
+	// QUIC is used only with named tunnels.
 	QUIC
+	// HTTP2Warp is used only with named tunnels. It's useful for warp-routing where we don't want to fallback to
+	// H2mux on HTTP2 failure to connect.
+	HTTP2Warp
+	//QUICWarp is used only with named tunnels. It's useful for warp-routing where we want to fallback to HTTP2 but
+	// don't want HTTP2 to fallback to H2mux
+	QUICWarp
 )

 // Fallback returns the fallback protocol and whether the protocol has a fallback
 func (p Protocol) fallback() (Protocol, bool) {
 	switch p {
+	case H2mux:
+		return 0, false
 	case HTTP2:
+		return H2mux, true
+	case HTTP2Warp:
 		return 0, false
 	case QUIC:
 		return HTTP2, true
+	case QUICWarp:
+		return HTTP2Warp, true
 	default:
 		return 0, false
 	}
@@ -53,9 +65,11 @@ func (p Protocol) fallback() (Protocol, bool) {

 func (p Protocol) String() string {
 	switch p {
-	case HTTP2:
+	case H2mux:
+		return "h2mux"
+	case HTTP2, HTTP2Warp:
 		return "http2"
-	case QUIC:
+	case QUIC, QUICWarp:
 		return "quic"
 	default:
 		return fmt.Sprintf("unknown protocol")
@@ -64,11 +78,15 @@ func (p Protocol) String() string {

 func (p Protocol) TLSSettings() *TLSSettings {
 	switch p {
-	case HTTP2:
+	case H2mux:
+		return &TLSSettings{
+			ServerName: edgeH2muxTLSServerName,
+		}
+	case HTTP2, HTTP2Warp:
 		return &TLSSettings{
 			ServerName: edgeH2TLSServerName,
 		}
-	case QUIC:
+	case QUIC, QUICWarp:
 		return &TLSSettings{
 			ServerName: edgeQUICServerName,
 			NextProtos: []string{"argotunnel"},
@@ -88,7 +106,6 @@ type ProtocolSelector interface {
 	Fallback() (Protocol, bool)
 }

-// staticProtocolSelector will not provide a different protocol for Fallback
 type staticProtocolSelector struct {
 	current Protocol
 }
@@ -98,11 +115,10 @@ func (s *staticProtocolSelector) Current() Protocol {
 }

 func (s *staticProtocolSelector) Fallback() (Protocol, bool) {
-	return s.current, false
+	return 0, false
 }

-// remoteProtocolSelector will fetch a list of remote protocols to provide for edge discovery
-type remoteProtocolSelector struct {
+type autoProtocolSelector struct {
 	lock sync.RWMutex

 	current Protocol
@@ -111,21 +127,23 @@ type remoteProtocolSelector struct {
 	protocolPool []Protocol

 	switchThreshold int32
-	fetchFunc       edgediscovery.PercentageFetcher
+	fetchFunc       PercentageFetcher
 	refreshAfter    time.Time
 	ttl             time.Duration
 	log             *zerolog.Logger
+	needPQ          bool
 }

-func newRemoteProtocolSelector(
+func newAutoProtocolSelector(
 	current Protocol,
 	protocolPool []Protocol,
 	switchThreshold int32,
-	fetchFunc edgediscovery.PercentageFetcher,
+	fetchFunc PercentageFetcher,
 	ttl time.Duration,
 	log *zerolog.Logger,
-) *remoteProtocolSelector {
-	return &remoteProtocolSelector{
+	needPQ bool,
+) *autoProtocolSelector {
+	return &autoProtocolSelector{
 		current:         current,
 		protocolPool:    protocolPool,
 		switchThreshold: switchThreshold,
@@ -133,10 +151,11 @@ func newRemoteProtocolSelector(
 		refreshAfter:    time.Now().Add(ttl),
 		ttl:             ttl,
 		log:             log,
+		needPQ:          needPQ,
 	}
 }

-func (s *remoteProtocolSelector) Current() Protocol {
+func (s *autoProtocolSelector) Current() Protocol {
 	s.lock.Lock()
 	defer s.lock.Unlock()
 	if time.Now().Before(s.refreshAfter) {
@@ -154,13 +173,7 @@ func (s *remoteProtocolSelector) Current() Protocol {
 	return s.current
 }

-func (s *remoteProtocolSelector) Fallback() (Protocol, bool) {
-	s.lock.RLock()
-	defer s.lock.RUnlock()
-	return s.current.fallback()
-}
-
-func getProtocol(protocolPool []Protocol, fetchFunc edgediscovery.PercentageFetcher, switchThreshold int32) (Protocol, error) {
+func getProtocol(protocolPool []Protocol, fetchFunc PercentageFetcher, switchThreshold int32) (Protocol, error) {
 	protocolPercentages, err := fetchFunc()
 	if err != nil {
 		return 0, err
@@ -172,78 +185,112 @@ func getProtocol(protocolPool []Protocol, fetchFunc edgediscovery.PercentageFetc
 		}
 	}

-	// Default to first index in protocolPool list
-	return protocolPool[0], nil
+	return protocolPool[len(protocolPool)-1], nil
 }

-// defaultProtocolSelector will allow for a protocol to have a fallback
-type defaultProtocolSelector struct {
-	lock    sync.RWMutex
-	current Protocol
-}
-
-func newDefaultProtocolSelector(
-	current Protocol,
-) *defaultProtocolSelector {
-	return &defaultProtocolSelector{
-		current: current,
-	}
-}
-
-func (s *defaultProtocolSelector) Current() Protocol {
-	s.lock.Lock()
-	defer s.lock.Unlock()
-	return s.current
-}
-
-func (s *defaultProtocolSelector) Fallback() (Protocol, bool) {
+func (s *autoProtocolSelector) Fallback() (Protocol, bool) {
 	s.lock.RLock()
 	defer s.lock.RUnlock()
+	if s.needPQ {
+		return 0, false
+	}
 	return s.current.fallback()
 }

+type PercentageFetcher func() (edgediscovery.ProtocolPercents, error)
+
 func NewProtocolSelector(
 	protocolFlag string,
-	accountTag string,
-	tunnelTokenProvided bool,
-	needPQ bool,
-	protocolFetcher edgediscovery.PercentageFetcher,
-	resolveTTL time.Duration,
+	warpRoutingEnabled bool,
+	namedTunnel *NamedTunnelProperties,
+	fetchFunc PercentageFetcher,
+	ttl time.Duration,
 	log *zerolog.Logger,
+	needPQ bool,
 ) (ProtocolSelector, error) {
-	// With --post-quantum, we force quic
-	if needPQ {
+	// Classic tunnel is only supported with h2mux
+	if namedTunnel == nil {
+		if needPQ {
+			return nil, errors.New("Classic tunnel does not support post-quantum")
+		}
+
 		return &staticProtocolSelector{
-			current: QUIC,
+			current: H2mux,
 		}, nil
 	}

-	threshold := switchThreshold(accountTag)
-	fetchedProtocol, err := getProtocol(ProtocolList, protocolFetcher, threshold)
-	log.Debug().Msgf("Fetched protocol: %s", fetchedProtocol)
-	if err != nil {
-		log.Warn().Msg("Unable to lookup protocol percentage.")
-		// Falling through here since 'auto' is handled in the switch and failing
-		// to do the protocol lookup isn't a failure since it can be triggered again
-		// after the TTL.
+	threshold := switchThreshold(namedTunnel.Credentials.AccountTag)
+	fetchedProtocol, err := getProtocol([]Protocol{QUIC, HTTP2}, fetchFunc, threshold)
+	if err != nil && protocolFlag == "auto" {
+		log.Err(err).Msg("Unable to lookup protocol. Defaulting to `http2`. If this fails, you can attempt `--protocol quic` instead.")
+		if needPQ {
+			return nil, errors.New("http2 does not support post-quantum")
+		}
+		return &staticProtocolSelector{
+			current: HTTP2,
+		}, nil
+	}
+	if warpRoutingEnabled {
+		if protocolFlag == H2mux.String() || fetchedProtocol == H2mux {
+			log.Warn().Msg("Warp routing is not supported in h2mux protocol. Upgrading to http2 to allow it.")
+			protocolFlag = HTTP2.String()
+			fetchedProtocol = HTTP2Warp
+		}
+		return selectWarpRoutingProtocols(protocolFlag, fetchFunc, ttl, log, threshold, fetchedProtocol, needPQ)
 	}

+	return selectNamedTunnelProtocols(protocolFlag, fetchFunc, ttl, log, threshold, fetchedProtocol, needPQ)
+}
+
+func selectNamedTunnelProtocols(
+	protocolFlag string,
+	fetchFunc PercentageFetcher,
+	ttl time.Duration,
+	log *zerolog.Logger,
+	threshold int32,
+	protocol Protocol,
+	needPQ bool,
+) (ProtocolSelector, error) {
 	// If the user picks a protocol, then we stick to it no matter what.
 	switch protocolFlag {
-	case "h2mux":
-		// Any users still requesting h2mux will be upgraded to http2 instead
-		log.Warn().Msg("h2mux is no longer a supported protocol: upgrading edge connection to http2. Please remove '--protocol h2mux' from runtime arguments to remove this warning.")
-		return &staticProtocolSelector{current: HTTP2}, nil
+	case H2mux.String():
+		return &staticProtocolSelector{current: H2mux}, nil
 	case QUIC.String():
 		return &staticProtocolSelector{current: QUIC}, nil
 	case HTTP2.String():
 		return &staticProtocolSelector{current: HTTP2}, nil
-	case AutoSelectFlag:
-		// When a --token is provided, we want to start with QUIC but have fallback to HTTP2
-		if tunnelTokenProvided {
-			return newDefaultProtocolSelector(QUIC), nil
-		}
-		return newRemoteProtocolSelector(fetchedProtocol, ProtocolList, threshold, protocolFetcher, resolveTTL, log), nil
+	}
+
+	// If the user does not pick (hopefully the majority) then we use the one derived from the TXT DNS record and
+	// fallback on failures.
+	if protocolFlag == AutoSelectFlag {
+		return newAutoProtocolSelector(protocol, []Protocol{QUIC, HTTP2, H2mux}, threshold, fetchFunc, ttl, log, needPQ), nil
+	}
+
+	return nil, fmt.Errorf("Unknown protocol %s, %s", protocolFlag, AvailableProtocolFlagMessage)
+}
+
+func selectWarpRoutingProtocols(
+	protocolFlag string,
+	fetchFunc PercentageFetcher,
+	ttl time.Duration,
+	log *zerolog.Logger,
+	threshold int32,
+	protocol Protocol,
+	needPQ bool,
+) (ProtocolSelector, error) {
+	// If the user picks a protocol, then we stick to it no matter what.
+	switch protocolFlag {
+	case QUIC.String():
+		return &staticProtocolSelector{current: QUICWarp}, nil
+	case HTTP2.String():
+		return &staticProtocolSelector{current: HTTP2Warp}, nil
+	}
+
+	// If the user does not pick (hopefully the majority) then we use the one derived from the TXT DNS record and
+	// fallback on failures.
+	if protocolFlag == AutoSelectFlag {
+		return newAutoProtocolSelector(protocol, []Protocol{QUICWarp, HTTP2Warp}, threshold, fetchFunc, ttl, log, needPQ), nil
 	}

 	return nil, fmt.Errorf("Unknown protocol %s, %s", protocolFlag, AvailableProtocolFlagMessage)
@@ -3,6 +3,7 @@ package connection
 import (
 	"fmt"
 	"testing"
+	"time"

 	"github.com/stretchr/testify/assert"

@@ -10,11 +11,19 @@ import (
 )

 const (
-	testNoTTL      = 0
-	testAccountTag = "testAccountTag"
+	testNoTTL            = 0
+	noWarpRoutingEnabled = false
 )

-func mockFetcher(getError bool, protocolPercent ...edgediscovery.ProtocolPercent) edgediscovery.PercentageFetcher {
+var (
+	testNamedTunnelProperties = &NamedTunnelProperties{
+		Credentials: Credentials{
+			AccountTag: "testAccountTag",
+		},
+	}
+)
+
+func mockFetcher(getError bool, protocolPercent ...edgediscovery.ProtocolPercent) PercentageFetcher {
 	return func() (edgediscovery.ProtocolPercents, error) {
 		if getError {
 			return nil, fmt.Errorf("failed to fetch percentage")
@@ -28,7 +37,7 @@ type dynamicMockFetcher struct {
 	err              error
 }

-func (dmf *dynamicMockFetcher) fetch() edgediscovery.PercentageFetcher {
+func (dmf *dynamicMockFetcher) fetch() PercentageFetcher {
 	return func() (edgediscovery.ProtocolPercents, error) {
 		return dmf.protocolPercents, dmf.err
 	}
@@ -36,58 +45,181 @@ func (dmf *dynamicMockFetcher) fetch() edgediscovery.PercentageFetcher {

 func TestNewProtocolSelector(t *testing.T) {
 	tests := []struct {
-		name                string
-		protocol            string
-		tunnelTokenProvided bool
-		needPQ              bool
-		expectedProtocol    Protocol
-		hasFallback         bool
-		expectedFallback    Protocol
-		wantErr             bool
+		name               string
+		protocol           string
+		expectedProtocol   Protocol
+		hasFallback        bool
+		expectedFallback   Protocol
+		warpRoutingEnabled bool
+		namedTunnelConfig  *NamedTunnelProperties
+		fetchFunc          PercentageFetcher
+		wantErr            bool
 	}{
 		{
-			name:     "named tunnel with unknown protocol",
-			protocol: "unknown",
-			wantErr:  true,
+			name:              "classic tunnel",
+			protocol:          "h2mux",
+			expectedProtocol:  H2mux,
+			namedTunnelConfig: nil,
 		},
 		{
-			name:             "named tunnel with h2mux: force to http2",
-			protocol:         "h2mux",
-			expectedProtocol: HTTP2,
+			name:              "named tunnel over h2mux",
+			protocol:          "h2mux",
+			expectedProtocol:  H2mux,
+			fetchFunc:         func() (edgediscovery.ProtocolPercents, error) { return nil, nil },
+			namedTunnelConfig: testNamedTunnelProperties,
 		},
 		{
-			name:             "named tunnel with http2: no fallback",
-			protocol:         "http2",
-			expectedProtocol: HTTP2,
+			name:              "named tunnel over http2",
+			protocol:          "http2",
+			expectedProtocol:  HTTP2,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}),
+			namedTunnelConfig: testNamedTunnelProperties,
 		},
 		{
-			name:             "named tunnel with auto: quic",
+			name:              "named tunnel http2 disabled still gets http2 because it is manually picked",
+			protocol:          "http2",
+			expectedProtocol:  HTTP2,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}),
+			namedTunnelConfig: testNamedTunnelProperties,
+		},
+		{
+			name:              "named tunnel quic disabled still gets quic because it is manually picked",
+			protocol:          "quic",
+			expectedProtocol:  QUIC,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: -1}),
+			namedTunnelConfig: testNamedTunnelProperties,
+		},
+		{
+			name:              "named tunnel quic and http2 disabled",
+			protocol:          AutoSelectFlag,
+			expectedProtocol:  H2mux,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: -1}),
+			namedTunnelConfig: testNamedTunnelProperties,
+		},
+		{
+			name:             "named tunnel quic disabled",
 			protocol:         AutoSelectFlag,
-			expectedProtocol: QUIC,
-			hasFallback:      true,
-			expectedFallback: HTTP2,
+			expectedProtocol: HTTP2,
+			// Hasfallback true is because if http2 fails, then we further fallback to h2mux.
+			hasFallback:       true,
+			expectedFallback:  H2mux,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: -1}),
+			namedTunnelConfig: testNamedTunnelProperties,
 		},
 		{
-			name:             "named tunnel (post quantum)",
-			protocol:         AutoSelectFlag,
-			needPQ:           true,
-			expectedProtocol: QUIC,
+			name:              "named tunnel auto all http2 disabled",
+			protocol:          AutoSelectFlag,
+			expectedProtocol:  H2mux,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}),
+			namedTunnelConfig: testNamedTunnelProperties,
 		},
 		{
-			name:             "named tunnel (post quantum) w/http2",
-			protocol:         "http2",
-			needPQ:           true,
-			expectedProtocol: QUIC,
+			name:              "named tunnel auto to h2mux",
+			protocol:          AutoSelectFlag,
+			expectedProtocol:  H2mux,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}),
+			namedTunnelConfig: testNamedTunnelProperties,
+		},
+		{
+			name:              "named tunnel auto to http2",
+			protocol:          AutoSelectFlag,
+			expectedProtocol:  HTTP2,
+			hasFallback:       true,
+			expectedFallback:  H2mux,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			namedTunnelConfig: testNamedTunnelProperties,
+		},
+		{
+			name:              "named tunnel auto to quic",
+			protocol:          AutoSelectFlag,
+			expectedProtocol:  QUIC,
+			hasFallback:       true,
+			expectedFallback:  HTTP2,
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}),
+			namedTunnelConfig: testNamedTunnelProperties,
+		},
+		{
+			name:               "warp routing requesting h2mux",
+			protocol:           "h2mux",
+			expectedProtocol:   HTTP2Warp,
+			hasFallback:        false,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelProperties,
+		},
+		{
+			name:               "warp routing requesting h2mux picks HTTP2 even if http2 percent is -1",
+			protocol:           "h2mux",
+			expectedProtocol:   HTTP2Warp,
+			hasFallback:        false,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelProperties,
+		},
+		{
+			name:               "warp routing http2",
+			protocol:           "http2",
+			expectedProtocol:   HTTP2Warp,
+			hasFallback:        false,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelProperties,
+		},
+		{
+			name:               "warp routing quic",
+			protocol:           AutoSelectFlag,
+			expectedProtocol:   QUICWarp,
+			hasFallback:        true,
+			expectedFallback:   HTTP2Warp,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelProperties,
+		},
+		{
+			name:               "warp routing auto",
+			protocol:           AutoSelectFlag,
+			expectedProtocol:   HTTP2Warp,
+			hasFallback:        false,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelProperties,
+		},
+		{
+			name:               "warp routing auto- quic",
+			protocol:           AutoSelectFlag,
+			expectedProtocol:   QUICWarp,
+			hasFallback:        true,
+			expectedFallback:   HTTP2Warp,
+			fetchFunc:          mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}, edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelProperties,
+		},
+		{
+			// None named tunnel can only use h2mux, so specifying an unknown protocol is not an error
+			name:             "classic tunnel unknown protocol",
+			protocol:         "unknown",
+			expectedProtocol: H2mux,
+		},
+		{
+			name:              "named tunnel unknown protocol",
+			protocol:          "unknown",
+			fetchFunc:         mockFetcher(false, edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}),
+			namedTunnelConfig: testNamedTunnelProperties,
+			wantErr:           true,
+		},
+		{
+			name:              "named tunnel fetch error",
+			protocol:          AutoSelectFlag,
+			fetchFunc:         mockFetcher(true),
+			namedTunnelConfig: testNamedTunnelProperties,
+			expectedProtocol:  HTTP2,
+			wantErr:           false,
 		},
-	}
-
-	fetcher := dynamicMockFetcher{
-		protocolPercents: edgediscovery.ProtocolPercents{},
 	}

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			selector, err := NewProtocolSelector(test.protocol, testAccountTag, test.tunnelTokenProvided, test.needPQ, fetcher.fetch(), ResolveTTL, &log)
+			selector, err := NewProtocolSelector(test.protocol, test.warpRoutingEnabled, test.namedTunnelConfig, test.fetchFunc, testNoTTL, &log, false)
 			if test.wantErr {
 				assert.Error(t, err, fmt.Sprintf("test %s failed", test.name))
 			} else {
@@ -105,15 +237,15 @@ func TestNewProtocolSelector(t *testing.T) {

 func TestAutoProtocolSelectorRefresh(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
-	selector, err := NewProtocolSelector(AutoSelectFlag, testAccountTag, false, false, fetcher.fetch(), testNoTTL, &log)
+	selector, err := NewProtocolSelector(AutoSelectFlag, noWarpRoutingEnabled, testNamedTunnelProperties, fetcher.fetch(), testNoTTL, &log, false)
 	assert.NoError(t, err)
-	assert.Equal(t, QUIC, selector.Current())
+	assert.Equal(t, H2mux, selector.Current())

 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
 	assert.Equal(t, HTTP2, selector.Current())

 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}}
-	assert.Equal(t, QUIC, selector.Current())
+	assert.Equal(t, H2mux, selector.Current())

 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
 	assert.Equal(t, HTTP2, selector.Current())
@@ -123,10 +255,10 @@ func TestAutoProtocolSelectorRefresh(t *testing.T) {

 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: -1}}
 	fetcher.err = nil
-	assert.Equal(t, QUIC, selector.Current())
+	assert.Equal(t, H2mux, selector.Current())

 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 0}}
-	assert.Equal(t, QUIC, selector.Current())
+	assert.Equal(t, H2mux, selector.Current())

 	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}}
 	assert.Equal(t, QUIC, selector.Current())
@@ -135,7 +267,7 @@ func TestAutoProtocolSelectorRefresh(t *testing.T) {
 func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
 	// Since the user chooses http2 on purpose, we always stick to it.
-	selector, err := NewProtocolSelector(HTTP2.String(), testAccountTag, false, false, fetcher.fetch(), testNoTTL, &log)
+	selector, err := NewProtocolSelector("http2", noWarpRoutingEnabled, testNamedTunnelProperties, fetcher.fetch(), testNoTTL, &log, false)
 	assert.NoError(t, err)
 	assert.Equal(t, HTTP2, selector.Current())

@@ -162,12 +294,13 @@ func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
 	assert.Equal(t, HTTP2, selector.Current())
 }

-func TestAutoProtocolSelectorNoRefreshWithToken(t *testing.T) {
+func TestProtocolSelectorRefreshTTL(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
-	selector, err := NewProtocolSelector(AutoSelectFlag, testAccountTag, true, false, fetcher.fetch(), testNoTTL, &log)
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}}
+	selector, err := NewProtocolSelector(AutoSelectFlag, noWarpRoutingEnabled, testNamedTunnelProperties, fetcher.fetch(), time.Hour, &log, false)
 	assert.NoError(t, err)
 	assert.Equal(t, QUIC, selector.Current())

-	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}}
+	fetcher.protocolPercents = edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 0}}
 	assert.Equal(t, QUIC, selector.Current())
 }
@@ -1,7 +1,6 @@
 package connection

 import (
-	"bufio"
 	"context"
 	"crypto/tls"
 	"fmt"
@@ -25,7 +24,6 @@ import (

 	"github.com/cloudflare/cloudflared/datagramsession"
 	"github.com/cloudflare/cloudflared/ingress"
-	"github.com/cloudflare/cloudflared/management"
 	"github.com/cloudflare/cloudflared/packet"
 	quicpogs "github.com/cloudflare/cloudflared/quic"
 	"github.com/cloudflare/cloudflared/tracing"
@@ -62,14 +60,12 @@ type QUICConnection struct {
 	packetRouter         *ingress.PacketRouter
 	controlStreamHandler ControlStreamHandler
 	connOptions          *tunnelpogs.ConnectionOptions
-	connIndex            uint8
 }

 // NewQUICConnection returns a new instance of QUICConnection.
 func NewQUICConnection(
 	quicConfig *quic.Config,
 	edgeAddr net.Addr,
-	localAddr net.IP,
 	connIndex uint8,
 	tlsConfig *tls.Config,
 	orchestrator Orchestrator,
@@ -78,7 +74,7 @@ func NewQUICConnection(
 	logger *zerolog.Logger,
 	packetRouterConfig *ingress.GlobalRouterConfig,
 ) (*QUICConnection, error) {
-	udpConn, err := createUDPConnForConnIndex(connIndex, localAddr, logger)
+	udpConn, err := createUDPConnForConnIndex(connIndex, logger)
 	if err != nil {
 		return nil, err
 	}
@@ -110,7 +106,6 @@ func NewQUICConnection(
 		packetRouter:         packetRouter,
 		controlStreamHandler: controlStreamHandler,
 		connOptions:          connOptions,
-		connIndex:            connIndex,
 	}, nil
 }

@@ -263,7 +258,7 @@ func (q *QUICConnection) dispatchRequest(ctx context.Context, stream *quicpogs.R

 	switch request.Type {
 	case quicpogs.ConnectionTypeHTTP, quicpogs.ConnectionTypeWebsocket:
-		tracedReq, err := buildHTTPRequest(ctx, request, stream, q.connIndex, q.logger)
+		tracedReq, err := buildHTTPRequest(ctx, request, stream, q.logger)
 		if err != nil {
 			return err, false
 		}
@@ -277,7 +272,6 @@ func (q *QUICConnection) dispatchRequest(ctx context.Context, stream *quicpogs.R
 			Dest:      request.Dest,
 			FlowID:    metadata[QUICMetadataFlowID],
 			CfTraceID: metadata[tracing.TracerContextName],
-			ConnIndex: q.connIndex,
 		}), rwa.connectResponseSent
 	default:
 		return errors.Errorf("unsupported error type: %s", request.Type), false
@@ -299,12 +293,11 @@ func (q *QUICConnection) RegisterUdpSession(ctx context.Context, sessionID uuid.
 		attribute.String("session-id", sessionID.String()),
 		attribute.String("dst", fmt.Sprintf("%s:%d", dstIP, dstPort)),
 	))
-	log := q.logger.With().Int(management.EventTypeKey, int(management.UDP)).Logger()
 	// Each session is a series of datagram from an eyeball to a dstIP:dstPort.
 	// (src port, dst IP, dst port) uniquely identifies a session, so it needs a dedicated connected socket.
 	originProxy, err := ingress.DialUDP(dstIP, dstPort)
 	if err != nil {
-		log.Err(err).Msgf("Failed to create udp proxy to %s:%d", dstIP, dstPort)
+		q.logger.Err(err).Msgf("Failed to create udp proxy to %s:%d", dstIP, dstPort)
 		tracing.EndWithErrorStatus(registerSpan, err)
 		return nil, err
 	}
@@ -315,18 +308,14 @@ func (q *QUICConnection) RegisterUdpSession(ctx context.Context, sessionID uuid.

 	session, err := q.sessionManager.RegisterSession(ctx, sessionID, originProxy)
 	if err != nil {
-		log.Err(err).Str("sessionID", sessionID.String()).Msgf("Failed to register udp session")
+		q.logger.Err(err).Str("sessionID", sessionID.String()).Msgf("Failed to register udp session")
 		tracing.EndWithErrorStatus(registerSpan, err)
 		return nil, err
 	}

 	go q.serveUDPSession(session, closeAfterIdleHint)

-	log.Debug().
-		Str("sessionID", sessionID.String()).
-		Str("src", originProxy.LocalAddr().String()).
-		Str("dst", fmt.Sprintf("%s:%d", dstIP, dstPort)).
-		Msgf("Registered session")
+	q.logger.Debug().Str("sessionID", sessionID.String()).Str("src", originProxy.LocalAddr().String()).Str("dst", fmt.Sprintf("%s:%d", dstIP, dstPort)).Msgf("Registered session")
 	tracing.End(registerSpan)

 	resp := tunnelpogs.RegisterUdpSessionResponse{
@@ -347,10 +336,7 @@ func (q *QUICConnection) serveUDPSession(session *datagramsession.Session, close
 			q.closeUDPSession(ctx, session.ID, "terminated without error")
 		}
 	}
-	q.logger.Debug().Err(err).
-		Int(management.EventTypeKey, int(management.UDP)).
-		Str("sessionID", session.ID.String()).
-		Msg("Session terminated")
+	q.logger.Debug().Err(err).Str("sessionID", session.ID.String()).Msg("Session terminated")
 }

 // closeUDPSession first unregisters the session from session manager, then it tries to unregister from edge
@@ -360,9 +346,7 @@ func (q *QUICConnection) closeUDPSession(ctx context.Context, sessionID uuid.UUI
 	if err != nil {
 		// Log this at debug because this is not an error if session was closed due to lost connection
 		// with edge
-		q.logger.Debug().Err(err).
-			Int(management.EventTypeKey, int(management.UDP)).
-			Str("sessionID", sessionID.String()).
+		q.logger.Debug().Err(err).Str("sessionID", sessionID.String()).
 			Msgf("Failed to open quic stream to unregister udp session with edge")
 		return
 	}
@@ -399,27 +383,22 @@ type streamReadWriteAcker struct {

 // AckConnection acks response back to the proxy.
 func (s *streamReadWriteAcker) AckConnection(tracePropagation string) error {
-	metadata := []quicpogs.Metadata{}
-	// Only add tracing if provided by origintunneld
-	if tracePropagation != "" {
-		metadata = append(metadata, quicpogs.Metadata{
-			Key: tracing.CanonicalCloudflaredTracingHeader,
-			Val: tracePropagation,
-		})
+	metadata := quicpogs.Metadata{
+		Key: tracing.CanonicalCloudflaredTracingHeader,
+		Val: tracePropagation,
 	}
 	s.connectResponseSent = true
-	return s.WriteConnectResponseData(nil, metadata...)
+	return s.WriteConnectResponseData(nil, metadata)
 }

 // httpResponseAdapter translates responses written by the HTTP Proxy into ones that can be used in QUIC.
 type httpResponseAdapter struct {
 	*quicpogs.RequestServerStream
-	headers             http.Header
 	connectResponseSent bool
 }

 func newHTTPResponseAdapter(s *quicpogs.RequestServerStream) httpResponseAdapter {
-	return httpResponseAdapter{RequestServerStream: s, headers: make(http.Header)}
+	return httpResponseAdapter{RequestServerStream: s}
 }

 func (hrw *httpResponseAdapter) AddTrailer(trailerName, trailerValue string) {
@@ -439,23 +418,6 @@ func (hrw *httpResponseAdapter) WriteRespHeaders(status int, header http.Header)
 	return hrw.WriteConnectResponseData(nil, metadata...)
 }

-func (hrw *httpResponseAdapter) Header() http.Header {
-	return hrw.headers
-}
-
-func (hrw *httpResponseAdapter) WriteHeader(status int) {
-	hrw.WriteRespHeaders(status, hrw.headers)
-}
-
-func (hrw *httpResponseAdapter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	conn := &localProxyConnection{hrw.ReadWriteCloser}
-	readWriter := bufio.NewReadWriter(
-		bufio.NewReader(hrw.ReadWriteCloser),
-		bufio.NewWriter(hrw.ReadWriteCloser),
-	)
-	return conn, readWriter, nil
-}
-
 func (hrw *httpResponseAdapter) WriteErrorResponse(err error) {
 	hrw.WriteConnectResponseData(err, quicpogs.Metadata{Key: "HttpStatus", Val: strconv.Itoa(http.StatusBadGateway)})
 }
@@ -469,7 +431,6 @@ func buildHTTPRequest(
 	ctx context.Context,
 	connectRequest *quicpogs.ConnectRequest,
 	body io.ReadCloser,
-	connIndex uint8,
 	log *zerolog.Logger,
 ) (*tracing.TracedHTTPRequest, error) {
 	metadata := connectRequest.MetadataMap()
@@ -513,7 +474,7 @@ func buildHTTPRequest(
 	stripWebsocketUpgradeHeader(req)

 	// Check for tracing on request
-	tracedReq := tracing.NewTracedHTTPRequest(req, connIndex, log)
+	tracedReq := tracing.NewTracedHTTPRequest(req, log)
 	return tracedReq, err
 }

@@ -594,17 +555,13 @@ func (rp *muxerWrapper) Close() error {
 	return nil
 }

-func createUDPConnForConnIndex(connIndex uint8, localIP net.IP, logger *zerolog.Logger) (*net.UDPConn, error) {
+func createUDPConnForConnIndex(connIndex uint8, logger *zerolog.Logger) (*net.UDPConn, error) {
 	portMapMutex.Lock()
 	defer portMapMutex.Unlock()

-	if localIP == nil {
-		localIP = net.IPv4zero
-	}
-
 	// if port was not set yet, it will be zero, so bind will randomly allocate one.
 	if port, ok := portForConnIndex[connIndex]; ok {
-		udpConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: localIP, Port: port})
+		udpConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4zero, Port: port})
 		// if there wasn't an error, or if port was 0 (independently of error or not, just return)
 		if err == nil {
 			return udpConn, nil
@@ -614,7 +571,7 @@ func createUDPConnForConnIndex(connIndex uint8, localIP net.IP, logger *zerolog.
 	}

 	// if we reached here, then there was an error or port as not been allocated it.
-	udpConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: localIP, Port: 0})
+	udpConn, err := net.ListenUDP("udp", &net.UDPAddr{IP: net.IPv4zero, Port: 0})
 	if err == nil {
 		udpAddr, ok := (udpConn.LocalAddr()).(*net.UDPAddr)
 		if !ok {
@@ -485,7 +485,7 @@ func TestBuildHTTPRequest(t *testing.T) {
 	for _, test := range tests {
 		test := test // capture range variable
 		t.Run(test.name, func(t *testing.T) {
-			req, err := buildHTTPRequest(context.Background(), test.connectRequest, test.body, 0, &log)
+			req, err := buildHTTPRequest(context.Background(), test.connectRequest, test.body, &log)
 			assert.NoError(t, err)
 			test.req = test.req.WithContext(req.Context())
 			assert.Equal(t, test.req, req.Request)
@@ -572,7 +572,7 @@ func TestNopCloserReadWriterCloseAfterEOF(t *testing.T) {

 func TestCreateUDPConnReuseSourcePort(t *testing.T) {
 	logger := zerolog.Nop()
-	conn, err := createUDPConnForConnIndex(0, nil, &logger)
+	conn, err := createUDPConnForConnIndex(0, &logger)
 	require.NoError(t, err)

 	getPortFunc := func(conn *net.UDPConn) int {
@@ -586,17 +586,17 @@ func TestCreateUDPConnReuseSourcePort(t *testing.T) {
 	conn.Close()

 	// should get the same port as before.
-	conn, err = createUDPConnForConnIndex(0, nil, &logger)
+	conn, err = createUDPConnForConnIndex(0, &logger)
 	require.NoError(t, err)
 	require.Equal(t, initialPort, getPortFunc(conn))

 	// new index, should get a different port
-	conn1, err := createUDPConnForConnIndex(1, nil, &logger)
+	conn1, err := createUDPConnForConnIndex(1, &logger)
 	require.NoError(t, err)
 	require.NotEqual(t, initialPort, getPortFunc(conn1))

 	// not closing the conn and trying to obtain a new conn for same index should give a different random port
-	conn, err = createUDPConnForConnIndex(0, nil, &logger)
+	conn, err = createUDPConnForConnIndex(0, &logger)
 	require.NoError(t, err)
 	require.NotEqual(t, initialPort, getPortFunc(conn))
 }
@@ -716,7 +716,6 @@ func testQUICConnection(udpListenerAddr net.Addr, t *testing.T, index uint8) *QU
 	qc, err := NewQUICConnection(
 		testQUICConfig,
 		udpListenerAddr,
-		nil,
 		index,
 		tlsClientConfig,
 		&mockOrchestrator{originProxy: &mockOriginProxyWithRequest{}},
@@ -2,6 +2,7 @@ package connection

 import (
 	"context"
+	"fmt"
 	"io"
 	"net"
 	"time"
@@ -151,3 +152,178 @@ const (
 	unregister   rpcName = "unregister"
 	authenticate rpcName = " authenticate"
 )
+
+func (h *h2muxConnection) registerTunnel(ctx context.Context, credentialSetter CredentialManager, classicTunnel *ClassicTunnelProperties, registrationOptions *tunnelpogs.RegistrationOptions) error {
+	h.observer.sendRegisteringEvent(registrationOptions.ConnectionID)
+
+	stream, err := h.newRPCStream(ctx, register)
+	if err != nil {
+		return err
+	}
+	rpcClient := NewTunnelServerClient(ctx, stream, h.observer.log)
+	defer rpcClient.Close()
+
+	_ = h.logServerInfo(ctx, rpcClient)
+	registration := rpcClient.client.RegisterTunnel(
+		ctx,
+		classicTunnel.OriginCert,
+		classicTunnel.Hostname,
+		registrationOptions,
+	)
+	if registrationErr := registration.DeserializeError(); registrationErr != nil {
+		// RegisterTunnel RPC failure
+		return h.processRegisterTunnelError(registrationErr, register)
+	}
+
+	credentialSetter.SetEventDigest(h.connIndex, registration.EventDigest)
+	return h.processRegistrationSuccess(registration, register, credentialSetter, classicTunnel)
+}
+
+type CredentialManager interface {
+	ReconnectToken() ([]byte, error)
+	EventDigest(connID uint8) ([]byte, error)
+	SetEventDigest(connID uint8, digest []byte)
+	ConnDigest(connID uint8) ([]byte, error)
+	SetConnDigest(connID uint8, digest []byte)
+}
+
+func (h *h2muxConnection) processRegistrationSuccess(
+	registration *tunnelpogs.TunnelRegistration,
+	name rpcName,
+	credentialManager CredentialManager, classicTunnel *ClassicTunnelProperties,
+) error {
+	for _, logLine := range registration.LogLines {
+		h.observer.log.Info().Msg(logLine)
+	}
+
+	if registration.TunnelID != "" {
+		h.observer.metrics.tunnelsHA.AddTunnelID(h.connIndex, registration.TunnelID)
+		h.observer.log.Info().Msgf("Each HA connection's tunnel IDs: %v", h.observer.metrics.tunnelsHA.String())
+	}
+
+	credentialManager.SetConnDigest(h.connIndex, registration.ConnDigest)
+	h.observer.metrics.userHostnamesCounts.WithLabelValues(registration.Url).Inc()
+
+	h.observer.log.Info().Msgf("Route propagating, it may take up to 1 minute for your new route to become functional")
+	h.observer.metrics.regSuccess.WithLabelValues(string(name)).Inc()
+	return nil
+}
+
+func (h *h2muxConnection) processRegisterTunnelError(err tunnelpogs.TunnelRegistrationError, name rpcName) error {
+	if err.Error() == DuplicateConnectionError {
+		h.observer.metrics.regFail.WithLabelValues("dup_edge_conn", string(name)).Inc()
+		return errDuplicationConnection
+	}
+	h.observer.metrics.regFail.WithLabelValues("server_error", string(name)).Inc()
+	return ServerRegisterTunnelError{
+		Cause:     err,
+		Permanent: err.IsPermanent(),
+	}
+}
+
+func (h *h2muxConnection) reconnectTunnel(ctx context.Context, credentialManager CredentialManager, classicTunnel *ClassicTunnelProperties, registrationOptions *tunnelpogs.RegistrationOptions) error {
+	token, err := credentialManager.ReconnectToken()
+	if err != nil {
+		return err
+	}
+	eventDigest, err := credentialManager.EventDigest(h.connIndex)
+	if err != nil {
+		return err
+	}
+	connDigest, err := credentialManager.ConnDigest(h.connIndex)
+	if err != nil {
+		return err
+	}
+
+	h.observer.log.Debug().Msg("initiating RPC stream to reconnect")
+	stream, err := h.newRPCStream(ctx, register)
+	if err != nil {
+		return err
+	}
+	rpcClient := NewTunnelServerClient(ctx, stream, h.observer.log)
+	defer rpcClient.Close()
+
+	_ = h.logServerInfo(ctx, rpcClient)
+	registration := rpcClient.client.ReconnectTunnel(
+		ctx,
+		token,
+		eventDigest,
+		connDigest,
+		classicTunnel.Hostname,
+		registrationOptions,
+	)
+	if registrationErr := registration.DeserializeError(); registrationErr != nil {
+		// ReconnectTunnel RPC failure
+		return h.processRegisterTunnelError(registrationErr, reconnect)
+	}
+	return h.processRegistrationSuccess(registration, reconnect, credentialManager, classicTunnel)
+}
+
+func (h *h2muxConnection) logServerInfo(ctx context.Context, rpcClient *tunnelServerClient) error {
+	// Request server info without blocking tunnel registration; must use capnp library directly.
+	serverInfoPromise := tunnelrpc.TunnelServer{Client: rpcClient.client.Client}.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
+		return nil
+	})
+	serverInfoMessage, err := serverInfoPromise.Result().Struct()
+	if err != nil {
+		h.observer.log.Err(err).Msg("Failed to retrieve server information")
+		return err
+	}
+	serverInfo, err := tunnelpogs.UnmarshalServerInfo(serverInfoMessage)
+	if err != nil {
+		h.observer.log.Err(err).Msg("Failed to retrieve server information")
+		return err
+	}
+	h.observer.logServerInfo(h.connIndex, serverInfo.LocationName, net.IP{}, "Connection established")
+	return nil
+}
+
+func (h *h2muxConnection) registerNamedTunnel(
+	ctx context.Context,
+	namedTunnel *NamedTunnelProperties,
+	connOptions *tunnelpogs.ConnectionOptions,
+) error {
+	stream, err := h.newRPCStream(ctx, register)
+	if err != nil {
+		return err
+	}
+	rpcClient := h.newRPCClientFunc(ctx, stream, h.observer.log)
+	defer rpcClient.Close()
+
+	registrationDetails, err := rpcClient.RegisterConnection(ctx, namedTunnel, connOptions, h.connIndex, nil, h.observer)
+	if err != nil {
+		return err
+	}
+	h.observer.logServerInfo(h.connIndex, registrationDetails.Location, nil, fmt.Sprintf("Connection %s registered", registrationDetails.UUID))
+	h.observer.sendConnectedEvent(h.connIndex, H2mux, registrationDetails.Location)
+
+	return nil
+}
+
+func (h *h2muxConnection) unregister(isNamedTunnel bool) {
+	h.observer.sendUnregisteringEvent(h.connIndex)
+
+	unregisterCtx, cancel := context.WithTimeout(context.Background(), h.gracePeriod)
+	defer cancel()
+
+	stream, err := h.newRPCStream(unregisterCtx, unregister)
+	if err != nil {
+		return
+	}
+	defer stream.Close()
+
+	if isNamedTunnel {
+		rpcClient := h.newRPCClientFunc(unregisterCtx, stream, h.observer.log)
+		defer rpcClient.Close()
+
+		rpcClient.GracefulShutdown(unregisterCtx, h.gracePeriod)
+	} else {
+		rpcClient := NewTunnelServerClient(unregisterCtx, stream, h.observer.log)
+		defer rpcClient.Close()
+
+		// gracePeriod is encoded in int64 using capnproto
+		_ = rpcClient.client.UnregisterTunnel(unregisterCtx, h.gracePeriod.Nanoseconds())
+	}
+
+	h.observer.log.Info().Uint8(LogFieldConnIndex, h.connIndex).Msg("Unregistered tunnel connection")
+}
@@ -1,83 +0,0 @@
-package credentials
-
-import (
-	"github.com/pkg/errors"
-	"github.com/rs/zerolog"
-
-	"github.com/cloudflare/cloudflared/cfapi"
-)
-
-const (
-	logFieldOriginCertPath = "originCertPath"
-)
-
-type User struct {
-	cert     *OriginCert
-	certPath string
-}
-
-func (c User) AccountID() string {
-	return c.cert.AccountID
-}
-
-func (c User) ZoneID() string {
-	return c.cert.ZoneID
-}
-
-func (c User) APIToken() string {
-	return c.cert.APIToken
-}
-
-func (c User) CertPath() string {
-	return c.certPath
-}
-
-// Client uses the user credentials to create a Cloudflare API client
-func (c *User) Client(apiURL string, userAgent string, log *zerolog.Logger) (cfapi.Client, error) {
-	if apiURL == "" {
-		return nil, errors.New("An api-url was not provided for the Cloudflare API client")
-	}
-	client, err := cfapi.NewRESTClient(
-		apiURL,
-		c.cert.AccountID,
-		c.cert.ZoneID,
-		c.cert.APIToken,
-		userAgent,
-		log,
-	)
-
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-// Read will load and read the origin cert.pem to load the user credentials
-func Read(originCertPath string, log *zerolog.Logger) (*User, error) {
-	originCertLog := log.With().
-		Str(logFieldOriginCertPath, originCertPath).
-		Logger()
-
-	originCertPath, err := FindOriginCert(originCertPath, &originCertLog)
-	if err != nil {
-		return nil, errors.Wrap(err, "Error locating origin cert")
-	}
-	blocks, err := readOriginCert(originCertPath)
-	if err != nil {
-		return nil, errors.Wrapf(err, "Can't read origin cert from %s", originCertPath)
-	}
-
-	cert, err := decodeOriginCert(blocks)
-	if err != nil {
-		return nil, errors.Wrap(err, "Error decoding origin cert")
-	}
-
-	if cert.AccountID == "" {
-		return nil, errors.Errorf(`Origin certificate needs to be refreshed before creating new tunnels.\nDelete %s and run "cloudflared login" to obtain a new cert.`, originCertPath)
-	}
-
-	return &User{
-		cert:     cert,
-		certPath: originCertPath,
-	}, nil
-}
@@ -1,38 +0,0 @@
-package credentials
-
-import (
-	"io/fs"
-	"os"
-	"path"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestCredentialsRead(t *testing.T) {
-	file, err := os.ReadFile("test-cloudflare-tunnel-cert-json.pem")
-	require.NoError(t, err)
-	dir := t.TempDir()
-	certPath := path.Join(dir, originCertFile)
-	os.WriteFile(certPath, file, fs.ModePerm)
-	user, err := Read(certPath, &nopLog)
-	require.NoError(t, err)
-	require.Equal(t, certPath, user.CertPath())
-	require.Equal(t, "test-service-key", user.APIToken())
-	require.Equal(t, "7b0a4d77dfb881c1a3b7d61ea9443e19", user.ZoneID())
-	require.Equal(t, "abcdabcdabcdabcd1234567890abcdef", user.AccountID())
-}
-
-func TestCredentialsClient(t *testing.T) {
-	user := User{
-		certPath: "/tmp/cert.pem",
-		cert: &OriginCert{
-			ZoneID:    "7b0a4d77dfb881c1a3b7d61ea9443e19",
-			AccountID: "abcdabcdabcdabcd1234567890abcdef",
-			APIToken:  "test-service-key",
-		},
-	}
-	client, err := user.Client("example.com", "cloudflared/test", &nopLog)
-	require.NoError(t, err)
-	require.NotNil(t, client)
-}
@@ -1,130 +0,0 @@
-package credentials
-
-import (
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/mitchellh/go-homedir"
-	"github.com/rs/zerolog"
-
-	"github.com/cloudflare/cloudflared/config"
-)
-
-const (
-	DefaultCredentialFile = "cert.pem"
-	OriginCertFlag        = "origincert"
-)
-
-type namedTunnelToken struct {
-	ZoneID    string `json:"zoneID"`
-	AccountID string `json:"accountID"`
-	APIToken  string `json:"apiToken"`
-}
-
-type OriginCert struct {
-	ZoneID    string
-	APIToken  string
-	AccountID string
-}
-
-// FindDefaultOriginCertPath returns the first path that contains a cert.pem file. If none of the
-// DefaultConfigSearchDirectories contains a cert.pem file, return empty string
-func FindDefaultOriginCertPath() string {
-	for _, defaultConfigDir := range config.DefaultConfigSearchDirectories() {
-		originCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, DefaultCredentialFile))
-		if ok := fileExists(originCertPath); ok {
-			return originCertPath
-		}
-	}
-	return ""
-}
-
-func decodeOriginCert(blocks []byte) (*OriginCert, error) {
-	if len(blocks) == 0 {
-		return nil, fmt.Errorf("Cannot decode empty certificate")
-	}
-	originCert := OriginCert{}
-	block, rest := pem.Decode(blocks)
-	for {
-		if block == nil {
-			break
-		}
-		switch block.Type {
-		case "PRIVATE KEY", "CERTIFICATE":
-			// this is for legacy purposes.
-			break
-		case "ARGO TUNNEL TOKEN":
-			if originCert.ZoneID != "" || originCert.APIToken != "" {
-				return nil, fmt.Errorf("Found multiple tokens in the certificate")
-			}
-			// The token is a string,
-			// Try the newer JSON format
-			ntt := namedTunnelToken{}
-			if err := json.Unmarshal(block.Bytes, &ntt); err == nil {
-				originCert.ZoneID = ntt.ZoneID
-				originCert.APIToken = ntt.APIToken
-				originCert.AccountID = ntt.AccountID
-			}
-		default:
-			return nil, fmt.Errorf("Unknown block %s in the certificate", block.Type)
-		}
-		block, rest = pem.Decode(rest)
-	}
-
-	if originCert.ZoneID == "" || originCert.APIToken == "" {
-		return nil, fmt.Errorf("Missing token in the certificate")
-	}
-
-	return &originCert, nil
-}
-
-func readOriginCert(originCertPath string) ([]byte, error) {
-	originCert, err := os.ReadFile(originCertPath)
-	if err != nil {
-		return nil, fmt.Errorf("cannot read %s to load origin certificate", originCertPath)
-	}
-
-	return originCert, nil
-}
-
-// FindOriginCert will check to make sure that the certificate exists at the specified file path.
-func FindOriginCert(originCertPath string, log *zerolog.Logger) (string, error) {
-	if originCertPath == "" {
-		log.Error().Msgf("Cannot determine default origin certificate path. No file %s in %v. You need to specify the origin certificate path by specifying the origincert option in the configuration file, or set TUNNEL_ORIGIN_CERT environment variable", DefaultCredentialFile, config.DefaultConfigSearchDirectories())
-		return "", fmt.Errorf("client didn't specify origincert path")
-	}
-	var err error
-	originCertPath, err = homedir.Expand(originCertPath)
-	if err != nil {
-		log.Err(err).Msgf("Cannot resolve origin certificate path")
-		return "", fmt.Errorf("cannot resolve path %s", originCertPath)
-	}
-	// Check that the user has acquired a certificate using the login command
-	ok := fileExists(originCertPath)
-	if !ok {
-		log.Error().Msgf(`Cannot find a valid certificate for your origin at the path:
-
-    %s
-
-If the path above is wrong, specify the path with the -origincert option.
-If you don't have a certificate signed by Cloudflare, run the command:
-
-	cloudflared login
-`, originCertPath)
-		return "", fmt.Errorf("cannot find a valid certificate at the path %s", originCertPath)
-	}
-
-	return originCertPath, nil
-}
-
-// FileExists checks to see if a file exist at the provided path.
-func fileExists(path string) bool {
-	fileStat, err := os.Stat(path)
-	if err != nil {
-		return false
-	}
-	return !fileStat.IsDir()
-}
@@ -1,110 +0,0 @@
-package credentials
-
-import (
-	"fmt"
-	"io/fs"
-	"os"
-	"path"
-	"testing"
-
-	"github.com/rs/zerolog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const (
-	originCertFile = "cert.pem"
-)
-
-var (
-	nopLog = zerolog.Nop().With().Logger()
-)
-
-func TestLoadOriginCert(t *testing.T) {
-	cert, err := decodeOriginCert([]byte{})
-	assert.Equal(t, fmt.Errorf("Cannot decode empty certificate"), err)
-	assert.Nil(t, cert)
-
-	blocks, err := os.ReadFile("test-cert-unknown-block.pem")
-	assert.NoError(t, err)
-	cert, err = decodeOriginCert(blocks)
-	assert.Equal(t, fmt.Errorf("Unknown block RSA PRIVATE KEY in the certificate"), err)
-	assert.Nil(t, cert)
-}
-
-func TestJSONArgoTunnelTokenEmpty(t *testing.T) {
-	blocks, err := os.ReadFile("test-cert-no-token.pem")
-	assert.NoError(t, err)
-	cert, err := decodeOriginCert(blocks)
-	assert.Equal(t, fmt.Errorf("Missing token in the certificate"), err)
-	assert.Nil(t, cert)
-}
-
-func TestJSONArgoTunnelToken(t *testing.T) {
-	// The given cert's Argo Tunnel Token was generated by base64 encoding this JSON:
-	// {
-	// "zoneID": "7b0a4d77dfb881c1a3b7d61ea9443e19",
-	// "apiToken": "test-service-key",
-	// "accountID": "abcdabcdabcdabcd1234567890abcdef"
-	// }
-	CloudflareTunnelTokenTest(t, "test-cloudflare-tunnel-cert-json.pem")
-}
-
-func CloudflareTunnelTokenTest(t *testing.T, path string) {
-	blocks, err := os.ReadFile(path)
-	assert.NoError(t, err)
-	cert, err := decodeOriginCert(blocks)
-	assert.NoError(t, err)
-	assert.NotNil(t, cert)
-	assert.Equal(t, "7b0a4d77dfb881c1a3b7d61ea9443e19", cert.ZoneID)
-	key := "test-service-key"
-	assert.Equal(t, key, cert.APIToken)
-}
-
-type mockFile struct {
-	path string
-	data []byte
-	err  error
-}
-
-type mockFileSystem struct {
-	files map[string]mockFile
-}
-
-func newMockFileSystem(files ...mockFile) *mockFileSystem {
-	fs := mockFileSystem{map[string]mockFile{}}
-	for _, f := range files {
-		fs.files[f.path] = f
-	}
-	return &fs
-}
-
-func (fs *mockFileSystem) ReadFile(path string) ([]byte, error) {
-	if f, ok := fs.files[path]; ok {
-		return f.data, f.err
-	}
-	return nil, os.ErrNotExist
-}
-
-func (fs *mockFileSystem) ValidFilePath(path string) bool {
-	_, exists := fs.files[path]
-	return exists
-}
-
-func TestFindOriginCert_Valid(t *testing.T) {
-	file, err := os.ReadFile("test-cloudflare-tunnel-cert-json.pem")
-	require.NoError(t, err)
-	dir := t.TempDir()
-	certPath := path.Join(dir, originCertFile)
-	os.WriteFile(certPath, file, fs.ModePerm)
-	path, err := FindOriginCert(certPath, &nopLog)
-	require.NoError(t, err)
-	require.Equal(t, certPath, path)
-}
-
-func TestFindOriginCert_Missing(t *testing.T) {
-	dir := t.TempDir()
-	certPath := path.Join(dir, originCertFile)
-	_, err := FindOriginCert(certPath, &nopLog)
-	require.Error(t, err)
-}
@@ -9,7 +9,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/rs/zerolog"

-	"github.com/cloudflare/cloudflared/management"
 	"github.com/cloudflare/cloudflared/packet"
 )

@@ -121,9 +120,7 @@ func (m *manager) registerSession(ctx context.Context, registration *registerSes
 }

 func (m *manager) newSession(id uuid.UUID, dstConn io.ReadWriteCloser) *Session {
-	logger := m.log.With().
-		Int(management.EventTypeKey, int(management.UDP)).
-		Str("sessionID", id.String()).Logger()
+	logger := m.log.With().Str("sessionID", id.String()).Logger()
 	return &Session{
 		ID:       id,
 		sendFunc: m.sendFunc,
@@ -9,8 +9,6 @@ import (

 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
-
-	"github.com/cloudflare/cloudflared/management"
 )

 const (
@@ -43,19 +41,6 @@ const (
 	IPv6Only ConfigIPVersion = 6
 )

-func (c ConfigIPVersion) String() string {
-	switch c {
-	case Auto:
-		return "auto"
-	case IPv4Only:
-		return "4"
-	case IPv6Only:
-		return "6"
-	default:
-		return ""
-	}
-}
-
 // IPVersion is the IP version of an EdgeAddr
 type EdgeIPVersion int8

@@ -110,20 +95,16 @@ var friendlyDNSErrorLines = []string{

 // EdgeDiscovery implements HA service discovery lookup.
 func edgeDiscovery(log *zerolog.Logger, srvService string) ([][]*EdgeAddr, error) {
-	logger := log.With().Int(management.EventTypeKey, int(management.Cloudflared)).Logger()
-	logger.Debug().
-		Int(management.EventTypeKey, int(management.Cloudflared)).
-		Str("domain", "_"+srvService+"._"+srvProto+"."+srvName).
-		Msg("edge discovery: looking up edge SRV record")
+	log.Debug().Str("domain", "_"+srvService+"._"+srvProto+"."+srvName).Msg("looking up edge SRV record")

 	_, addrs, err := netLookupSRV(srvService, srvProto, srvName)
 	if err != nil {
 		_, fallbackAddrs, fallbackErr := fallbackLookupSRV(srvService, srvProto, srvName)
 		if fallbackErr != nil || len(fallbackAddrs) == 0 {
 			// use the original DNS error `err` in messages, not `fallbackErr`
-			logger.Err(err).Msg("edge discovery: error looking up Cloudflare edge IPs: the DNS query failed")
+			log.Err(err).Msg("Error looking up Cloudflare edge IPs: the DNS query failed")
 			for _, s := range friendlyDNSErrorLines {
-				logger.Error().Msg(s)
+				log.Error().Msg(s)
 			}
 			return nil, errors.Wrapf(err, "Could not lookup srv records on _%v._%v.%v", srvService, srvProto, srvName)
 		}
@@ -137,13 +118,9 @@ func edgeDiscovery(log *zerolog.Logger, srvService string) ([][]*EdgeAddr, error
 		if err != nil {
 			return nil, err
 		}
-		logAddrs := make([]string, len(edgeAddrs))
-		for i, e := range edgeAddrs {
-			logAddrs[i] = e.UDP.IP.String()
+		for _, e := range edgeAddrs {
+			log.Debug().Msgf("Edge Address: %+v", *e)
 		}
-		logger.Debug().
-			Strs("addresses", logAddrs).
-			Msg("edge discovery: resolved edge addresses")
 		resolvedAddrPerCNAME = append(resolvedAddrPerCNAME, edgeAddrs)
 	}

@@ -198,15 +175,13 @@ func ResolveAddrs(addrs []string, log *zerolog.Logger) (resolved []*EdgeAddr) {
 	for _, addr := range addrs {
 		tcpAddr, err := net.ResolveTCPAddr("tcp", addr)
 		if err != nil {
-			log.Error().Int(management.EventTypeKey, int(management.Cloudflared)).
-				Str(logFieldAddress, addr).Err(err).Msg("edge discovery: failed to resolve to TCP address")
+			log.Error().Str(logFieldAddress, addr).Err(err).Msg("failed to resolve to TCP address")
 			continue
 		}

 		udpAddr, err := net.ResolveUDPAddr("udp", addr)
 		if err != nil {
-			log.Error().Int(management.EventTypeKey, int(management.Cloudflared)).
-				Str(logFieldAddress, addr).Err(err).Msg("edge discovery: failed to resolve to UDP address")
+			log.Error().Str(logFieldAddress, addr).Err(err).Msg("failed to resolve to UDP address")
 			continue
 		}
 		version := V6
@@ -15,16 +15,12 @@ func DialEdge(
 	timeout time.Duration,
 	tlsConfig *tls.Config,
 	edgeTCPAddr *net.TCPAddr,
-	localIP net.IP,
 ) (net.Conn, error) {
 	// Inherit from parent context so we can cancel (Ctrl-C) while dialing
 	dialCtx, dialCancel := context.WithTimeout(ctx, timeout)
 	defer dialCancel()

 	dialer := net.Dialer{}
-	if localIP != nil {
-		dialer.LocalAddr = &net.TCPAddr{IP: localIP, Port: 0}
-	}
 	edgeConn, err := dialer.DialContext(dialCtx, "tcp", edgeTCPAddr.String())
 	if err != nil {
 		return nil, newDialError(err, "DialContext error")
@@ -6,7 +6,6 @@ import (
 	"github.com/rs/zerolog"

 	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
-	"github.com/cloudflare/cloudflared/management"
 )

 const (
@@ -75,35 +74,33 @@ func (ed *Edge) GetAddrForRPC() (*allregions.EdgeAddr, error) {

 // GetAddr gives this proxy connection an edge Addr. Prefer Addrs this connection has already used.
 func (ed *Edge) GetAddr(connIndex int) (*allregions.EdgeAddr, error) {
-	log := ed.log.With().
-		Int(LogFieldConnIndex, connIndex).
-		Int(management.EventTypeKey, int(management.Cloudflared)).
-		Logger()
+	log := ed.log.With().Int(LogFieldConnIndex, connIndex).Logger()
 	ed.Lock()
 	defer ed.Unlock()

 	// If this connection has already used an edge addr, return it.
 	if addr := ed.regions.AddrUsedBy(connIndex); addr != nil {
-		log.Debug().IPAddr(LogFieldIPAddress, addr.UDP.IP).Msg("edge discovery: returning same edge address back to pool")
+		log.Debug().Msg("edgediscovery - GetAddr: Returning same address back to proxy connection")
 		return addr, nil
 	}

 	// Otherwise, give it an unused one
 	addr := ed.regions.GetUnusedAddr(nil, connIndex)
 	if addr == nil {
-		log.Debug().Msg("edge discovery: no addresses left in pool to give proxy connection")
+		log.Debug().Msg("edgediscovery - GetAddr: No addresses left to give proxy connection")
 		return nil, errNoAddressesLeft
 	}
-	log.Debug().IPAddr(LogFieldIPAddress, addr.UDP.IP).Msg("edge discovery: giving new address to connection")
+	log = ed.log.With().
+		Int(LogFieldConnIndex, connIndex).
+		IPAddr(LogFieldIPAddress, addr.UDP.IP).Logger()
+	log.Debug().Msgf("edgediscovery - GetAddr: Giving connection its new address")
 	return addr, nil
 }

 // GetDifferentAddr gives back the proxy connection's edge Addr and uses a new one.
 func (ed *Edge) GetDifferentAddr(connIndex int, hasConnectivityError bool) (*allregions.EdgeAddr, error) {
-	log := ed.log.With().
-		Int(LogFieldConnIndex, connIndex).
-		Int(management.EventTypeKey, int(management.Cloudflared)).
-		Logger()
+	log := ed.log.With().Int(LogFieldConnIndex, connIndex).Logger()
+
 	ed.Lock()
 	defer ed.Unlock()

@@ -113,14 +110,14 @@ func (ed *Edge) GetDifferentAddr(connIndex int, hasConnectivityError bool) (*all
 	}
 	addr := ed.regions.GetUnusedAddr(oldAddr, connIndex)
 	if addr == nil {
-		log.Debug().Msg("edge discovery: no addresses left in pool to give proxy connection")
+		log.Debug().Msg("edgediscovery - GetDifferentAddr: No addresses left to give proxy connection")
 		// note: if oldAddr were not nil, it will become available on the next iteration
 		return nil, errNoAddressesLeft
 	}
-	log.Debug().
-		IPAddr(LogFieldIPAddress, addr.UDP.IP).
-		Int("available", ed.regions.AvailableAddrs()).
-		Msg("edge discovery: giving new address to connection")
+	log = ed.log.With().
+		Int(LogFieldConnIndex, connIndex).
+		IPAddr(LogFieldIPAddress, addr.UDP.IP).Logger()
+	log.Debug().Msgf("edgediscovery - GetDifferentAddr: Giving connection its new address from the address list: %v", ed.regions.AvailableAddrs())
 	return addr, nil
 }

@@ -136,9 +133,8 @@ func (ed *Edge) AvailableAddrs() int {
 func (ed *Edge) GiveBack(addr *allregions.EdgeAddr, hasConnectivityError bool) bool {
 	ed.Lock()
 	defer ed.Unlock()
-	ed.log.Debug().
-		Int(management.EventTypeKey, int(management.Cloudflared)).
-		IPAddr(LogFieldIPAddress, addr.UDP.IP).
-		Msg("edge discovery: gave back address to the pool")
+	log := ed.log.With().
+		IPAddr(LogFieldIPAddress, addr.UDP.IP).Logger()
+	log.Debug().Msgf("edgediscovery - GiveBack: Address now unused")
 	return ed.regions.GiveBack(addr, hasConnectivityError)
 }
@@ -15,8 +15,6 @@ var (
 	errNoProtocolRecord = fmt.Errorf("No TXT record found for %s to determine connection protocol", protocolRecord)
 )

-type PercentageFetcher func() (ProtocolPercents, error)
-
 // ProtocolPercent represents a single Protocol Percentage combination.
 type ProtocolPercent struct {
 	Protocol   string `json:"protocol"`
@@ -1,30 +0,0 @@
-package features
-
-const (
-	FeatureSerializedHeaders = "serialized_headers"
-	FeatureQuickReconnects   = "quick_reconnects"
-	FeatureAllowRemoteConfig = "allow_remote_config"
-	FeatureDatagramV2        = "support_datagram_v2"
-	FeaturePostQuantum       = "postquantum"
-	FeatureQUICSupportEOF    = "support_quic_eof"
-	FeatureManagementLogs    = "management_logs"
-)
-
-var (
-	DefaultFeatures = []string{
-		FeatureAllowRemoteConfig,
-		FeatureSerializedHeaders,
-		FeatureDatagramV2,
-		FeatureQUICSupportEOF,
-		FeatureManagementLogs,
-	}
-)
-
-func Contains(feature string) bool {
-	for _, f := range DefaultFeatures {
-		if f == feature {
-			return true
-		}
-	}
-	return false
-}
@@ -12,8 +12,6 @@ require (
 	github.com/fsnotify/fsnotify v1.4.9
 	github.com/getsentry/raven-go v0.2.0
 	github.com/getsentry/sentry-go v0.16.0
-	github.com/go-chi/chi/v5 v5.0.8
-	github.com/go-jose/go-jose/v3 v3.0.0
 	github.com/gobwas/ws v1.0.4
 	github.com/golang-collections/collections v0.0.0-20130729185459-604e922904d3
 	github.com/google/gopacket v1.1.19
@@ -37,17 +35,16 @@ require (
 	go.opentelemetry.io/otel/trace v1.6.3
 	go.opentelemetry.io/proto/otlp v0.15.0
 	go.uber.org/automaxprocs v1.4.0
-	golang.org/x/crypto v0.8.0
-	golang.org/x/net v0.9.0
+	golang.org/x/crypto v0.5.0
+	golang.org/x/net v0.5.0
 	golang.org/x/sync v0.1.0
-	golang.org/x/sys v0.7.0
-	golang.org/x/term v0.7.0
+	golang.org/x/sys v0.4.0
+	golang.org/x/term v0.4.0
 	google.golang.org/protobuf v1.28.1
 	gopkg.in/coreos/go-oidc.v2 v2.2.1
 	gopkg.in/natefinch/lumberjack.v2 v2.0.0
 	gopkg.in/square/go-jose.v2 v2.6.0
 	gopkg.in/yaml.v3 v3.0.1
-	nhooyr.io/websocket v1.8.7
 	zombiezen.com/go/capnproto2 v2.18.0+incompatible
 )

@@ -75,7 +72,6 @@ require (
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
-	github.com/klauspost/compress v1.15.11 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/marten-seemann/qtls-go1-16 v0.1.5 // indirect
@@ -95,10 +91,10 @@ require (
 	github.com/prometheus/common v0.37.0 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	golang.org/x/mod v0.8.0 // indirect
+	golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect
 	golang.org/x/oauth2 v0.4.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
-	golang.org/x/tools v0.6.0 // indirect
+	golang.org/x/text v0.6.0 // indirect
+	golang.org/x/tools v0.1.12 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20221202195650-67e5cbc046fd // indirect
 	google.golang.org/grpc v1.51.0 // indirect
@@ -118,11 +114,9 @@ replace gopkg.in/yaml.v3 => gopkg.in/yaml.v3 v3.0.1

 // Post-quantum tunnel RTG-1339
 replace (
-	// Branches go1.18 go1.19 go1.20 on github.com/cloudflare/qtls-pq
+	// branch go1.18
 	github.com/marten-seemann/qtls-go1-18 => github.com/cloudflare/qtls-pq v0.0.0-20230103171413-e7a2fb559a0e
+
+	// branch go1.19
 	github.com/marten-seemann/qtls-go1-19 => github.com/cloudflare/qtls-pq v0.0.0-20230103171656-05e84f90909e
-	github.com/marten-seemann/qtls-go1-20 => github.com/cloudflare/qtls-pq v0.0.0-20230215110727-8b4e1699c2a8
-	github.com/quic-go/qtls-go1-18 => github.com/cloudflare/qtls-pq v0.0.0-20230103171413-e7a2fb559a0e
-	github.com/quic-go/qtls-go1-19 => github.com/cloudflare/qtls-pq v0.0.0-20230103171656-05e84f90909e
-	github.com/quic-go/qtls-go1-20 => github.com/cloudflare/qtls-pq v0.0.0-20230215110727-8b4e1699c2a8
 )
@@ -166,20 +166,12 @@ github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49P
 github.com/getsentry/sentry-go v0.16.0 h1:owk+S+5XcgJLlGR/3+3s6N4d+uKwqYvh/eS0AIMjPWo=
 github.com/getsentry/sentry-go v0.16.0/go.mod h1:ZXCloQLj0pG7mja5NK6NPf2V4A88YJ4pNlc2mOHwh6Y=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
-github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
-github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
-github.com/gin-gonic/gin v1.8.1 h1:4+fr/el88TOO3ewCmQr8cx/CtZ/umlIRIs5M4NTNjf8=
 github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-chi/chi/v5 v5.0.8 h1:lD+NLqFcAi1ovnVZpsnObHGW4xb4J8lNmoYVfECH1Y0=
-github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v3 v3.0.0 h1:s6rrhirfEP/CGIoc6p+PZAeogN2SxKav6Wp7+dyMWVo=
-github.com/go-jose/go-jose/v3 v3.0.0/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -193,26 +185,15 @@ github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
 github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
-github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
-github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
-github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/jYrnRPArHwAcmLoJZxyho=
-github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
-github.com/go-playground/validator/v10 v10.11.1 h1:prmOlTVv+YjZjmRmNSF3VmspqJIxJWXmqUsHwfTRRkQ=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
 github.com/gobwas/httphead v0.0.0-20200921212729-da3d93bc3c58 h1:YyrUZvJaU8Q0QsoVo+xLFBgWDTam29PKea6GYmwvSiQ=
 github.com/gobwas/httphead v0.0.0-20200921212729-da3d93bc3c58/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
-github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
 github.com/gobwas/ws v1.0.4 h1:5eXU1CZhpQdq5kXbKb+sECH5Ia5KiO6CYzIzdlVx6Bs=
 github.com/gobwas/ws v1.0.4/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
-github.com/goccy/go-json v0.9.11 h1:/pAaQDLHEoCq/5FFmSKBswWmK6H0e8g4159Kc/X/nqk=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang-collections/collections v0.0.0-20130729185459-604e922904d3 h1:zN2lZNZRflqFyxVaTIU61KNKQ9C0055u9CAfpmqUvo4=
 github.com/golang-collections/collections v0.0.0-20130729185459-604e922904d3/go.mod h1:nPpo7qLxd6XL3hWJG/O60sR8ZKfMCiIoNap5GvD12KU=
@@ -309,7 +290,6 @@ github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99
 github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
 github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
@@ -329,7 +309,6 @@ github.com/ipostelnik/cli/v2 v2.3.1-0.20210324024421-b6ea8234fe3d/go.mod h1:LJmU
 github.com/jellevandenhooff/dkim v0.0.0-20150330215556-f50fe3d243e1/go.mod h1:E0B/fFc00Y+Rasa88328GlI/XbtyysCtTHZS8h7IrBU=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
@@ -339,9 +318,6 @@ github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/X
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.15.11 h1:Lcadnb3RKGin4FYM/orgq0qde+nc15E5Cbqg4B9Sx9c=
-github.com/klauspost/compress v1.15.11/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
@@ -355,8 +331,6 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
-github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
 github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/marten-seemann/qpack v0.2.1/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
@@ -366,7 +340,6 @@ github.com/marten-seemann/qtls-go1-17 v0.1.2 h1:JADBlm0LYiVbuSySCHeY863dNkcpMmDR
 github.com/marten-seemann/qtls-go1-17 v0.1.2/go.mod h1:C2ekUKcDdz9SDWxec1N/MvcXBpaX9l3Nx67XaR84L5s=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
@@ -405,7 +378,6 @@ github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
-github.com/pelletier/go-toml/v2 v2.0.5 h1:ipoSadvV8oGUjnUbMub59IDPPwfxF694nG/jwbMiyQg=
 github.com/philhofer/fwd v1.1.1 h1:GdGcTjf5RNAxwS4QLsiMzJYj5KEvPJD3Abr261yRQXQ=
 github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -499,10 +471,6 @@ github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKs
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
 github.com/tinylib/msgp v1.1.2 h1:gWmO7n0Ys2RBEb7GPYB9Ujq8Mk5p2U08lRnmMcGy6BQ=
-github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
-github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
-github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
-github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
 github.com/viant/assertly v0.4.8/go.mod h1:aGifi++jvCrUaklKEKT0BU95igDNaqkvz+49uaYMPRU=
 github.com/viant/toolbox v0.24.0/go.mod h1:OxMCG57V0PXuIP2HNQrtJf2CjqdmbrOx5EkMILuUhzM=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -544,13 +512,12 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190313024323-a1f597ede03a/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200221231518-2aa609cf4a9d/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
-golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
+golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
+golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -587,8 +554,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 h1:6zppjxzCulZykYSLyVDYbneBfbaBIQPYMevg0bEwv2s=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -643,8 +610,8 @@ golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw=
+golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -708,7 +675,6 @@ golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -765,12 +731,12 @@ golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.7.0 h1:BEvjmm5fURWqcfbSKTdpkDXYBrUS1c0m8agp14W48vQ=
-golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg=
+golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -780,8 +746,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k=
+golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -842,8 +808,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1063,7 +1029,6 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
@@ -1078,8 +1043,6 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
-nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
@@ -113,7 +113,7 @@ func (rc *RemoteConfig) UnmarshalJSON(b []byte) error {
 	return nil
 }

-func originRequestFromSingleRule(c *cli.Context) OriginRequestConfig {
+func originRequestFromSingeRule(c *cli.Context) OriginRequestConfig {
 	var connectTimeout = defaultHTTPConnectTimeout
 	var tlsTimeout = defaultTLSTimeout
 	var tcpKeepAlive = defaultTCPKeepAlive
@@ -411,7 +411,7 @@ func TestDefaultConfigFromCLI(t *testing.T) {
 		KeepAliveTimeout:     defaultKeepAliveTimeout,
 		ProxyAddress:         defaultProxyAddress,
 	}
-	actual := originRequestFromSingleRule(c)
+	actual := originRequestFromSingeRule(c)
 	require.Equal(t, expected, actual)
 }

@@ -20,7 +20,6 @@ import (

 var (
 	ErrNoIngressRules             = errors.New("The config file doesn't contain any ingress rules")
-	ErrNoIngressRulesCLI          = errors.New("No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests")
 	errLastRuleNotCatchAll        = errors.New("The last ingress rule must match all URLs (i.e. it should not have a hostname or path filter)")
 	errBadWildcard                = errors.New("Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"")
 	errHostnameContainsPort       = errors.New("Hostname cannot contain a port")
@@ -35,22 +34,13 @@ const (

 // FindMatchingRule returns the index of the Ingress Rule which matches the given
 // hostname and path. This function assumes the last rule matches everything,
-// which is the case if the rules were instantiated via the ingress#Validate method.
-//
-// Negative index rule signifies local cloudflared rules (not-user defined).
+// which is the case if the rules were instantiated via the ingress#Validate method
 func (ing Ingress) FindMatchingRule(hostname, path string) (*Rule, int) {
 	// The hostname might contain port. We only want to compare the host part with the rule
 	host, _, err := net.SplitHostPort(hostname)
 	if err == nil {
 		hostname = host
 	}
-	for i, rule := range ing.LocalRules {
-		if rule.Matches(hostname, path) {
-			// Local rule matches return a negative rule index to distiguish local rules from user-defined rules in logs
-			// Full range would be [-1 .. )
-			return &rule, -1 - i
-		}
-	}
 	for i, rule := range ing.Rules {
 		if rule.Matches(hostname, path) {
 			return &rule, i
@@ -76,63 +66,20 @@ func matchHost(ruleHost, reqHost string) bool {

 // Ingress maps eyeball requests to origins.
 type Ingress struct {
-	// Set of ingress rules that are not added to remote config, e.g. management
-	LocalRules []Rule
-	// Rules that are provided by the user from remote or local configuration
 	Rules    []Rule              `json:"ingress"`
 	Defaults OriginRequestConfig `json:"originRequest"`
 }

-// ParseIngress parses ingress rules, but does not send HTTP requests to the origins.
-func ParseIngress(conf *config.Configuration) (Ingress, error) {
-	if len(conf.Ingress) == 0 {
-		return Ingress{}, ErrNoIngressRules
-	}
-	return validateIngress(conf.Ingress, originRequestFromConfig(conf.OriginRequest))
-}
-
-// ParseIngressFromConfigAndCLI will parse the configuration rules from config files for ingress
-// rules and then attempt to parse CLI for ingress rules.
-// Will always return at least one valid ingress rule. If none are provided by the user, the default
-// will be to return 503 status code for all incoming requests.
-func ParseIngressFromConfigAndCLI(conf *config.Configuration, c *cli.Context, log *zerolog.Logger) (Ingress, error) {
-	// Attempt to parse ingress rules from configuration
-	ingressRules, err := ParseIngress(conf)
-	if err == nil && !ingressRules.IsEmpty() {
-		return ingressRules, nil
-	}
-	if err != ErrNoIngressRules {
-		return Ingress{}, err
-	}
-	// Attempt to parse ingress rules from CLI:
-	//   --url or --unix-socket flag for a tunnel HTTP ingress
-	//   --hello-world for a basic HTTP ingress self-served
-	//   --bastion for ssh bastion service
-	ingressRules, err = parseCLIIngress(c, false)
-	if errors.Is(err, ErrNoIngressRulesCLI) {
-		// Only log a warning if the tunnel is not a remotely managed tunnel and the config
-		// will be loaded after connecting.
-		if !c.IsSet("token") {
-			log.Warn().Msgf(ErrNoIngressRulesCLI.Error())
-		}
-		return newDefaultOrigin(c, log), nil
-	}
-	if err != nil {
-		return Ingress{}, err
-	}
-	return ingressRules, nil
-}
-
-// parseCLIIngress constructs an Ingress set with only one rule constructed from
-// CLI parameters: --url, --hello-world, --bastion, or --unix-socket
-func parseCLIIngress(c *cli.Context, allowURLFromArgs bool) (Ingress, error) {
+// NewSingleOrigin constructs an Ingress set with only one rule, constructed from
+// CLI parameters for quick tunnels like --url or --no-chunked-encoding.
+func NewSingleOrigin(c *cli.Context, allowURLFromArgs bool) (Ingress, error) {
 	service, err := parseSingleOriginService(c, allowURLFromArgs)
 	if err != nil {
 		return Ingress{}, err
 	}

 	// Construct an Ingress with the single rule.
-	defaults := originRequestFromSingleRule(c)
+	defaults := originRequestFromSingeRule(c)
 	ing := Ingress{
 		Rules: []Rule{
 			{
@@ -145,25 +92,27 @@ func parseCLIIngress(c *cli.Context, allowURLFromArgs bool) (Ingress, error) {
 	return ing, err
 }

-// newDefaultOrigin always returns a 503 response code to help indicate that there are no ingress
-// rules setup, but the tunnel is reachable.
-func newDefaultOrigin(c *cli.Context, log *zerolog.Logger) Ingress {
-	noRulesService := newDefaultStatusCode(log)
-	defaults := originRequestFromSingleRule(c)
-	ingress := Ingress{
-		Rules: []Rule{
-			{
-				Service: &noRulesService,
-			},
+// WarpRoutingService starts a tcp stream between the origin and requests from
+// warp clients.
+type WarpRoutingService struct {
+	Proxy StreamBasedOriginProxy
+}
+
+func NewWarpRoutingService(config WarpRoutingConfig) *WarpRoutingService {
+	svc := &rawTCPService{
+		name: ServiceWarpRouting,
+		dialer: net.Dialer{
+			Timeout:   config.ConnectTimeout.Duration,
+			KeepAlive: config.TCPKeepAlive.Duration,
 		},
-		Defaults: defaults,
 	}
-	return ingress
+
+	return &WarpRoutingService{Proxy: svc}
 }

 // Get a single origin service from the CLI/config.
 func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (OriginService, error) {
-	if c.IsSet(HelloWorldFlag) {
+	if c.IsSet("hello-world") {
 		return new(helloWorld), nil
 	}
 	if c.IsSet(config.BastionFlag) {
@@ -188,7 +137,8 @@ func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (OriginServ
 		}
 		return &unixSocketPath{path: path, scheme: "http"}, nil
 	}
-	return nil, ErrNoIngressRulesCLI
+	u, err := url.Parse("http://localhost:8080")
+	return &httpService{url: u}, err
 }

 // IsEmpty checks if there are any ingress rules.
@@ -256,7 +206,7 @@ func validateIngress(ingress []config.UnvalidatedIngressRule, defaults OriginReq
 			}
 			srv := newStatusCode(statusCode)
 			service = &srv
-		} else if r.Service == HelloWorldFlag || r.Service == HelloWorldService {
+		} else if r.Service == HelloWorldService || r.Service == "hello-world" || r.Service == "helloworld" {
 			service = new(helloWorld)
 		} else if r.Service == ServiceSocksProxy {
 			rules := make([]ipaccess.Rule, len(r.OriginRequest.IPRules))
@@ -385,6 +335,14 @@ func (e errRuleShouldNotBeCatchAll) Error() string {
 		"will never be triggered.", e.index+1, e.hostname)
 }

+// ParseIngress parses ingress rules, but does not send HTTP requests to the origins.
+func ParseIngress(conf *config.Configuration) (Ingress, error) {
+	if len(conf.Ingress) == 0 {
+		return Ingress{}, ErrNoIngressRules
+	}
+	return validateIngress(conf.Ingress, originRequestFromConfig(conf.OriginRequest))
+}
+
 func isHTTPService(url *url.URL) bool {
 	return url.Scheme == "http" || url.Scheme == "https" || url.Scheme == "ws" || url.Scheme == "wss"
 }
@@ -43,7 +43,7 @@ ingress:
 	require.Equal(t, "https", s.scheme)
 }

-func TestParseIngress(t *testing.T) {
+func Test_parseIngress(t *testing.T) {
 	localhost8000 := MustParseURL(t, "https://localhost:8000")
 	localhost8001 := MustParseURL(t, "https://localhost:8001")
 	fourOhFour := newStatusCode(404)
@@ -517,7 +517,7 @@ func TestSingleOriginSetsConfig(t *testing.T) {

 	allowURLFromArgs := false
 	require.NoError(t, err)
-	ingress, err := parseCLIIngress(cliCtx, allowURLFromArgs)
+	ingress, err := NewSingleOrigin(cliCtx, allowURLFromArgs)
 	require.NoError(t, err)

 	assert.Equal(t, config.CustomDuration{Duration: time.Second}, ingress.Rules[0].Config.ConnectTimeout)
@@ -537,119 +537,6 @@ func TestSingleOriginSetsConfig(t *testing.T) {
 	assert.Equal(t, socksProxy, ingress.Rules[0].Config.ProxyType)
 }

-func TestSingleOriginServices(t *testing.T) {
-	host := "://localhost:8080"
-	httpURL := urlMustParse("http" + host)
-	tcpURL := urlMustParse("tcp" + host)
-	unix := "unix://service"
-	newCli := func(params ...string) *cli.Context {
-		flagSet := flag.NewFlagSet(t.Name(), flag.PanicOnError)
-		flagSet.Bool("hello-world", false, "")
-		flagSet.Bool("bastion", false, "")
-		flagSet.String("url", "", "")
-		flagSet.String("unix-socket", "", "")
-		cliCtx := cli.NewContext(cli.NewApp(), flagSet, nil)
-		for i := 0; i < len(params); i += 2 {
-			cliCtx.Set(params[i], params[i+1])
-		}
-
-		return cliCtx
-	}
-
-	tests := []struct {
-		name            string
-		cli             *cli.Context
-		expectedService OriginService
-		err             error
-	}{
-		{
-			name:            "Valid hello-world",
-			cli:             newCli("hello-world", "true"),
-			expectedService: &helloWorld{},
-		},
-		{
-			name:            "Valid bastion",
-			cli:             newCli("bastion", "true"),
-			expectedService: newBastionService(),
-		},
-		{
-			name:            "Valid http url",
-			cli:             newCli("url", httpURL.String()),
-			expectedService: &httpService{url: httpURL},
-		},
-		{
-			name:            "Valid tcp url",
-			cli:             newCli("url", tcpURL.String()),
-			expectedService: newTCPOverWSService(tcpURL),
-		},
-		{
-			name:            "Valid unix-socket",
-			cli:             newCli("unix-socket", unix),
-			expectedService: &unixSocketPath{path: unix, scheme: "http"},
-		},
-		{
-			name: "No origins defined",
-			cli:  newCli(),
-			err:  ErrNoIngressRulesCLI,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ingress, err := parseCLIIngress(test.cli, false)
-			require.Equal(t, err, test.err)
-			if test.err != nil {
-				return
-			}
-			require.Equal(t, 1, len(ingress.Rules))
-			rule := ingress.Rules[0]
-			require.Equal(t, test.expectedService, rule.Service)
-		})
-	}
-}
-
-func urlMustParse(s string) *url.URL {
-	u, err := url.Parse(s)
-	if err != nil {
-		panic(err)
-	}
-	return u
-}
-
-func TestSingleOriginServices_URL(t *testing.T) {
-	host := "://localhost:8080"
-	newCli := func(param string, value string) *cli.Context {
-		flagSet := flag.NewFlagSet(t.Name(), flag.PanicOnError)
-		flagSet.String("url", "", "")
-		cliCtx := cli.NewContext(cli.NewApp(), flagSet, nil)
-		cliCtx.Set(param, value)
-		return cliCtx
-	}
-
-	httpTests := []string{"http", "https"}
-	for _, test := range httpTests {
-		t.Run(test, func(t *testing.T) {
-			url := urlMustParse(test + host)
-			ingress, err := parseCLIIngress(newCli("url", url.String()), false)
-			require.NoError(t, err)
-			require.Equal(t, 1, len(ingress.Rules))
-			rule := ingress.Rules[0]
-			require.Equal(t, &httpService{url: url}, rule.Service)
-		})
-	}
-
-	tcpTests := []string{"ssh", "rdp", "smb", "tcp"}
-	for _, test := range tcpTests {
-		t.Run(test, func(t *testing.T) {
-			url := urlMustParse(test + host)
-			ingress, err := parseCLIIngress(newCli("url", url.String()), false)
-			require.NoError(t, err)
-			require.Equal(t, 1, len(ingress.Rules))
-			rule := ingress.Rules[0]
-			require.Equal(t, newTCPOverWSService(url), rule.Service)
-		})
-	}
-}
-
 func TestFindMatchingRule(t *testing.T) {
 	ingress := Ingress{
 		Rules: []Rule{
@@ -17,12 +17,6 @@ type StreamBasedOriginProxy interface {
 	EstablishConnection(ctx context.Context, dest string) (OriginConnection, error)
 }

-// HTTPLocalProxy can be implemented by cloudflared services that want to handle incoming http requests.
-type HTTPLocalProxy interface {
-	// Handler is how cloudflared proxies eyeball requests to the local cloudflared services
-	http.Handler
-}
-
 func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) {
 	req.URL.Scheme = o.scheme
 	return o.transport.RoundTrip(req)
@@ -50,9 +44,6 @@ func (o *httpService) RoundTrip(req *http.Request) (*http.Response, error) {
 }

 func (o *statusCode) RoundTrip(_ *http.Request) (*http.Response, error) {
-	if o.defaultResp {
-		o.log.Warn().Msgf(ErrNoIngressRulesCLI.Error())
-	}
 	resp := &http.Response{
 		StatusCode: o.code,
 		Status:     fmt.Sprintf("%d %s", o.code, http.StatusText(o.code)),
@@ -17,14 +17,12 @@ import (

 	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/ipaccess"
-	"github.com/cloudflare/cloudflared/management"
 	"github.com/cloudflare/cloudflared/socks"
 	"github.com/cloudflare/cloudflared/tlsconfig"
 )

 const (
 	HelloWorldService = "hello_world"
-	HelloWorldFlag    = "hello-world"
 	HttpStatusService = "http_status"
 )

@@ -248,21 +246,12 @@ func (o helloWorld) MarshalJSON() ([]byte, error) {
 // Typical use-case is "user wants the catch-all rule to just respond 404".
 type statusCode struct {
 	code int
-
-	// Set only when the user has not defined any ingress rules
-	defaultResp bool
-	log         *zerolog.Logger
 }

 func newStatusCode(status int) statusCode {
 	return statusCode{code: status}
 }

-// default status code (503) that is returned for requests to cloudflared that don't have any ingress rules setup
-func newDefaultStatusCode(log *zerolog.Logger) statusCode {
-	return statusCode{code: 503, defaultResp: true, log: log}
-}
-
 func (o *statusCode) String() string {
 	return fmt.Sprintf("http_status:%d", o.code)
 }
@@ -279,54 +268,6 @@ func (o statusCode) MarshalJSON() ([]byte, error) {
 	return json.Marshal(o.String())
 }

-// WarpRoutingService starts a tcp stream between the origin and requests from
-// warp clients.
-type WarpRoutingService struct {
-	Proxy StreamBasedOriginProxy
-}
-
-func NewWarpRoutingService(config WarpRoutingConfig) *WarpRoutingService {
-	svc := &rawTCPService{
-		name: ServiceWarpRouting,
-		dialer: net.Dialer{
-			Timeout:   config.ConnectTimeout.Duration,
-			KeepAlive: config.TCPKeepAlive.Duration,
-		},
-	}
-
-	return &WarpRoutingService{Proxy: svc}
-}
-
-// ManagementService starts a local HTTP server to handle incoming management requests.
-type ManagementService struct {
-	HTTPLocalProxy
-}
-
-func newManagementService(managementProxy HTTPLocalProxy) *ManagementService {
-	return &ManagementService{
-		HTTPLocalProxy: managementProxy,
-	}
-}
-
-func (o *ManagementService) start(log *zerolog.Logger, _ <-chan struct{}, cfg OriginRequestConfig) error {
-	return nil
-}
-
-func (o *ManagementService) String() string {
-	return "management"
-}
-
-func (o ManagementService) MarshalJSON() ([]byte, error) {
-	return json.Marshal(o.String())
-}
-
-func NewManagementRule(management *management.ManagementService) Rule {
-	return Rule{
-		Hostname: management.Hostname,
-		Service:  newManagementService(management),
-	}
-}
-
 type NopReadCloser struct{}

 // Read always returns EOF to signal end of input
@@ -1,66 +0,0 @@
-package test
-
-// copied from https://github.com/nhooyr/websocket/blob/master/internal/test/wstest/pipe.go
-
-import (
-	"bufio"
-	"context"
-	"net"
-	"net/http"
-	"net/http/httptest"
-
-	"nhooyr.io/websocket"
-)
-
-// Pipe is used to create an in memory connection
-// between two websockets analogous to net.Pipe.
-func WSPipe(dialOpts *websocket.DialOptions, acceptOpts *websocket.AcceptOptions) (clientConn, serverConn *websocket.Conn) {
-	tt := fakeTransport{
-		h: func(w http.ResponseWriter, r *http.Request) {
-			serverConn, _ = websocket.Accept(w, r, acceptOpts)
-		},
-	}
-
-	if dialOpts == nil {
-		dialOpts = &websocket.DialOptions{}
-	}
-	dialOpts = &*dialOpts
-	dialOpts.HTTPClient = &http.Client{
-		Transport: tt,
-	}
-
-	clientConn, _, _ = websocket.Dial(context.Background(), "ws://example.com", dialOpts)
-	return clientConn, serverConn
-}
-
-type fakeTransport struct {
-	h http.HandlerFunc
-}
-
-func (t fakeTransport) RoundTrip(r *http.Request) (*http.Response, error) {
-	clientConn, serverConn := net.Pipe()
-
-	hj := testHijacker{
-		ResponseRecorder: httptest.NewRecorder(),
-		serverConn:       serverConn,
-	}
-
-	t.h.ServeHTTP(hj, r)
-
-	resp := hj.ResponseRecorder.Result()
-	if resp.StatusCode == http.StatusSwitchingProtocols {
-		resp.Body = clientConn
-	}
-	return resp, nil
-}
-
-type testHijacker struct {
-	*httptest.ResponseRecorder
-	serverConn net.Conn
-}
-
-var _ http.Hijacker = testHijacker{}
-
-func (hj testHijacker) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	return hj.serverConn, bufio.NewReadWriter(bufio.NewReader(hj.serverConn), bufio.NewWriter(hj.serverConn)), nil
-}
@@ -15,9 +15,6 @@ import (
 	"github.com/urfave/cli/v2"
 	"golang.org/x/term"
 	"gopkg.in/natefinch/lumberjack.v2"
-
-	"github.com/cloudflare/cloudflared/features"
-	"github.com/cloudflare/cloudflared/management"
 )

 const (
@@ -38,19 +35,8 @@ const (
 	consoleTimeFormat = time.RFC3339
 )

-var (
-	ManagementLogger *management.Logger
-)
-
 func init() {
-	zerolog.TimeFieldFormat = time.RFC3339
 	zerolog.TimestampFunc = utcNow
-
-	if features.Contains(features.FeatureManagementLogs) {
-		// Management logger needs to be initialized before any of the other loggers as to not capture
-		// it's own logging events.
-		ManagementLogger = management.NewLogger()
-	}
 }

 func utcNow() time.Time {
@@ -64,36 +50,17 @@ func fallbackLogger(err error) *zerolog.Logger {
 	return &failLog
 }

-// resilientMultiWriter is an alternative to zerolog's so that we can make it resilient to individual
-// writer's errors. E.g., when running as a Windows service, the console writer fails, but we don't want to
-// allow that to prevent all logging to fail due to breaking the for loop upon an error.
 type resilientMultiWriter struct {
-	level            zerolog.Level
-	writers          []io.Writer
-	managementWriter zerolog.LevelWriter
+	writers []io.Writer
 }

+// This custom resilientMultiWriter is an alternative to zerolog's so that we can make it resilient to individual
+// writer's errors. E.g., when running as a Windows service, the console writer fails, but we don't want to
+// allow that to prevent all logging to fail due to breaking the for loop upon an error.
 func (t resilientMultiWriter) Write(p []byte) (n int, err error) {
 	for _, w := range t.writers {
 		_, _ = w.Write(p)
 	}
-	if t.managementWriter != nil {
-		_, _ = t.managementWriter.Write(p)
-	}
-	return len(p), nil
-}
-
-func (t resilientMultiWriter) WriteLevel(level zerolog.Level, p []byte) (n int, err error) {
-	// Only write the event to normal writers if it exceeds the level, but always write to the
-	// management logger and let it decided with the provided level of the log event.
-	if t.level <= level {
-		for _, w := range t.writers {
-			_, _ = w.Write(p)
-		}
-	}
-	if t.managementWriter != nil {
-		_, _ = t.managementWriter.WriteLevel(level, p)
-	}
 	return len(p), nil
 }

@@ -124,18 +91,13 @@ func newZerolog(loggerConfig *Config) *zerolog.Logger {
 		writers = append(writers, rollingLogger)
 	}

-	var managementWriter zerolog.LevelWriter
-	if features.Contains(features.FeatureManagementLogs) {
-		managementWriter = ManagementLogger
-	}
+	multi := resilientMultiWriter{writers}

 	level, levelErr := zerolog.ParseLevel(loggerConfig.MinLevel)
 	if levelErr != nil {
 		level = zerolog.InfoLevel
 	}
-
-	multi := resilientMultiWriter{level, writers, managementWriter}
-	log := zerolog.New(multi).With().Timestamp().Logger()
+	log := zerolog.New(multi).With().Timestamp().Logger().Level(level)
 	if !levelErrorLogged && levelErr != nil {
 		log.Error().Msgf("Failed to parse log level %q, using %q instead", loggerConfig.MinLevel, level)
 		levelErrorLogged = true
@@ -9,13 +9,14 @@ import (
 	"github.com/stretchr/testify/assert"
 )

+var writeCalls int
+
 type mockedWriter struct {
-	wantErr    bool
-	writeCalls int
+	wantErr bool
 }

-func (c *mockedWriter) Write(p []byte) (int, error) {
-	c.writeCalls++
+func (c mockedWriter) Write(p []byte) (int, error) {
+	writeCalls++

 	if c.wantErr {
 		return -1, errors.New("Expected error")
@@ -25,108 +26,65 @@ func (c *mockedWriter) Write(p []byte) (int, error) {
 }

 // Tests that a new writer is only used if it actually works.
-func TestResilientMultiWriter_Errors(t *testing.T) {
+func TestResilientMultiWriter(t *testing.T) {
 	tests := []struct {
 		name    string
-		writers []*mockedWriter
+		writers []io.Writer
 	}{
 		{
 			name: "All valid writers",
-			writers: []*mockedWriter{
-				{
+			writers: []io.Writer{
+				mockedWriter{
 					wantErr: false,
 				},
-				{
+				mockedWriter{
 					wantErr: false,
 				},
 			},
 		},
 		{
 			name: "All invalid writers",
-			writers: []*mockedWriter{
-				{
+			writers: []io.Writer{
+				mockedWriter{
 					wantErr: true,
 				},
-				{
+				mockedWriter{
 					wantErr: true,
 				},
 			},
 		},
 		{
 			name: "First invalid writer",
-			writers: []*mockedWriter{
-				{
+			writers: []io.Writer{
+				mockedWriter{
 					wantErr: true,
 				},
-				{
+				mockedWriter{
 					wantErr: false,
 				},
 			},
 		},
 		{
 			name: "First valid writer",
-			writers: []*mockedWriter{
-				{
+			writers: []io.Writer{
+				mockedWriter{
 					wantErr: false,
 				},
-				{
+				mockedWriter{
 					wantErr: true,
 				},
 			},
 		},
 	}

-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			writers := []io.Writer{}
-			for _, w := range test.writers {
-				writers = append(writers, w)
-			}
-			multiWriter := resilientMultiWriter{zerolog.InfoLevel, writers, nil}
+	for _, tt := range tests {
+		writers := tt.writers
+		multiWriter := resilientMultiWriter{writers}

-			logger := zerolog.New(multiWriter).With().Timestamp().Logger()
-			logger.Info().Msg("Test msg")
+		logger := zerolog.New(multiWriter).With().Timestamp().Logger().Level(zerolog.InfoLevel)
+		logger.Info().Msg("Test msg")

-			for _, w := range test.writers {
-				// Expect each writer to be written to regardless of the previous writers returning an error
-				assert.Equal(t, 1, w.writeCalls)
-			}
-		})
-	}
-}
-
-type mockedManagementWriter struct {
-	WriteCalls int
-}
-
-func (c *mockedManagementWriter) Write(p []byte) (int, error) {
-	return len(p), nil
-}
-
-func (c *mockedManagementWriter) WriteLevel(level zerolog.Level, p []byte) (int, error) {
-	c.WriteCalls++
-	return len(p), nil
-}
-
-// Tests that management writer receives write calls of all levels except Disabled
-func TestResilientMultiWriter_Management(t *testing.T) {
-	for _, level := range []zerolog.Level{
-		zerolog.DebugLevel,
-		zerolog.InfoLevel,
-		zerolog.WarnLevel,
-		zerolog.ErrorLevel,
-		zerolog.FatalLevel,
-		zerolog.PanicLevel,
-	} {
-		t.Run(level.String(), func(t *testing.T) {
-			managementWriter := mockedManagementWriter{}
-			multiWriter := resilientMultiWriter{level, []io.Writer{&mockedWriter{}}, &managementWriter}
-
-			logger := zerolog.New(multiWriter).With().Timestamp().Logger()
-			logger.Info().Msg("Test msg")
-
-			// Always write to management
-			assert.Equal(t, 1, managementWriter.WriteCalls)
-		})
+		assert.Equal(t, len(writers), writeCalls)
+		writeCalls = 0
 	}
 }
@@ -1,317 +0,0 @@
-package management
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-
-	jsoniter "github.com/json-iterator/go"
-	"github.com/rs/zerolog"
-	"nhooyr.io/websocket"
-)
-
-var (
-	errInvalidMessageType = fmt.Errorf("invalid message type was provided")
-)
-
-// ServerEventType represents the event types that can come from the server
-type ServerEventType string
-
-// ClientEventType represents the event types that can come from the client
-type ClientEventType string
-
-const (
-	UnknownClientEventType ClientEventType = ""
-	StartStreaming         ClientEventType = "start_streaming"
-	StopStreaming          ClientEventType = "stop_streaming"
-
-	UnknownServerEventType ServerEventType = ""
-	Logs                   ServerEventType = "logs"
-)
-
-// ServerEvent is the base struct that informs, based of the Type field, which Event type was provided from the server.
-type ServerEvent struct {
-	Type ServerEventType `json:"type,omitempty"`
-	// The raw json message is provided to allow better deserialization once the type is known
-	event jsoniter.RawMessage
-}
-
-// ClientEvent is the base struct that informs, based of the Type field, which Event type was provided from the client.
-type ClientEvent struct {
-	Type ClientEventType `json:"type,omitempty"`
-	// The raw json message is provided to allow better deserialization once the type is known
-	event jsoniter.RawMessage
-}
-
-// EventStartStreaming signifies that the client wishes to start receiving log events.
-// Additional filters can be provided to augment the log events requested.
-type EventStartStreaming struct {
-	ClientEvent
-	Filters *StreamingFilters `json:"filters,omitempty"`
-}
-
-type StreamingFilters struct {
-	Events   []LogEventType `json:"events,omitempty"`
-	Level    *LogLevel      `json:"level,omitempty"`
-	Sampling float64        `json:"sampling,omitempty"`
-}
-
-// EventStopStreaming signifies that the client wishes to halt receiving log events.
-type EventStopStreaming struct {
-	ClientEvent
-}
-
-// EventLog is the event that the server sends to the client with the log events.
-type EventLog struct {
-	ServerEvent
-	Logs []*Log `json:"logs"`
-}
-
-// LogEventType is the way that logging messages are able to be filtered.
-// Example: assigning LogEventType.Cloudflared to a zerolog event will allow the client to filter for only
-// the Cloudflared-related events.
-type LogEventType int8
-
-const (
-	// Cloudflared events are signficant to cloudflared operations like connection state changes.
-	// Cloudflared is also the default event type for any events that haven't been separated into a proper event type.
-	Cloudflared LogEventType = iota
-	HTTP
-	TCP
-	UDP
-)
-
-func ParseLogEventType(s string) (LogEventType, bool) {
-	switch s {
-	case "cloudflared":
-		return Cloudflared, true
-	case "http":
-		return HTTP, true
-	case "tcp":
-		return TCP, true
-	case "udp":
-		return UDP, true
-	}
-	return -1, false
-}
-
-func (l LogEventType) String() string {
-	switch l {
-	case Cloudflared:
-		return "cloudflared"
-	case HTTP:
-		return "http"
-	case TCP:
-		return "tcp"
-	case UDP:
-		return "udp"
-	default:
-		return ""
-	}
-}
-
-func (l LogEventType) MarshalJSON() ([]byte, error) {
-	return json.Marshal(l.String())
-}
-
-func (e *LogEventType) UnmarshalJSON(data []byte) error {
-	var s string
-	if err := json.Unmarshal(data, &s); err != nil {
-		return errors.New("unable to unmarshal LogEventType string")
-	}
-	if event, ok := ParseLogEventType(s); ok {
-		*e = event
-		return nil
-	}
-	return errors.New("unable to unmarshal LogEventType")
-}
-
-// LogLevel corresponds to the zerolog logging levels
-// "panic", "fatal", and "trace" are exempt from this list as they are rarely used and, at least
-// the the first two are limited to failure conditions that lead to cloudflared shutting down.
-type LogLevel int8
-
-const (
-	Debug LogLevel = 0
-	Info  LogLevel = 1
-	Warn  LogLevel = 2
-	Error LogLevel = 3
-)
-
-func ParseLogLevel(l string) (LogLevel, bool) {
-	switch l {
-	case "debug":
-		return Debug, true
-	case "info":
-		return Info, true
-	case "warn":
-		return Warn, true
-	case "error":
-		return Error, true
-	}
-	return -1, false
-}
-
-func (l LogLevel) String() string {
-	switch l {
-	case Debug:
-		return "debug"
-	case Info:
-		return "info"
-	case Warn:
-		return "warn"
-	case Error:
-		return "error"
-	default:
-		return ""
-	}
-}
-
-func (l LogLevel) MarshalJSON() ([]byte, error) {
-	return json.Marshal(l.String())
-}
-
-func (l *LogLevel) UnmarshalJSON(data []byte) error {
-	var s string
-	if err := json.Unmarshal(data, &s); err != nil {
-		return errors.New("unable to unmarshal LogLevel string")
-	}
-	if level, ok := ParseLogLevel(s); ok {
-		*l = level
-		return nil
-	}
-	return fmt.Errorf("unable to unmarshal LogLevel")
-}
-
-const (
-	// TimeKey aligns with the zerolog.TimeFieldName
-	TimeKey = "time"
-	// LevelKey aligns with the zerolog.LevelFieldName
-	LevelKey = "level"
-	// LevelKey aligns with the zerolog.MessageFieldName
-	MessageKey = "message"
-	// EventTypeKey is the custom JSON key of the LogEventType in ZeroLogEvent
-	EventTypeKey = "event"
-	// FieldsKey is a custom JSON key to match and store every other key for a zerolog event
-	FieldsKey = "fields"
-)
-
-// Log is the basic structure of the events that are sent to the client.
-type Log struct {
-	Time    string                 `json:"time,omitempty"`
-	Level   LogLevel               `json:"level,omitempty"`
-	Message string                 `json:"message,omitempty"`
-	Event   LogEventType           `json:"event,omitempty"`
-	Fields  map[string]interface{} `json:"fields,omitempty"`
-}
-
-// IntoClientEvent unmarshals the provided ClientEvent into the proper type.
-func IntoClientEvent[T EventStartStreaming | EventStopStreaming](e *ClientEvent, eventType ClientEventType) (*T, bool) {
-	if e.Type != eventType {
-		return nil, false
-	}
-	event := new(T)
-	err := json.Unmarshal(e.event, event)
-	if err != nil {
-		return nil, false
-	}
-	return event, true
-}
-
-// IntoServerEvent unmarshals the provided ServerEvent into the proper type.
-func IntoServerEvent[T EventLog](e *ServerEvent, eventType ServerEventType) (*T, bool) {
-	if e.Type != eventType {
-		return nil, false
-	}
-	event := new(T)
-	err := json.Unmarshal(e.event, event)
-	if err != nil {
-		return nil, false
-	}
-	return event, true
-}
-
-// ReadEvent will read a message from the websocket connection and parse it into a valid ServerEvent.
-func ReadServerEvent(c *websocket.Conn, ctx context.Context) (*ServerEvent, error) {
-	message, err := readMessage(c, ctx)
-	if err != nil {
-		return nil, err
-	}
-	event := ServerEvent{}
-	if err := json.Unmarshal(message, &event); err != nil {
-		return nil, err
-	}
-	switch event.Type {
-	case Logs:
-		event.event = message
-		return &event, nil
-	case UnknownServerEventType:
-		return nil, errInvalidMessageType
-	default:
-		return nil, fmt.Errorf("invalid server message type was provided: %s", event.Type)
-	}
-}
-
-// ReadEvent will read a message from the websocket connection and parse it into a valid ClientEvent.
-func ReadClientEvent(c *websocket.Conn, ctx context.Context) (*ClientEvent, error) {
-	message, err := readMessage(c, ctx)
-	if err != nil {
-		return nil, err
-	}
-	event := ClientEvent{}
-	if err := json.Unmarshal(message, &event); err != nil {
-		return nil, err
-	}
-	switch event.Type {
-	case StartStreaming, StopStreaming:
-		event.event = message
-		return &event, nil
-	case UnknownClientEventType:
-		return nil, errInvalidMessageType
-	default:
-		return nil, fmt.Errorf("invalid client message type was provided: %s", event.Type)
-	}
-}
-
-// readMessage will read a message from the websocket connection and return the payload.
-func readMessage(c *websocket.Conn, ctx context.Context) ([]byte, error) {
-	messageType, reader, err := c.Reader(ctx)
-	if err != nil {
-		return nil, err
-	}
-	if messageType != websocket.MessageText {
-		return nil, errInvalidMessageType
-	}
-	return io.ReadAll(reader)
-}
-
-// WriteEvent will write a Event type message to the websocket connection.
-func WriteEvent(c *websocket.Conn, ctx context.Context, event any) error {
-	payload, err := json.Marshal(event)
-	if err != nil {
-		return err
-	}
-	return c.Write(ctx, websocket.MessageText, payload)
-}
-
-// IsClosed returns true if the websocket error is a websocket.CloseError; returns false if not a
-// websocket.CloseError
-func IsClosed(err error, log *zerolog.Logger) bool {
-	var closeErr websocket.CloseError
-	if errors.As(err, &closeErr) {
-		if closeErr.Code != websocket.StatusNormalClosure {
-			log.Debug().Msgf("connection is already closed: (%d) %s", closeErr.Code, closeErr.Reason)
-		}
-		return true
-	}
-	return false
-}
-
-func AsClosed(err error) *websocket.CloseError {
-	var closeErr websocket.CloseError
-	if errors.As(err, &closeErr) {
-		return &closeErr
-	}
-	return nil
-}
@@ -1,247 +0,0 @@
-package management
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"nhooyr.io/websocket"
-
-	"github.com/cloudflare/cloudflared/internal/test"
-)
-
-var (
-	debugLevel *LogLevel
-	infoLevel  *LogLevel
-	warnLevel  *LogLevel
-	errorLevel *LogLevel
-)
-
-func init() {
-	// created here because we can't do a reference to a const enum, i.e. &Info
-	debugLevel := new(LogLevel)
-	*debugLevel = Debug
-	infoLevel := new(LogLevel)
-	*infoLevel = Info
-	warnLevel := new(LogLevel)
-	*warnLevel = Warn
-	errorLevel := new(LogLevel)
-	*errorLevel = Error
-}
-
-func TestIntoClientEvent_StartStreaming(t *testing.T) {
-	for _, test := range []struct {
-		name     string
-		expected EventStartStreaming
-	}{
-		{
-			name:     "no filters",
-			expected: EventStartStreaming{ClientEvent: ClientEvent{Type: StartStreaming}},
-		},
-		{
-			name: "level filter",
-			expected: EventStartStreaming{
-				ClientEvent: ClientEvent{Type: StartStreaming},
-				Filters: &StreamingFilters{
-					Level: infoLevel,
-				},
-			},
-		},
-		{
-			name: "events filter",
-			expected: EventStartStreaming{
-				ClientEvent: ClientEvent{Type: StartStreaming},
-				Filters: &StreamingFilters{
-					Events: []LogEventType{Cloudflared, HTTP},
-				},
-			},
-		},
-		{
-			name: "sampling filter",
-			expected: EventStartStreaming{
-				ClientEvent: ClientEvent{Type: StartStreaming},
-				Filters: &StreamingFilters{
-					Sampling: 0.5,
-				},
-			},
-		},
-		{
-			name: "level and events filters",
-			expected: EventStartStreaming{
-				ClientEvent: ClientEvent{Type: StartStreaming},
-				Filters: &StreamingFilters{
-					Level:    infoLevel,
-					Events:   []LogEventType{Cloudflared},
-					Sampling: 0.5,
-				},
-			},
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			data, err := json.Marshal(test.expected)
-			require.NoError(t, err)
-			event := ClientEvent{}
-			err = json.Unmarshal(data, &event)
-			require.NoError(t, err)
-			event.event = data
-			ce, ok := IntoClientEvent[EventStartStreaming](&event, StartStreaming)
-			require.True(t, ok)
-			require.Equal(t, test.expected.ClientEvent, ce.ClientEvent)
-			if test.expected.Filters != nil {
-				f := ce.Filters
-				ef := test.expected.Filters
-				if ef.Level != nil {
-					require.Equal(t, *ef.Level, *f.Level)
-				}
-				require.ElementsMatch(t, ef.Events, f.Events)
-			}
-		})
-	}
-}
-
-func TestIntoClientEvent_StopStreaming(t *testing.T) {
-	event := ClientEvent{
-		Type:  StopStreaming,
-		event: []byte(`{"type": "stop_streaming"}`),
-	}
-	ce, ok := IntoClientEvent[EventStopStreaming](&event, StopStreaming)
-	require.True(t, ok)
-	require.Equal(t, EventStopStreaming{ClientEvent: ClientEvent{Type: StopStreaming}}, *ce)
-}
-
-func TestIntoClientEvent_Invalid(t *testing.T) {
-	event := ClientEvent{
-		Type:  UnknownClientEventType,
-		event: []byte(`{"type": "invalid"}`),
-	}
-	_, ok := IntoClientEvent[EventStartStreaming](&event, StartStreaming)
-	require.False(t, ok)
-}
-
-func TestIntoServerEvent_Logs(t *testing.T) {
-	event := ServerEvent{
-		Type:  Logs,
-		event: []byte(`{"type": "logs"}`),
-	}
-	ce, ok := IntoServerEvent(&event, Logs)
-	require.True(t, ok)
-	require.Equal(t, EventLog{ServerEvent: ServerEvent{Type: Logs}}, *ce)
-}
-
-func TestIntoServerEvent_Invalid(t *testing.T) {
-	event := ServerEvent{
-		Type:  UnknownServerEventType,
-		event: []byte(`{"type": "invalid"}`),
-	}
-	_, ok := IntoServerEvent(&event, Logs)
-	require.False(t, ok)
-}
-
-func TestReadServerEvent(t *testing.T) {
-	sentEvent := EventLog{
-		ServerEvent: ServerEvent{Type: Logs},
-		Logs: []*Log{
-			{
-				Time:    time.Now().UTC().Format(time.RFC3339),
-				Event:   HTTP,
-				Level:   Info,
-				Message: "test",
-			},
-		},
-	}
-	client, server := test.WSPipe(nil, nil)
-	server.CloseRead(context.Background())
-	defer func() {
-		server.Close(websocket.StatusInternalError, "")
-	}()
-	go func() {
-		err := WriteEvent(server, context.Background(), &sentEvent)
-		require.NoError(t, err)
-	}()
-	event, err := ReadServerEvent(client, context.Background())
-	require.NoError(t, err)
-	require.Equal(t, sentEvent.Type, event.Type)
-	client.Close(websocket.StatusInternalError, "")
-}
-
-func TestReadServerEvent_InvalidWebSocketMessageType(t *testing.T) {
-	client, server := test.WSPipe(nil, nil)
-	server.CloseRead(context.Background())
-	defer func() {
-		server.Close(websocket.StatusInternalError, "")
-	}()
-	go func() {
-		err := server.Write(context.Background(), websocket.MessageBinary, []byte("test1234"))
-		require.NoError(t, err)
-	}()
-	_, err := ReadServerEvent(client, context.Background())
-	require.Error(t, err)
-	client.Close(websocket.StatusInternalError, "")
-}
-
-func TestReadServerEvent_InvalidMessageType(t *testing.T) {
-	sentEvent := ClientEvent{Type: ClientEventType(UnknownServerEventType)}
-	client, server := test.WSPipe(nil, nil)
-	server.CloseRead(context.Background())
-	defer func() {
-		server.Close(websocket.StatusInternalError, "")
-	}()
-	go func() {
-		err := WriteEvent(server, context.Background(), &sentEvent)
-		require.NoError(t, err)
-	}()
-	_, err := ReadServerEvent(client, context.Background())
-	require.ErrorIs(t, err, errInvalidMessageType)
-	client.Close(websocket.StatusInternalError, "")
-}
-
-func TestReadClientEvent(t *testing.T) {
-	sentEvent := EventStartStreaming{
-		ClientEvent: ClientEvent{Type: StartStreaming},
-	}
-	client, server := test.WSPipe(nil, nil)
-	client.CloseRead(context.Background())
-	defer func() {
-		client.Close(websocket.StatusInternalError, "")
-	}()
-	go func() {
-		err := WriteEvent(client, context.Background(), &sentEvent)
-		require.NoError(t, err)
-	}()
-	event, err := ReadClientEvent(server, context.Background())
-	require.NoError(t, err)
-	require.Equal(t, sentEvent.Type, event.Type)
-	server.Close(websocket.StatusInternalError, "")
-}
-
-func TestReadClientEvent_InvalidWebSocketMessageType(t *testing.T) {
-	client, server := test.WSPipe(nil, nil)
-	client.CloseRead(context.Background())
-	defer func() {
-		client.Close(websocket.StatusInternalError, "")
-	}()
-	go func() {
-		err := client.Write(context.Background(), websocket.MessageBinary, []byte("test1234"))
-		require.NoError(t, err)
-	}()
-	_, err := ReadClientEvent(server, context.Background())
-	require.Error(t, err)
-	server.Close(websocket.StatusInternalError, "")
-}
-
-func TestReadClientEvent_InvalidMessageType(t *testing.T) {
-	sentEvent := ClientEvent{Type: UnknownClientEventType}
-	client, server := test.WSPipe(nil, nil)
-	client.CloseRead(context.Background())
-	defer func() {
-		client.Close(websocket.StatusInternalError, "")
-	}()
-	go func() {
-		err := WriteEvent(client, context.Background(), &sentEvent)
-		require.NoError(t, err)
-	}()
-	_, err := ReadClientEvent(server, context.Background())
-	require.ErrorIs(t, err, errInvalidMessageType)
-	server.Close(websocket.StatusInternalError, "")
-}
@@ -1,177 +0,0 @@
-package management
-
-import (
-	"os"
-	"sync"
-	"time"
-
-	jsoniter "github.com/json-iterator/go"
-	"github.com/rs/zerolog"
-)
-
-var json = jsoniter.ConfigFastest
-
-// Logger manages the number of management streaming log sessions
-type Logger struct {
-	sessions []*session
-	mu       sync.RWMutex
-
-	// Unique logger that isn't a io.Writer of the list of zerolog writers. This helps prevent management log
-	// statements from creating infinite recursion to export messages to a session and allows basic debugging and
-	// error statements to be issued in the management code itself.
-	Log *zerolog.Logger
-}
-
-func NewLogger() *Logger {
-	log := zerolog.New(zerolog.ConsoleWriter{
-		Out:        os.Stdout,
-		TimeFormat: time.RFC3339,
-	}).With().Timestamp().Logger().Level(zerolog.InfoLevel)
-	return &Logger{
-		Log: &log,
-	}
-}
-
-type LoggerListener interface {
-	// ActiveSession returns the first active session for the requested actor.
-	ActiveSession(actor) *session
-	// ActiveSession returns the count of active sessions.
-	ActiveSessions() int
-	// Listen appends the session to the list of sessions that receive log events.
-	Listen(*session)
-	// Remove a session from the available sessions that were receiving log events.
-	Remove(*session)
-}
-
-func (l *Logger) ActiveSession(actor actor) *session {
-	l.mu.RLock()
-	defer l.mu.RUnlock()
-	for _, session := range l.sessions {
-		if session.actor.ID == actor.ID && session.active.Load() {
-			return session
-		}
-	}
-	return nil
-}
-
-func (l *Logger) ActiveSessions() int {
-	l.mu.RLock()
-	defer l.mu.RUnlock()
-	count := 0
-	for _, session := range l.sessions {
-		if session.active.Load() {
-			count += 1
-		}
-	}
-	return count
-}
-
-func (l *Logger) Listen(session *session) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	session.active.Store(true)
-	l.sessions = append(l.sessions, session)
-}
-
-func (l *Logger) Remove(session *session) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	index := -1
-	for i, v := range l.sessions {
-		if v == session {
-			index = i
-			break
-		}
-	}
-	if index == -1 {
-		// Not found
-		return
-	}
-	copy(l.sessions[index:], l.sessions[index+1:])
-	l.sessions = l.sessions[:len(l.sessions)-1]
-}
-
-// Write will write the log event to all sessions that have available capacity. For those that are full, the message
-// will be dropped.
-// This function is the interface that zerolog expects to call when a log event is to be written out.
-func (l *Logger) Write(p []byte) (int, error) {
-	l.mu.RLock()
-	defer l.mu.RUnlock()
-	// return early if no active sessions
-	if len(l.sessions) == 0 {
-		return len(p), nil
-	}
-	event, err := parseZerologEvent(p)
-	// drop event if unable to parse properly
-	if err != nil {
-		l.Log.Debug().Msg("unable to parse log event")
-		return len(p), nil
-	}
-	for _, session := range l.sessions {
-		session.Insert(event)
-	}
-	return len(p), nil
-}
-
-func (l *Logger) WriteLevel(level zerolog.Level, p []byte) (n int, err error) {
-	return l.Write(p)
-}
-
-func parseZerologEvent(p []byte) (*Log, error) {
-	var fields map[string]interface{}
-	iter := json.BorrowIterator(p)
-	defer json.ReturnIterator(iter)
-	iter.ReadVal(&fields)
-	if iter.Error != nil {
-		return nil, iter.Error
-	}
-	logTime := time.Now().UTC().Format(zerolog.TimeFieldFormat)
-	if t, ok := fields[TimeKey]; ok {
-		if t, ok := t.(string); ok {
-			logTime = t
-		}
-	}
-	logLevel := Debug
-	// A zerolog Debug event can be created and then an error can be added
-	// via .Err(error), if so, we upgrade the level to error.
-	if _, hasError := fields["error"]; hasError {
-		logLevel = Error
-	} else {
-		if level, ok := fields[LevelKey]; ok {
-			if level, ok := level.(string); ok {
-				if logLevel, ok = ParseLogLevel(level); !ok {
-					logLevel = Debug
-				}
-			}
-		}
-	}
-	// Assume the event type is Cloudflared if unable to parse/find. This could be from log events that haven't
-	// yet been tagged with the appropriate EventType yet.
-	logEvent := Cloudflared
-	e := fields[EventTypeKey]
-	if e != nil {
-		if eventNumber, ok := e.(float64); ok {
-			logEvent = LogEventType(eventNumber)
-		}
-	}
-	logMessage := ""
-	if m, ok := fields[MessageKey]; ok {
-		if m, ok := m.(string); ok {
-			logMessage = m
-		}
-	}
-	event := Log{
-		Time:    logTime,
-		Level:   logLevel,
-		Event:   logEvent,
-		Message: logMessage,
-	}
-	// Remove the keys that have top level keys on Log
-	delete(fields, TimeKey)
-	delete(fields, LevelKey)
-	delete(fields, EventTypeKey)
-	delete(fields, MessageKey)
-	// The rest of the keys go into the Fields
-	event.Fields = fields
-	return &event, nil
-}
@@ -1,152 +0,0 @@
-package management
-
-import (
-	"context"
-	"testing"
-
-	"github.com/rs/zerolog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// No listening sessions will not write to the channel
-func TestLoggerWrite_NoSessions(t *testing.T) {
-	logger := NewLogger()
-	zlog := zerolog.New(logger).With().Timestamp().Logger().Level(zerolog.InfoLevel)
-
-	zlog.Info().Msg("hello")
-}
-
-// Validate that the session receives the event
-func TestLoggerWrite_OneSession(t *testing.T) {
-	logger := NewLogger()
-	zlog := zerolog.New(logger).With().Timestamp().Logger().Level(zerolog.InfoLevel)
-	_, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	session := newSession(logWindow, actor{ID: actorID}, cancel)
-	logger.Listen(session)
-	defer logger.Remove(session)
-	assert.Equal(t, 1, logger.ActiveSessions())
-	assert.Equal(t, session, logger.ActiveSession(actor{ID: actorID}))
-	zlog.Info().Int(EventTypeKey, int(HTTP)).Msg("hello")
-	select {
-	case event := <-session.listener:
-		assert.NotEmpty(t, event.Time)
-		assert.Equal(t, "hello", event.Message)
-		assert.Equal(t, Info, event.Level)
-		assert.Equal(t, HTTP, event.Event)
-	default:
-		assert.Fail(t, "expected an event to be in the listener")
-	}
-}
-
-// Validate all sessions receive the same event
-func TestLoggerWrite_MultipleSessions(t *testing.T) {
-	logger := NewLogger()
-	zlog := zerolog.New(logger).With().Timestamp().Logger().Level(zerolog.InfoLevel)
-	_, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	session1 := newSession(logWindow, actor{}, cancel)
-	logger.Listen(session1)
-	defer logger.Remove(session1)
-	assert.Equal(t, 1, logger.ActiveSessions())
-
-	session2 := newSession(logWindow, actor{}, cancel)
-	logger.Listen(session2)
-	assert.Equal(t, 2, logger.ActiveSessions())
-
-	zlog.Info().Int(EventTypeKey, int(HTTP)).Msg("hello")
-	for _, session := range []*session{session1, session2} {
-		select {
-		case event := <-session.listener:
-			assert.NotEmpty(t, event.Time)
-			assert.Equal(t, "hello", event.Message)
-			assert.Equal(t, Info, event.Level)
-			assert.Equal(t, HTTP, event.Event)
-		default:
-			assert.Fail(t, "expected an event to be in the listener")
-		}
-	}
-
-	// Close session2 and make sure session1 still receives events
-	logger.Remove(session2)
-	zlog.Info().Int(EventTypeKey, int(HTTP)).Msg("hello2")
-	select {
-	case event := <-session1.listener:
-		assert.NotEmpty(t, event.Time)
-		assert.Equal(t, "hello2", event.Message)
-		assert.Equal(t, Info, event.Level)
-		assert.Equal(t, HTTP, event.Event)
-	default:
-		assert.Fail(t, "expected an event to be in the listener")
-	}
-
-	// Make sure a held reference to session2 doesn't receive events after being closed
-	select {
-	case <-session2.listener:
-		assert.Fail(t, "An event was not expected to be in the session listener")
-	default:
-		// pass
-	}
-}
-
-type mockWriter struct {
-	event *Log
-	err   error
-}
-
-func (m *mockWriter) Write(p []byte) (int, error) {
-	m.event, m.err = parseZerologEvent(p)
-	return len(p), nil
-}
-
-// Validate all event types are set properly
-func TestParseZerologEvent_EventTypes(t *testing.T) {
-	writer := mockWriter{}
-	zlog := zerolog.New(&writer).With().Timestamp().Logger().Level(zerolog.InfoLevel)
-
-	for _, test := range []LogEventType{
-		Cloudflared,
-		HTTP,
-		TCP,
-		UDP,
-	} {
-		t.Run(test.String(), func(t *testing.T) {
-			defer func() { writer.err = nil }()
-			zlog.Info().Int(EventTypeKey, int(test)).Msg("test")
-			require.NoError(t, writer.err)
-			require.Equal(t, test, writer.event.Event)
-		})
-	}
-
-	// Invalid defaults to Cloudflared LogEventType
-	t.Run("invalid", func(t *testing.T) {
-		defer func() { writer.err = nil }()
-		zlog.Info().Str(EventTypeKey, "unknown").Msg("test")
-		require.NoError(t, writer.err)
-		require.Equal(t, Cloudflared, writer.event.Event)
-	})
-}
-
-// Validate top-level keys are removed from Fields
-func TestParseZerologEvent_Fields(t *testing.T) {
-	writer := mockWriter{}
-	zlog := zerolog.New(&writer).With().Timestamp().Logger().Level(zerolog.InfoLevel)
-	zlog.Info().Int(EventTypeKey, int(Cloudflared)).Str("test", "test").Msg("test message")
-	require.NoError(t, writer.err)
-	event := writer.event
-	require.NotEmpty(t, event.Time)
-	require.Equal(t, Cloudflared, event.Event)
-	require.Equal(t, Info, event.Level)
-	require.Equal(t, "test message", event.Message)
-
-	// Make sure Fields doesn't have other set keys used in the Log struct
-	require.NotEmpty(t, event.Fields)
-	require.Equal(t, "test", event.Fields["test"])
-	require.NotContains(t, event.Fields, EventTypeKey)
-	require.NotContains(t, event.Fields, LevelKey)
-	require.NotContains(t, event.Fields, MessageKey)
-	require.NotContains(t, event.Fields, TimeKey)
-}
@@ -1,76 +0,0 @@
-package management
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-)
-
-type ctxKey int
-
-const (
-	accessClaimsCtxKey ctxKey = iota
-)
-
-const (
-	connectorIDQuery = "connector_id"
-	accessTokenQuery = "access_token"
-)
-
-var (
-	errMissingAccessToken = managementError{Code: 1001, Message: "missing access_token query parameter"}
-)
-
-// HTTP middleware setting the parsed access_token claims in the request context
-func ValidateAccessTokenQueryMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Validate access token
-		accessToken := r.URL.Query().Get("access_token")
-		if accessToken == "" {
-			writeHTTPErrorResponse(w, errMissingAccessToken)
-			return
-		}
-		token, err := parseToken(accessToken)
-		if err != nil {
-			writeHTTPErrorResponse(w, errMissingAccessToken)
-			return
-		}
-		r = r.WithContext(context.WithValue(r.Context(), accessClaimsCtxKey, token))
-		next.ServeHTTP(w, r)
-	})
-}
-
-// Middleware validation error struct for returning to the eyeball
-type managementError struct {
-	Code    int    `json:"code,omitempty"`
-	Message string `json:"message,omitempty"`
-}
-
-func (m *managementError) Error() string {
-	return m.Message
-}
-
-// Middleware validation error HTTP response JSON for returning to the eyeball
-type managementErrorResponse struct {
-	Success bool              `json:"success,omitempty"`
-	Errors  []managementError `json:"errors,omitempty"`
-}
-
-// writeErrorResponse will respond to the eyeball with basic HTTP JSON payloads with validation failure information
-func writeHTTPErrorResponse(w http.ResponseWriter, errResp managementError) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusBadRequest)
-	err := json.NewEncoder(w).Encode(managementErrorResponse{
-		Success: false,
-		Errors:  []managementError{errResp},
-	})
-	// we have already written the header, so write a basic error response if unable to encode the error
-	if err != nil {
-		// fallback to text message
-		http.Error(w, fmt.Sprintf(
-			"%d %s",
-			http.StatusBadRequest,
-			http.StatusText(http.StatusBadRequest),
-		), http.StatusBadRequest)
-	}
-}
@@ -1,71 +0,0 @@
-package management
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestValidateAccessTokenQueryMiddleware(t *testing.T) {
-	r := chi.NewRouter()
-	r.Use(ValidateAccessTokenQueryMiddleware)
-	r.Get("/valid", func(w http.ResponseWriter, r *http.Request) {
-		claims, ok := r.Context().Value(accessClaimsCtxKey).(*managementTokenClaims)
-		assert.True(t, ok)
-		assert.True(t, claims.verify())
-		w.WriteHeader(http.StatusOK)
-	})
-	r.Get("/invalid", func(w http.ResponseWriter, r *http.Request) {
-		_, ok := r.Context().Value(accessClaimsCtxKey).(*managementTokenClaims)
-		assert.False(t, ok)
-		w.WriteHeader(http.StatusOK)
-	})
-
-	ts := httptest.NewServer(r)
-	defer ts.Close()
-
-	// valid: with access_token query param
-	path := "/valid?access_token=" + validToken
-	resp, _ := testRequest(t, ts, "GET", path, nil)
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
-
-	// invalid: unset token
-	path = "/invalid"
-	resp, err := testRequest(t, ts, "GET", path, nil)
-	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
-	assert.NotNil(t, err)
-	assert.Equal(t, errMissingAccessToken, err.Errors[0])
-
-	// invalid: invalid token
-	path = "/invalid?access_token=eyJ"
-	resp, err = testRequest(t, ts, "GET", path, nil)
-	assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
-	assert.NotNil(t, err)
-	assert.Equal(t, errMissingAccessToken, err.Errors[0])
-}
-
-func testRequest(t *testing.T, ts *httptest.Server, method, path string, body io.Reader) (*http.Response, *managementErrorResponse) {
-	req, err := http.NewRequest(method, ts.URL+path, body)
-	if err != nil {
-		t.Fatal(err)
-		return nil, nil
-	}
-
-	resp, err := ts.Client().Do(req)
-	if err != nil {
-		t.Fatal(err)
-		return nil, nil
-	}
-	var claims managementErrorResponse
-	err = json.NewDecoder(resp.Body).Decode(&claims)
-	if err != nil {
-		return resp, nil
-	}
-	defer resp.Body.Close()
-
-	return resp, &claims
-}
@@ -1,302 +0,0 @@
-package management
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"sync"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/google/uuid"
-	"github.com/rs/zerolog"
-	"nhooyr.io/websocket"
-)
-
-const (
-	// In the current state, an invalid command was provided by the client
-	StatusInvalidCommand websocket.StatusCode = 4001
-	reasonInvalidCommand                      = "expected start streaming as first event"
-	// There are a limited number of available streaming log sessions that cloudflared will service, exceeding this
-	// value will return this error to incoming requests.
-	StatusSessionLimitExceeded websocket.StatusCode = 4002
-	reasonSessionLimitExceeded                      = "limit exceeded for streaming sessions"
-	// There is a limited idle time while not actively serving a session for a request before dropping the connection.
-	StatusIdleLimitExceeded websocket.StatusCode = 4003
-	reasonIdleLimitExceeded                      = "session was idle for too long"
-)
-
-type ManagementService struct {
-	// The management tunnel hostname
-	Hostname string
-
-	// Host details related configurations
-	serviceIP string
-	clientID  uuid.UUID
-	label     string
-
-	log    *zerolog.Logger
-	router chi.Router
-
-	// streamingMut is a lock to prevent concurrent requests to start streaming. Utilizing the atomic.Bool is not
-	// sufficient to complete this operation since many other checks during an incoming new request are needed
-	// to validate this before setting streaming to true.
-	streamingMut sync.Mutex
-	logger       LoggerListener
-}
-
-func New(managementHostname string,
-	serviceIP string,
-	clientID uuid.UUID,
-	label string,
-	log *zerolog.Logger,
-	logger LoggerListener,
-) *ManagementService {
-	s := &ManagementService{
-		Hostname:  managementHostname,
-		log:       log,
-		logger:    logger,
-		serviceIP: serviceIP,
-		clientID:  clientID,
-		label:     label,
-	}
-	r := chi.NewRouter()
-	r.Use(ValidateAccessTokenQueryMiddleware)
-	r.Get("/ping", ping)
-	r.Head("/ping", ping)
-	r.Get("/logs", s.logs)
-	r.Get("/host_details", s.getHostDetails)
-	s.router = r
-	return s
-}
-
-func (m *ManagementService) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	m.router.ServeHTTP(w, r)
-}
-
-// Management Ping handler
-func ping(w http.ResponseWriter, r *http.Request) {
-	w.WriteHeader(200)
-}
-
-// The response provided by the /host_details endpoint
-type getHostDetailsResponse struct {
-	ClientID string `json:"connector_id"`
-	IP       string `json:"ip,omitempty"`
-	HostName string `json:"hostname,omitempty"`
-}
-
-func (m *ManagementService) getHostDetails(w http.ResponseWriter, r *http.Request) {
-	var getHostDetailsResponse = getHostDetailsResponse{
-		ClientID: m.clientID.String(),
-	}
-	if ip, err := getPrivateIP(m.serviceIP); err == nil {
-		getHostDetailsResponse.IP = ip
-	}
-	getHostDetailsResponse.HostName = m.getLabel()
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(200)
-	json.NewEncoder(w).Encode(getHostDetailsResponse)
-}
-
-func (m *ManagementService) getLabel() string {
-	if m.label != "" {
-		return fmt.Sprintf("custom:%s", m.label)
-	}
-
-	// If no label is provided we return the system hostname. This is not
-	// a fqdn hostname.
-	hostname, err := os.Hostname()
-	if err != nil {
-		return "unknown"
-	}
-	return hostname
-}
-
-// Get preferred private ip of this machine
-func getPrivateIP(addr string) (string, error) {
-	conn, err := net.DialTimeout("tcp", addr, 1*time.Second)
-	if err != nil {
-		return "", err
-	}
-	defer conn.Close()
-	localAddr := conn.LocalAddr().String()
-	host, _, err := net.SplitHostPort(localAddr)
-	return host, err
-}
-
-// readEvents will loop through all incoming websocket messages from a client and marshal them into the
-// proper Event structure and pass through to the events channel. Any invalid messages sent will automatically
-// terminate the connection.
-func (m *ManagementService) readEvents(c *websocket.Conn, ctx context.Context, events chan<- *ClientEvent) {
-	for {
-		event, err := ReadClientEvent(c, ctx)
-		select {
-		case <-ctx.Done():
-			return
-		default:
-			if err != nil {
-				// If the client (or the server) already closed the connection, don't attempt to close it again
-				if !IsClosed(err, m.log) {
-					m.log.Err(err).Send()
-					m.log.Err(c.Close(websocket.StatusUnsupportedData, err.Error())).Send()
-				}
-				// Any errors when reading the messages from the client will close the connection
-				return
-			}
-			events <- event
-		}
-	}
-}
-
-// streamLogs will begin the process of reading from the Session listener and write the log events to the client.
-func (m *ManagementService) streamLogs(c *websocket.Conn, ctx context.Context, session *session) {
-	for session.Active() {
-		select {
-		case <-ctx.Done():
-			session.Stop()
-			return
-		case event := <-session.listener:
-			err := WriteEvent(c, ctx, &EventLog{
-				ServerEvent: ServerEvent{Type: Logs},
-				Logs:        []*Log{event},
-			})
-			if err != nil {
-				// If the client (or the server) already closed the connection, don't attempt to close it again
-				if !IsClosed(err, m.log) {
-					m.log.Err(err).Send()
-					m.log.Err(c.Close(websocket.StatusInternalError, err.Error())).Send()
-				}
-				// Any errors when writing the messages to the client will stop streaming and close the connection
-				session.Stop()
-				return
-			}
-		default:
-			// No messages to send
-		}
-	}
-}
-
-// canStartStream will check the conditions of the request and return if the session can begin streaming.
-func (m *ManagementService) canStartStream(session *session) bool {
-	m.streamingMut.Lock()
-	defer m.streamingMut.Unlock()
-	// Limits to one actor for streaming logs
-	if m.logger.ActiveSessions() > 0 {
-		// Allow the same user to preempt their existing session to disconnect their old session and start streaming
-		// with this new session instead.
-		if existingSession := m.logger.ActiveSession(session.actor); existingSession != nil {
-			m.log.Info().
-				Msgf("Another management session request for the same actor was requested; the other session will be disconnected to handle the new request.")
-			existingSession.Stop()
-			m.logger.Remove(existingSession)
-			existingSession.cancel()
-		} else {
-			m.log.Warn().
-				Msgf("Another management session request was attempted but one session already being served; there is a limit of streaming log sessions to reduce overall performance impact.")
-			return false
-		}
-	}
-	return true
-}
-
-// parseFilters will check the ClientEvent for start_streaming and assign filters if provided to the session
-func (m *ManagementService) parseFilters(c *websocket.Conn, event *ClientEvent, session *session) bool {
-	// Expect the first incoming request
-	startEvent, ok := IntoClientEvent[EventStartStreaming](event, StartStreaming)
-	if !ok {
-		return false
-	}
-	session.Filters(startEvent.Filters)
-	return true
-}
-
-// Management Streaming Logs accept handler
-func (m *ManagementService) logs(w http.ResponseWriter, r *http.Request) {
-	c, err := websocket.Accept(w, r, nil)
-	if err != nil {
-		m.log.Debug().Msgf("management handshake: %s", err.Error())
-		return
-	}
-	// Make sure the connection is closed if other go routines fail to close the connection after completing.
-	defer c.Close(websocket.StatusInternalError, "")
-	ctx, cancel := context.WithCancel(r.Context())
-	defer cancel()
-	events := make(chan *ClientEvent)
-	go m.readEvents(c, ctx, events)
-
-	// Send a heartbeat ping to hold the connection open even if not streaming.
-	ping := time.NewTicker(15 * time.Second)
-	defer ping.Stop()
-
-	// Close the connection if no operation has occurred after the idle timeout. The timeout is halted
-	// when streaming logs is active.
-	idleTimeout := 5 * time.Minute
-	idle := time.NewTimer(idleTimeout)
-	defer idle.Stop()
-
-	// Fetch the claims from the request context to acquire the actor
-	claims, ok := ctx.Value(accessClaimsCtxKey).(*managementTokenClaims)
-	if !ok || claims == nil {
-		// Typically should never happen as it is provided in the context from the middleware
-		m.log.Err(c.Close(websocket.StatusInternalError, "missing access_token")).Send()
-		return
-	}
-
-	session := newSession(logWindow, claims.Actor, cancel)
-	defer m.logger.Remove(session)
-
-	for {
-		select {
-		case <-ctx.Done():
-			m.log.Debug().Msgf("management logs: context cancelled")
-			c.Close(websocket.StatusNormalClosure, "context closed")
-			return
-		case event := <-events:
-			switch event.Type {
-			case StartStreaming:
-				idle.Stop()
-				// Expect the first incoming request
-				startEvent, ok := IntoClientEvent[EventStartStreaming](event, StartStreaming)
-				if !ok {
-					m.log.Warn().Msgf("expected start_streaming as first recieved event")
-					m.log.Err(c.Close(StatusInvalidCommand, reasonInvalidCommand)).Send()
-					return
-				}
-				// Make sure the session can start
-				if !m.canStartStream(session) {
-					m.log.Err(c.Close(StatusSessionLimitExceeded, reasonSessionLimitExceeded)).Send()
-					return
-				}
-				session.Filters(startEvent.Filters)
-				m.logger.Listen(session)
-				m.log.Debug().Msgf("Streaming logs")
-				go m.streamLogs(c, ctx, session)
-				continue
-			case StopStreaming:
-				idle.Reset(idleTimeout)
-				// Stop the current session for the current actor who requested it
-				session.Stop()
-				m.logger.Remove(session)
-			case UnknownClientEventType:
-				fallthrough
-			default:
-				// Drop unknown events and close connection
-				m.log.Debug().Msgf("unexpected management message received: %s", event.Type)
-				// If the client (or the server) already closed the connection, don't attempt to close it again
-				if !IsClosed(err, m.log) {
-					m.log.Err(err).Err(c.Close(websocket.StatusUnsupportedData, err.Error())).Send()
-				}
-				return
-			}
-		case <-ping.C:
-			go c.Ping(ctx)
-		case <-idle.C:
-			c.Close(StatusIdleLimitExceeded, reasonIdleLimitExceeded)
-			return
-		}
-	}
-}
@@ -1,126 +0,0 @@
-package management
-
-import (
-	"context"
-	"io"
-	"testing"
-	"time"
-
-	"github.com/rs/zerolog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"nhooyr.io/websocket"
-
-	"github.com/cloudflare/cloudflared/internal/test"
-)
-
-var (
-	noopLogger = zerolog.New(io.Discard)
-)
-
-func TestReadEventsLoop(t *testing.T) {
-	sentEvent := EventStartStreaming{
-		ClientEvent: ClientEvent{Type: StartStreaming},
-	}
-	client, server := test.WSPipe(nil, nil)
-	client.CloseRead(context.Background())
-	defer func() {
-		client.Close(websocket.StatusInternalError, "")
-	}()
-	go func() {
-		err := WriteEvent(client, context.Background(), &sentEvent)
-		require.NoError(t, err)
-	}()
-	m := ManagementService{
-		log: &noopLogger,
-	}
-	events := make(chan *ClientEvent)
-	go m.readEvents(server, context.Background(), events)
-	event := <-events
-	require.Equal(t, sentEvent.Type, event.Type)
-	server.Close(websocket.StatusInternalError, "")
-}
-
-func TestReadEventsLoop_ContextCancelled(t *testing.T) {
-	client, server := test.WSPipe(nil, nil)
-	ctx, cancel := context.WithCancel(context.Background())
-	client.CloseRead(ctx)
-	defer func() {
-		client.Close(websocket.StatusInternalError, "")
-	}()
-	m := ManagementService{
-		log: &noopLogger,
-	}
-	events := make(chan *ClientEvent)
-	go func() {
-		time.Sleep(time.Second)
-		cancel()
-	}()
-	// Want to make sure this function returns when context is cancelled
-	m.readEvents(server, ctx, events)
-	server.Close(websocket.StatusInternalError, "")
-}
-
-func TestCanStartStream_NoSessions(t *testing.T) {
-	m := ManagementService{
-		log: &noopLogger,
-		logger: &Logger{
-			Log: &noopLogger,
-		},
-	}
-	_, cancel := context.WithCancel(context.Background())
-	session := newSession(0, actor{}, cancel)
-	assert.True(t, m.canStartStream(session))
-}
-
-func TestCanStartStream_ExistingSessionDifferentActor(t *testing.T) {
-	m := ManagementService{
-		log: &noopLogger,
-		logger: &Logger{
-			Log: &noopLogger,
-		},
-	}
-	_, cancel := context.WithCancel(context.Background())
-	session1 := newSession(0, actor{ID: "test"}, cancel)
-	assert.True(t, m.canStartStream(session1))
-	m.logger.Listen(session1)
-	assert.True(t, session1.Active())
-
-	// Try another session
-	session2 := newSession(0, actor{ID: "test2"}, cancel)
-	assert.Equal(t, 1, m.logger.ActiveSessions())
-	assert.False(t, m.canStartStream(session2))
-
-	// Close session1
-	m.logger.Remove(session1)
-	assert.True(t, session1.Active()) // Remove doesn't stop a session
-	session1.Stop()
-	assert.False(t, session1.Active())
-	assert.Equal(t, 0, m.logger.ActiveSessions())
-
-	// Try session2 again
-	assert.True(t, m.canStartStream(session2))
-}
-
-func TestCanStartStream_ExistingSessionSameActor(t *testing.T) {
-	m := ManagementService{
-		log: &noopLogger,
-		logger: &Logger{
-			Log: &noopLogger,
-		},
-	}
-	actor := actor{ID: "test"}
-	_, cancel := context.WithCancel(context.Background())
-	session1 := newSession(0, actor, cancel)
-	assert.True(t, m.canStartStream(session1))
-	m.logger.Listen(session1)
-	assert.True(t, session1.Active())
-
-	// Try another session
-	session2 := newSession(0, actor, cancel)
-	assert.Equal(t, 1, m.logger.ActiveSessions())
-	assert.True(t, m.canStartStream(session2))
-	// session1 is removed and stopped
-	assert.Equal(t, 0, m.logger.ActiveSessions())
-	assert.False(t, session1.Active())
-}
@@ -1,120 +0,0 @@
-package management
-
-import (
-	"context"
-	"math/rand"
-	"sync/atomic"
-)
-
-const (
-	// Indicates how many log messages the listener will hold before dropping.
-	// Provides a throttling mechanism to drop latest messages if the sender
-	// can't keep up with the influx of log messages.
-	logWindow = 30
-)
-
-// session captures a streaming logs session for a connection of an actor.
-type session struct {
-	// Indicates if the session is streaming or not. Modifying this will affect the active session.
-	active atomic.Bool
-	// Allows the session to control the context of the underlying connection to close it out when done. Mostly
-	// used by the LoggerListener to close out and cleanup a session.
-	cancel context.CancelFunc
-	// Actor who started the session
-	actor actor
-	// Buffered channel that holds the recent log events
-	listener chan *Log
-	// Types of log events that this session will provide through the listener
-	filters *StreamingFilters
-	// Sampling of the log events this session will send (runs after all other filters if available)
-	sampler *sampler
-}
-
-// NewSession creates a new session.
-func newSession(size int, actor actor, cancel context.CancelFunc) *session {
-	s := &session{
-		active:   atomic.Bool{},
-		cancel:   cancel,
-		actor:    actor,
-		listener: make(chan *Log, size),
-		filters:  &StreamingFilters{},
-	}
-	return s
-}
-
-// Filters assigns the StreamingFilters to the session
-func (s *session) Filters(filters *StreamingFilters) {
-	if filters != nil {
-		s.filters = filters
-		sampling := filters.Sampling
-		// clamp the sampling values between 0 and 1
-		if sampling < 0 {
-			sampling = 0
-		}
-		if sampling > 1 {
-			sampling = 1
-		}
-		s.filters.Sampling = sampling
-		if sampling > 0 && sampling < 1 {
-			s.sampler = &sampler{
-				p: int(sampling * 100),
-			}
-		}
-	} else {
-		s.filters = &StreamingFilters{}
-	}
-}
-
-// Insert attempts to insert the log to the session. If the log event matches the provided session filters, it
-// will be applied to the listener.
-func (s *session) Insert(log *Log) {
-	// Level filters are optional
-	if s.filters.Level != nil {
-		if *s.filters.Level > log.Level {
-			return
-		}
-	}
-	// Event filters are optional
-	if len(s.filters.Events) != 0 && !contains(s.filters.Events, log.Event) {
-		return
-	}
-	// Sampling is also optional
-	if s.sampler != nil && !s.sampler.Sample() {
-		return
-	}
-	select {
-	case s.listener <- log:
-	default:
-		// buffer is full, discard
-	}
-}
-
-// Active returns if the session is active
-func (s *session) Active() bool {
-	return s.active.Load()
-}
-
-// Stop will halt the session
-func (s *session) Stop() {
-	s.active.Store(false)
-}
-
-func contains(array []LogEventType, t LogEventType) bool {
-	for _, v := range array {
-		if v == t {
-			return true
-		}
-	}
-	return false
-}
-
-// sampler will send approximately every p percentage log events out of 100.
-type sampler struct {
-	p int
-}
-
-// Sample returns true if the event should be part of the sample, false if the event should be dropped.
-func (s *sampler) Sample() bool {
-	return rand.Intn(100) <= s.p
-
-}
@@ -1,147 +0,0 @@
-package management
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// Validate the active states of the session
-func TestSession_ActiveControl(t *testing.T) {
-	_, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	session := newSession(4, actor{}, cancel)
-	// session starts out not active
-	assert.False(t, session.Active())
-	session.active.Store(true)
-	assert.True(t, session.Active())
-	session.Stop()
-	assert.False(t, session.Active())
-}
-
-// Validate that the session filters events
-func TestSession_Insert(t *testing.T) {
-	_, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	infoLevel := new(LogLevel)
-	*infoLevel = Info
-	warnLevel := new(LogLevel)
-	*warnLevel = Warn
-	for _, test := range []struct {
-		name      string
-		filters   StreamingFilters
-		expectLog bool
-	}{
-		{
-			name:      "none",
-			expectLog: true,
-		},
-		{
-			name: "level",
-			filters: StreamingFilters{
-				Level: infoLevel,
-			},
-			expectLog: true,
-		},
-		{
-			name: "filtered out level",
-			filters: StreamingFilters{
-				Level: warnLevel,
-			},
-			expectLog: false,
-		},
-		{
-			name: "events",
-			filters: StreamingFilters{
-				Events: []LogEventType{HTTP},
-			},
-			expectLog: true,
-		},
-		{
-			name: "filtered out event",
-			filters: StreamingFilters{
-				Events: []LogEventType{Cloudflared},
-			},
-			expectLog: false,
-		},
-		{
-			name: "sampling",
-			filters: StreamingFilters{
-				Sampling: 0.9999999,
-			},
-			expectLog: true,
-		},
-		{
-			name: "sampling (invalid negative)",
-			filters: StreamingFilters{
-				Sampling: -1.0,
-			},
-			expectLog: true,
-		},
-		{
-			name: "sampling (invalid too large)",
-			filters: StreamingFilters{
-				Sampling: 2.0,
-			},
-			expectLog: true,
-		},
-		{
-			name: "filter and event",
-			filters: StreamingFilters{
-				Level:  infoLevel,
-				Events: []LogEventType{HTTP},
-			},
-			expectLog: true,
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			session := newSession(4, actor{}, cancel)
-			session.Filters(&test.filters)
-			log := Log{
-				Time:    time.Now().UTC().Format(time.RFC3339),
-				Event:   HTTP,
-				Level:   Info,
-				Message: "test",
-			}
-			session.Insert(&log)
-			select {
-			case <-session.listener:
-				require.True(t, test.expectLog)
-			default:
-				require.False(t, test.expectLog)
-			}
-		})
-	}
-}
-
-// Validate that the session has a max amount of events to hold
-func TestSession_InsertOverflow(t *testing.T) {
-	_, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	session := newSession(1, actor{}, cancel)
-	log := Log{
-		Time:    time.Now().UTC().Format(time.RFC3339),
-		Event:   HTTP,
-		Level:   Info,
-		Message: "test",
-	}
-	// Insert 2 but only max channel size for 1
-	session.Insert(&log)
-	session.Insert(&log)
-	select {
-	case <-session.listener:
-		// pass
-	default:
-		require.Fail(t, "expected one log event")
-	}
-	// Second dequeue should fail
-	select {
-	case <-session.listener:
-		require.Fail(t, "expected no more remaining log events")
-	default:
-		// pass
-	}
-}
@@ -1,55 +0,0 @@
-package management
-
-import (
-	"fmt"
-
-	"github.com/go-jose/go-jose/v3/jwt"
-)
-
-type managementTokenClaims struct {
-	Tunnel tunnel `json:"tun"`
-	Actor  actor  `json:"actor"`
-}
-
-// VerifyTunnel compares the tun claim isn't empty
-func (c *managementTokenClaims) verify() bool {
-	return c.Tunnel.verify() && c.Actor.verify()
-}
-
-type tunnel struct {
-	ID         string `json:"id"`
-	AccountTag string `json:"account_tag"`
-}
-
-// verify compares the tun claim isn't empty
-func (t *tunnel) verify() bool {
-	return t.AccountTag != "" && t.ID != ""
-}
-
-type actor struct {
-	ID      string `json:"id"`
-	Support bool   `json:"support"`
-}
-
-// verify checks the ID claim isn't empty
-func (t *actor) verify() bool {
-	return t.ID != ""
-}
-
-func parseToken(token string) (*managementTokenClaims, error) {
-	jwt, err := jwt.ParseSigned(token)
-	if err != nil {
-		return nil, fmt.Errorf("malformed jwt: %v", err)
-	}
-
-	var claims managementTokenClaims
-	// This is actually safe because we verify the token in the edge before it reaches cloudflared
-	err = jwt.UnsafeClaimsWithoutVerification(&claims)
-	if err != nil {
-		return nil, fmt.Errorf("malformed jwt: %v", err)
-	}
-	if !claims.verify() {
-		return nil, fmt.Errorf("invalid management token format provided")
-	}
-	return &claims, nil
-}
@@ -1,130 +0,0 @@
-package management
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"gopkg.in/square/go-jose.v2"
-)
-
-const (
-	validToken = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6IjEifQ.eyJ0dW4iOnsiaWQiOiI3YjA5ODE0OS01MWZlLTRlZTUtYTY4Ny0zZTM3NDQ2NmVmYzciLCJhY2NvdW50X3RhZyI6ImNkMzkxZTljMDYyNmE4Zjc2Y2IxZjY3MGY2NTkxYjA1In0sImFjdG9yIjp7ImlkIjoiZGNhcnJAY2xvdWRmbGFyZS5jb20iLCJzdXBwb3J0IjpmYWxzZX0sInJlcyI6WyJsb2dzIl0sImV4cCI6MTY3NzExNzY5NiwiaWF0IjoxNjc3MTE0MDk2LCJpc3MiOiJ0dW5uZWxzdG9yZSJ9.mKenOdOy3Xi4O-grldFnAAemdlE9WajEpTDC_FwezXQTstWiRTLwU65P5jt4vNsIiZA4OJRq7bH-QYID9wf9NA"
-
-	accountTag = "cd391e9c0626a8f76cb1f670f6591b05"
-	tunnelID   = "7b098149-51fe-4ee5-a687-3e374466efc7"
-	actorID    = "45d2751e-6b59-45a9-814d-f630786bd0cd"
-)
-
-type invalidManagementTokenClaims struct {
-	Invalid string `json:"invalid"`
-}
-
-func TestParseToken(t *testing.T) {
-	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	require.NoError(t, err)
-
-	for _, test := range []struct {
-		name   string
-		claims any
-		err    error
-	}{
-		{
-			name: "Valid",
-			claims: managementTokenClaims{
-				Tunnel: tunnel{
-					ID:         tunnelID,
-					AccountTag: accountTag,
-				},
-				Actor: actor{
-					ID: actorID,
-				},
-			},
-		},
-		{
-			name:   "Invalid claims",
-			claims: invalidManagementTokenClaims{Invalid: "invalid"},
-			err:    errors.New("invalid management token format provided"),
-		},
-		{
-			name: "Missing Tunnel",
-			claims: managementTokenClaims{
-				Actor: actor{
-					ID: actorID,
-				},
-			},
-			err: errors.New("invalid management token format provided"),
-		},
-		{
-			name: "Missing Tunnel ID",
-			claims: managementTokenClaims{
-				Tunnel: tunnel{
-					AccountTag: accountTag,
-				},
-				Actor: actor{
-					ID: actorID,
-				},
-			},
-			err: errors.New("invalid management token format provided"),
-		},
-		{
-			name: "Missing Account Tag",
-			claims: managementTokenClaims{
-				Tunnel: tunnel{
-					ID: tunnelID,
-				},
-				Actor: actor{
-					ID: actorID,
-				},
-			},
-			err: errors.New("invalid management token format provided"),
-		},
-		{
-			name: "Missing Actor",
-			claims: managementTokenClaims{
-				Tunnel: tunnel{
-					ID:         tunnelID,
-					AccountTag: accountTag,
-				},
-			},
-			err: errors.New("invalid management token format provided"),
-		},
-		{
-			name: "Missing Actor ID",
-			claims: managementTokenClaims{
-				Tunnel: tunnel{
-					ID: tunnelID,
-				},
-				Actor: actor{},
-			},
-			err: errors.New("invalid management token format provided"),
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			jwt := signToken(t, test.claims, key)
-			claims, err := parseToken(jwt)
-			if test.err != nil {
-				require.EqualError(t, err, test.err.Error())
-				return
-			}
-			require.Nil(t, err)
-			require.Equal(t, test.claims, *claims)
-		})
-	}
-}
-
-func signToken(t *testing.T, token any, key *ecdsa.PrivateKey) string {
-	opts := (&jose.SignerOptions{}).WithType("JWT").WithHeader("kid", "1")
-	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.ES256, Key: key}, opts)
-	require.NoError(t, err)
-	payload, err := json.Marshal(token)
-	require.NoError(t, err)
-	jws, err := signer.Sign(payload)
-	require.NoError(t, err)
-	jwt, err := jws.CompactSerialize()
-	require.NoError(t, err)
-	return jwt
-}
@@ -28,9 +28,8 @@ type Orchestrator struct {
 	lock sync.RWMutex
 	// Underlying value is proxy.Proxy, can be read without the lock, but still needs the lock to update
 	proxy atomic.Value
-	// Set of local ingress rules defined at cloudflared startup (separate from user-defined ingress rules)
-	localRules         []ingress.Rule
-	warpRoutingEnabled atomic.Bool
+	// TODO: TUN-6815 Use atomic.Bool once we upgrade to go 1.19. 1 Means enabled and 0 means disabled
+	warpRoutingEnabled uint32
 	config             *Config
 	tags               []tunnelpogs.Tag
 	log                *zerolog.Logger
@@ -41,11 +40,10 @@ type Orchestrator struct {
 	proxyShutdownC chan<- struct{}
 }

-func NewOrchestrator(ctx context.Context, config *Config, tags []tunnelpogs.Tag, localRules []ingress.Rule, log *zerolog.Logger) (*Orchestrator, error) {
+func NewOrchestrator(ctx context.Context, config *Config, tags []tunnelpogs.Tag, log *zerolog.Logger) (*Orchestrator, error) {
 	o := &Orchestrator{
 		// Lowest possible version, any remote configuration will have version higher than this
 		currentVersion: 0,
-		localRules:     localRules,
 		config:         config,
 		tags:           tags,
 		log:            log,
@@ -114,9 +112,6 @@ func (o *Orchestrator) updateIngress(ingressRules ingress.Ingress, warpRouting i
 	default:
 	}

-	// Assign the local ingress rules to the parsed ingress
-	ingressRules.LocalRules = o.localRules
-
 	// Start new proxy before closing the ones from last version.
 	// The upside is we don't need to restart proxy from last version, which can fail
 	// The downside is new version might have ingress rule that require previous version to be shutdown first
@@ -125,14 +120,14 @@ func (o *Orchestrator) updateIngress(ingressRules ingress.Ingress, warpRouting i
 	if err := ingressRules.StartOrigins(o.log, proxyShutdownC); err != nil {
 		return errors.Wrap(err, "failed to start origin")
 	}
-	proxy := proxy.NewOriginProxy(ingressRules, warpRouting, o.tags, o.log)
-	o.proxy.Store(proxy)
+	newProxy := proxy.NewOriginProxy(ingressRules, warpRouting, o.tags, o.log)
+	o.proxy.Store(newProxy)
 	o.config.Ingress = &ingressRules
 	o.config.WarpRouting = warpRouting
 	if warpRouting.Enabled {
-		o.warpRoutingEnabled.Store(true)
+		atomic.StoreUint32(&o.warpRoutingEnabled, 1)
 	} else {
-		o.warpRoutingEnabled.Store(false)
+		atomic.StoreUint32(&o.warpRoutingEnabled, 0)
 	}

 	// If proxyShutdownC is nil, there is no previous running proxy
@@ -193,7 +188,7 @@ func (o *Orchestrator) GetOriginProxy() (connection.OriginProxy, error) {
 		o.log.Error().Msg(err.Error())
 		return nil, err
 	}
-	proxy, ok := val.(connection.OriginProxy)
+	proxy, ok := val.(*proxy.Proxy)
 	if !ok {
 		err := fmt.Errorf("origin proxy has unexpected value %+v", val)
 		o.log.Error().Msg(err.Error())
@@ -202,8 +197,12 @@ func (o *Orchestrator) GetOriginProxy() (connection.OriginProxy, error) {
 	return proxy, nil
 }

-func (o *Orchestrator) WarpRoutingEnabled() bool {
-	return o.warpRoutingEnabled.Load()
+// TODO: TUN-6815 consider storing WarpRouting.Enabled as atomic.Bool once we upgrade to go 1.19
+func (o *Orchestrator) WarpRoutingEnabled() (enabled bool) {
+	if atomic.LoadUint32(&o.warpRoutingEnabled) == 0 {
+		return false
+	}
+	return true
 }

 func (o *Orchestrator) waitToCloseLastProxy() {
@@ -14,7 +14,6 @@ import (
 	"time"

 	"github.com/gobwas/ws/wsutil"
-	"github.com/google/uuid"
 	gows "github.com/gorilla/websocket"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/require"
@@ -22,7 +21,7 @@ import (
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/ingress"
-	"github.com/cloudflare/cloudflared/management"
+	"github.com/cloudflare/cloudflared/proxy"
 	"github.com/cloudflare/cloudflared/tracing"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
@@ -51,11 +50,11 @@ func TestUpdateConfiguration(t *testing.T) {
 	initConfig := &Config{
 		Ingress: &ingress.Ingress{},
 	}
-	orchestrator, err := NewOrchestrator(context.Background(), initConfig, testTags, []ingress.Rule{ingress.NewManagementRule(management.New("management.argotunnel.com", "1.1.1.1:80", uuid.Nil, "", &testLogger, nil))}, &testLogger)
+	orchestrator, err := NewOrchestrator(context.Background(), initConfig, testTags, &testLogger)
 	require.NoError(t, err)
 	initOriginProxy, err := orchestrator.GetOriginProxy()
 	require.NoError(t, err)
-	require.Implements(t, (*connection.OriginProxy)(nil), initOriginProxy)
+	require.IsType(t, &proxy.Proxy{}, initOriginProxy)
 	require.False(t, orchestrator.WarpRoutingEnabled())

 	configJSONV2 := []byte(`
@@ -96,10 +95,6 @@ func TestUpdateConfiguration(t *testing.T) {

 	updateWithValidation(t, orchestrator, 2, configJSONV2)
 	configV2 := orchestrator.config
-	// Validate local ingress rules
-	require.Equal(t, "management.argotunnel.com", configV2.Ingress.LocalRules[0].Hostname)
-	require.True(t, configV2.Ingress.LocalRules[0].Matches("management.argotunnel.com", "/ping"))
-	require.Equal(t, "management", configV2.Ingress.LocalRules[0].Service.String())
 	// Validate ingress rule 0
 	require.Equal(t, "jira.tunnel.org", configV2.Ingress.Rules[0].Hostname)
 	require.True(t, configV2.Ingress.Rules[0].Matches("jira.tunnel.org", "/login"))
@@ -133,7 +128,7 @@ func TestUpdateConfiguration(t *testing.T) {

 	originProxyV2, err := orchestrator.GetOriginProxy()
 	require.NoError(t, err)
-	require.Implements(t, (*connection.OriginProxy)(nil), originProxyV2)
+	require.IsType(t, &proxy.Proxy{}, originProxyV2)
 	require.NotEqual(t, originProxyV2, initOriginProxy)

 	// Should not downgrade to an older version
@@ -177,7 +172,7 @@ func TestUpdateConfiguration(t *testing.T) {

 	originProxyV10, err := orchestrator.GetOriginProxy()
 	require.NoError(t, err)
-	require.Implements(t, (*connection.OriginProxy)(nil), originProxyV10)
+	require.IsType(t, &proxy.Proxy{}, originProxyV10)
 	require.NotEqual(t, originProxyV10, originProxyV2)
 }

@@ -262,7 +257,7 @@ func TestConcurrentUpdateAndRead(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()

-	orchestrator, err := NewOrchestrator(ctx, initConfig, testTags, []ingress.Rule{}, &testLogger)
+	orchestrator, err := NewOrchestrator(ctx, initConfig, testTags, &testLogger)
 	require.NoError(t, err)

 	updateWithValidation(t, orchestrator, 1, configJSONV1)
@@ -363,7 +358,7 @@ func proxyHTTP(originProxy connection.OriginProxy, hostname string) (*http.Respo
 		return nil, err
 	}

-	err = originProxy.ProxyHTTP(respWriter, tracing.NewTracedHTTPRequest(req, 0, &log), false)
+	err = originProxy.ProxyHTTP(respWriter, tracing.NewTracedHTTPRequest(req, &log), false)
 	if err != nil {
 		return nil, err
 	}
@@ -489,7 +484,7 @@ func TestClosePreviousProxies(t *testing.T) {
 	)

 	ctx, cancel := context.WithCancel(context.Background())
-	orchestrator, err := NewOrchestrator(ctx, initConfig, testTags, []ingress.Rule{}, &testLogger)
+	orchestrator, err := NewOrchestrator(ctx, initConfig, testTags, &testLogger)
 	require.NoError(t, err)

 	updateWithValidation(t, orchestrator, 1, configWithHelloWorld)
@@ -544,7 +539,7 @@ func TestPersistentConnection(t *testing.T) {
 	initConfig := &Config{
 		Ingress: &ingress.Ingress{},
 	}
-	orchestrator, err := NewOrchestrator(context.Background(), initConfig, testTags, []ingress.Rule{}, &testLogger)
+	orchestrator, err := NewOrchestrator(context.Background(), initConfig, testTags, &testLogger)
 	require.NoError(t, err)

 	wsOrigin := httptest.NewServer(http.HandlerFunc(wsEcho))
@@ -613,7 +608,7 @@ func TestPersistentConnection(t *testing.T) {
 		respWriter, err := connection.NewHTTP2RespWriter(req, wsRespReadWriter, connection.TypeWebsocket, &log)
 		require.NoError(t, err)

-		err = originProxy.ProxyHTTP(respWriter, tracing.NewTracedHTTPRequest(req, 0, &log), true)
+		err = originProxy.ProxyHTTP(respWriter, tracing.NewTracedHTTPRequest(req, &log), true)
 		require.NoError(t, err)
 	}()

@@ -16,7 +16,6 @@ import (
 	"github.com/cloudflare/cloudflared/cfio"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/ingress"
-	"github.com/cloudflare/cloudflared/management"
 	"github.com/cloudflare/cloudflared/stream"
 	"github.com/cloudflare/cloudflared/tracing"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
@@ -26,12 +25,9 @@ const (
 	// TagHeaderNamePrefix indicates a Cloudflared Warp Tag prefix that gets appended for warp traffic stream headers.
 	TagHeaderNamePrefix   = "Cf-Warp-Tag-"
 	LogFieldCFRay         = "cfRay"
-	LogFieldLBProbe       = "lbProbe"
 	LogFieldRule          = "ingressRule"
 	LogFieldOriginService = "originService"
 	LogFieldFlowID        = "flowID"
-	LogFieldConnIndex     = "connIndex"
-	LogFieldDestAddr      = "destAddr"

 	trailerHeaderName = "Trailer"
 )
@@ -40,7 +36,6 @@ const (
 type Proxy struct {
 	ingressRules ingress.Ingress
 	warpRouting  *ingress.WarpRoutingService
-	management   *ingress.ManagementService
 	tags         []tunnelpogs.Tag
 	log          *zerolog.Logger
 }
@@ -99,10 +94,9 @@ func (p *Proxy) ProxyHTTP(
 		trace.WithAttributes(attribute.String("req-host", req.Host)))
 	rule, ruleNum := p.ingressRules.FindMatchingRule(req.Host, req.URL.Path)
 	logFields := logFields{
-		cfRay:     cfRay,
-		lbProbe:   lbProbe,
-		rule:      ruleNum,
-		connIndex: tr.ConnIndex,
+		cfRay:   cfRay,
+		lbProbe: lbProbe,
+		rule:    ruleNum,
 	}
 	p.logRequest(req, logFields)
 	ruleSpan.SetAttributes(attribute.Int("rule-num", ruleNum))
@@ -144,9 +138,6 @@ func (p *Proxy) ProxyHTTP(
 			return err
 		}
 		return nil
-	case ingress.HTTPLocalProxy:
-		p.proxyLocalRequest(originProxy, w, req, isWebsocket)
-		return nil
 	default:
 		return fmt.Errorf("Unrecognized service: %s, %t", rule.Service, originProxy)
 	}
@@ -172,24 +163,14 @@ func (p *Proxy) ProxyTCP(

 	tracedCtx := tracing.NewTracedContext(serveCtx, req.CfTraceID, p.log)

-	p.log.Debug().
-		Int(management.EventTypeKey, int(management.TCP)).
-		Str(LogFieldFlowID, req.FlowID).
-		Str(LogFieldDestAddr, req.Dest).
-		Uint8(LogFieldConnIndex, req.ConnIndex).
-		Msg("tcp proxy stream started")
+	p.log.Debug().Str(LogFieldFlowID, req.FlowID).Msg("tcp proxy stream started")

 	if err := p.proxyStream(tracedCtx, rwa, req.Dest, p.warpRouting.Proxy); err != nil {
 		p.logRequestError(err, req.CFRay, req.FlowID, "", ingress.ServiceWarpRouting)
 		return err
 	}

-	p.log.Debug().
-		Int(management.EventTypeKey, int(management.TCP)).
-		Str(LogFieldFlowID, req.FlowID).
-		Str(LogFieldDestAddr, req.Dest).
-		Uint8(LogFieldConnIndex, req.ConnIndex).
-		Msg("tcp proxy stream finished successfully")
+	p.log.Debug().Str(LogFieldFlowID, req.FlowID).Msg("tcp proxy stream finished successfully")

 	return nil
 }
@@ -319,17 +300,6 @@ func (p *Proxy) proxyStream(
 	return nil
 }

-func (p *Proxy) proxyLocalRequest(proxy ingress.HTTPLocalProxy, w connection.ResponseWriter, req *http.Request, isWebsocket bool) {
-	if isWebsocket {
-		// These headers are added since they are stripped off during an eyeball request to origintunneld, but they
-		// are required during the Handshake process of a WebSocket request.
-		req.Header.Set("Connection", "Upgrade")
-		req.Header.Set("Upgrade", "websocket")
-		req.Header.Set("Sec-Websocket-Version", "13")
-	}
-	proxy.ServeHTTP(w, req)
-}
-
 type bidirectionalStream struct {
 	reader io.Reader
 	writer io.Writer
@@ -350,11 +320,10 @@ func (p *Proxy) appendTagHeaders(r *http.Request) {
 }

 type logFields struct {
-	cfRay     string
-	lbProbe   bool
-	rule      int
-	flowID    string
-	connIndex uint8
+	cfRay   string
+	lbProbe bool
+	rule    interface{}
+	flowID  string
 }

 func copyTrailers(w connection.ResponseWriter, response *http.Response) {
@@ -366,41 +335,44 @@ func copyTrailers(w connection.ResponseWriter, response *http.Response) {
 }

 func (p *Proxy) logRequest(r *http.Request, fields logFields) {
-	log := p.log.With().Int(management.EventTypeKey, int(management.HTTP)).Logger()
-	event := log.Debug()
 	if fields.cfRay != "" {
-		event = event.Str(LogFieldCFRay, fields.cfRay)
+		p.log.Debug().Msgf("CF-RAY: %s %s %s %s", fields.cfRay, r.Method, r.URL, r.Proto)
+	} else if fields.lbProbe {
+		p.log.Debug().Msgf("CF-RAY: %s Load Balancer health check %s %s %s", fields.cfRay, r.Method, r.URL, r.Proto)
+	} else {
+		p.log.Debug().Msgf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", r.Method, r.URL, r.Proto)
 	}
-	if fields.lbProbe {
-		event = event.Bool(LogFieldLBProbe, fields.lbProbe)
-	}
-	if fields.cfRay == "" && !fields.lbProbe {
-		log.Debug().Msgf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", r.Method, r.URL, r.Proto)
-	}
-	event.
-		Uint8(LogFieldConnIndex, fields.connIndex).
+	p.log.Debug().
+		Str("CF-RAY", fields.cfRay).
+		Str("Header", fmt.Sprintf("%+v", r.Header)).
 		Str("host", r.Host).
 		Str("path", r.URL.Path).
-		Interface(LogFieldRule, fields.rule).
-		Interface("headers", r.Header).
-		Int64("content-length", r.ContentLength).
-		Msgf("%s %s %s", r.Method, r.URL, r.Proto)
+		Interface("rule", fields.rule).
+		Msg("Inbound request")
+
+	if contentLen := r.ContentLength; contentLen == -1 {
+		p.log.Debug().Msgf("CF-RAY: %s Request Content length unknown", fields.cfRay)
+	} else {
+		p.log.Debug().Msgf("CF-RAY: %s Request content length %d", fields.cfRay, contentLen)
+	}
 }

 func (p *Proxy) logOriginResponse(resp *http.Response, fields logFields) {
 	responseByCode.WithLabelValues(strconv.Itoa(resp.StatusCode)).Inc()
-	event := p.log.Debug()
 	if fields.cfRay != "" {
-		event = event.Str(LogFieldCFRay, fields.cfRay)
+		p.log.Debug().Msgf("CF-RAY: %s Status: %s served by ingress %d", fields.cfRay, resp.Status, fields.rule)
+	} else if fields.lbProbe {
+		p.log.Debug().Msgf("Response to Load Balancer health check %s", resp.Status)
+	} else {
+		p.log.Debug().Msgf("Status: %s served by ingress %v", resp.Status, fields.rule)
 	}
-	if fields.lbProbe {
-		event = event.Bool(LogFieldLBProbe, fields.lbProbe)
+	p.log.Debug().Msgf("CF-RAY: %s Response Headers %+v", fields.cfRay, resp.Header)
+
+	if contentLen := resp.ContentLength; contentLen == -1 {
+		p.log.Debug().Msgf("CF-RAY: %s Response content length unknown", fields.cfRay)
+	} else {
+		p.log.Debug().Msgf("CF-RAY: %s Response content length %d", fields.cfRay, contentLen)
 	}
-	event.
-		Int(management.EventTypeKey, int(management.HTTP)).
-		Uint8(LogFieldConnIndex, fields.connIndex).
-		Int64("content-length", resp.ContentLength).
-		Msgf("%s", resp.Status)
 }

 func (p *Proxy) logRequestError(err error, cfRay string, flowID string, rule, service string) {
@@ -410,9 +382,7 @@ func (p *Proxy) logRequestError(err error, cfRay string, flowID string, rule, se
 		log = log.Str(LogFieldCFRay, cfRay)
 	}
 	if flowID != "" {
-		log = log.Str(LogFieldFlowID, flowID).Int(management.EventTypeKey, int(management.TCP))
-	} else {
-		log = log.Int(management.EventTypeKey, int(management.HTTP))
+		log = log.Str(LogFieldFlowID, flowID)
 	}
 	if rule != "" {
 		log = log.Str(LogFieldRule, rule)
@@ -420,7 +390,7 @@ func (p *Proxy) logRequestError(err error, cfRay string, flowID string, rule, se
 	if service != "" {
 		log = log.Str(LogFieldOriginService, service)
 	}
-	log.Send()
+	log.Msg("")
 }

 func getDestFromRule(rule *ingress.Rule, req *http.Request) (string, error) {
@@ -1,7 +1,6 @@
 package proxy

 import (
-	"bufio"
 	"bytes"
 	"context"
 	"flag"
@@ -24,6 +23,7 @@ import (
 	"golang.org/x/sync/errgroup"

 	"github.com/cloudflare/cloudflared/cfio"
+
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/hello"
@@ -34,7 +34,7 @@ import (
 )

 var (
-	testTags        = []tunnelpogs.Tag{{Name: "Name", Value: "value"}}
+	testTags        = []tunnelpogs.Tag{tunnelpogs.Tag{Name: "Name", Value: "value"}}
 	noWarpRouting   = ingress.WarpRoutingConfig{}
 	testWarpRouting = ingress.WarpRoutingConfig{
 		Enabled:        true,
@@ -77,10 +77,6 @@ func (w *mockHTTPRespWriter) headers() http.Header {
 	return w.Header()
 }

-func (m *mockHTTPRespWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	panic("Hijack not implemented")
-}
-
 type mockWSRespWriter struct {
 	*mockHTTPRespWriter
 	writeNotification chan []byte
@@ -114,10 +110,6 @@ func (w *mockWSRespWriter) Read(data []byte) (int, error) {
 	return w.reader.Read(data)
 }

-func (m *mockWSRespWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	panic("Hijack not implemented")
-}
-
 type mockSSERespWriter struct {
 	*mockHTTPRespWriter
 	writeNotification chan []byte
@@ -158,7 +150,8 @@ func TestProxySingleOrigin(t *testing.T) {
 	err := cliCtx.Set("hello-world", "true")
 	require.NoError(t, err)

-	ingressRule, err := ingress.ParseIngressFromConfigAndCLI(&config.Configuration{}, cliCtx, &log)
+	allowURLFromArgs := false
+	ingressRule, err := ingress.NewSingleOrigin(cliCtx, allowURLFromArgs)
 	require.NoError(t, err)

 	require.NoError(t, ingressRule.StartOrigins(&log, ctx.Done()))
@@ -177,7 +170,7 @@ func testProxyHTTP(proxy connection.OriginProxy) func(t *testing.T) {
 		require.NoError(t, err)

 		log := zerolog.Nop()
-		err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, 0, &log), false)
+		err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, &log), false)
 		require.NoError(t, err)
 		for _, tag := range testTags {
 			assert.Equal(t, tag.Value, req.Header.Get(TagHeaderNamePrefix+tag.Name))
@@ -205,7 +198,7 @@ func testProxyWebsocket(proxy connection.OriginProxy) func(t *testing.T) {
 		errGroup, ctx := errgroup.WithContext(ctx)
 		errGroup.Go(func() error {
 			log := zerolog.Nop()
-			err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, 0, &log), true)
+			err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, &log), true)
 			require.NoError(t, err)

 			require.Equal(t, http.StatusSwitchingProtocols, responseWriter.Code)
@@ -267,7 +260,7 @@ func testProxySSE(proxy connection.OriginProxy) func(t *testing.T) {
 		go func() {
 			defer wg.Done()
 			log := zerolog.Nop()
-			err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, 0, &log), false)
+			err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, &log), false)
 			require.Equal(t, err.Error(), "context canceled")

 			require.Equal(t, http.StatusOK, responseWriter.Code)
@@ -374,7 +367,7 @@ func runIngressTestScenarios(t *testing.T, unvalidatedIngress []config.Unvalidat
 		req, err := http.NewRequest(http.MethodGet, test.url, nil)
 		require.NoError(t, err)

-		err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, 0, &log), false)
+		err = proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, &log), false)
 		require.NoError(t, err)

 		assert.Equal(t, test.expectedStatus, responseWriter.Code)
@@ -421,7 +414,7 @@ func TestProxyError(t *testing.T) {
 	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1", nil)
 	assert.NoError(t, err)

-	assert.Error(t, proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, 0, &log), false))
+	assert.Error(t, proxy.ProxyHTTP(responseWriter, tracing.NewTracedHTTPRequest(req, &log), false))
 }

 type replayer struct {
@@ -702,13 +695,14 @@ func TestConnections(t *testing.T) {
 				err = proxy.ProxyTCP(ctx, rwa, &connection.TCPRequest{Dest: dest})
 			} else {
 				log := zerolog.Nop()
-				err = proxy.ProxyHTTP(respWriter, tracing.NewTracedHTTPRequest(req, 0, &log), test.args.connectionType == connection.TypeWebsocket)
+				err = proxy.ProxyHTTP(respWriter, tracing.NewTracedHTTPRequest(req, &log), test.args.connectionType == connection.TypeWebsocket)
 			}

 			cancel()
 			assert.Equal(t, test.want.err, err != nil)
 			assert.Equal(t, test.want.message, replayer.Bytes())
-			assert.Equal(t, test.want.headers, respWriter.Header())
+			respPrinter := respWriter.(responsePrinter)
+			assert.Equal(t, test.want.headers, respPrinter.headers())
 			replayer.rw.Reset()
 		})
 	}
@@ -801,6 +795,10 @@ func (p *pipedRequestBody) Close() error {
 	return nil
 }

+type responsePrinter interface {
+	headers() http.Header
+}
+
 type wsRespWriter struct {
 	w               io.Writer
 	responseHeaders http.Header
@@ -839,20 +837,12 @@ func (w *wsRespWriter) AddTrailer(trailerName, trailerValue string) {
 }

 // respHeaders is a test function to read respHeaders
-func (w *wsRespWriter) Header() http.Header {
+func (w *wsRespWriter) headers() http.Header {
 	// Removing indeterminstic header because it cannot be asserted.
 	w.responseHeaders.Del("Date")
 	return w.responseHeaders
 }

-func (w *wsRespWriter) WriteHeader(status int) {
-	// unused
-}
-
-func (m *wsRespWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	panic("Hijack not implemented")
-}
-
 type mockTCPRespWriter struct {
 	w               io.Writer
 	responseHeaders http.Header
@@ -873,7 +863,7 @@ func (m *mockTCPRespWriter) Write(p []byte) (n int, err error) {
 	return m.w.Write(p)
 }

-func (m *mockTCPRespWriter) AddTrailer(trailerName, trailerValue string) {
+func (w *mockTCPRespWriter) AddTrailer(trailerName, trailerValue string) {
 	// do nothing
 }

@@ -884,18 +874,10 @@ func (m *mockTCPRespWriter) WriteRespHeaders(status int, header http.Header) err
 }

 // respHeaders is a test function to read respHeaders
-func (m *mockTCPRespWriter) Header() http.Header {
+func (m *mockTCPRespWriter) headers() http.Header {
 	return m.responseHeaders
 }

-func (m *mockTCPRespWriter) WriteHeader(status int) {
-	// do nothing
-}
-
-func (m *mockTCPRespWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	panic("Hijack not implemented")
-}
-
 func createSingleIngressConfig(t *testing.T, service string) ingress.Ingress {
 	ingressConfig := &config.Configuration{
 		Ingress: []config.UnvalidatedIngressRule{
@@ -3,10 +3,12 @@ package supervisor
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net"
 	"strings"
 	"time"

+	"github.com/google/uuid"
 	"github.com/lucas-clemente/quic-go"
 	"github.com/rs/zerolog"

@@ -19,6 +21,8 @@ import (
 )

 const (
+	// SRV and TXT record resolution TTL
+	ResolveTTL = time.Hour
 	// Waiting time before retrying a failed tunnel connection
 	tunnelRetryDuration = time.Second * 10
 	// Interval between registering new tunnels
@@ -34,6 +38,7 @@ const (
 // Supervisor manages non-declarative tunnels. Establishes TCP connections with the edge, and
 // reconnects them if they disconnect.
 type Supervisor struct {
+	cloudflaredUUID         uuid.UUID
 	config                  *TunnelConfig
 	orchestrator            *orchestration.Orchestrator
 	edgeIPs                 *edgediscovery.Edge
@@ -63,9 +68,13 @@ type tunnelError struct {
 }

 func NewSupervisor(config *TunnelConfig, orchestrator *orchestration.Orchestrator, reconnectCh chan ReconnectSignal, gracefulShutdownC <-chan struct{}) (*Supervisor, error) {
+	cloudflaredUUID, err := uuid.NewRandom()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate cloudflared instance ID: %w", err)
+	}
+
 	isStaticEdge := len(config.EdgeAddrs) > 0

-	var err error
 	var edgeIPs *edgediscovery.Edge
 	if isStaticEdge { // static edge addresses
 		edgeIPs, err = edgediscovery.StaticEdge(config.Log, config.EdgeAddrs)
@@ -82,15 +91,14 @@ func NewSupervisor(config *TunnelConfig, orchestrator *orchestration.Orchestrato
 	log := NewConnAwareLogger(config.Log, tracker, config.Observer)

 	edgeAddrHandler := NewIPAddrFallback(config.MaxEdgeAddrRetries)
-	edgeBindAddr := config.EdgeBindAddr

 	edgeTunnelServer := EdgeTunnelServer{
 		config:            config,
+		cloudflaredUUID:   cloudflaredUUID,
 		orchestrator:      orchestrator,
 		credentialManager: reconnectCredentialManager,
 		edgeAddrs:         edgeIPs,
 		edgeAddrHandler:   edgeAddrHandler,
-		edgeBindAddr:      edgeBindAddr,
 		tracker:           tracker,
 		reconnectCh:       reconnectCh,
 		gracefulShutdownC: gracefulShutdownC,
@@ -98,6 +106,7 @@ func NewSupervisor(config *TunnelConfig, orchestrator *orchestration.Orchestrato
 	}

 	return &Supervisor{
+		cloudflaredUUID:            cloudflaredUUID,
 		config:                     config,
 		orchestrator:               orchestrator,
 		edgeIPs:                    edgeIPs,
@@ -0,0 +1,74 @@
+package supervisor
+
+import (
+	"context"
+	"testing"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/cloudflare/cloudflared/connection"
+	"github.com/cloudflare/cloudflared/edgediscovery"
+	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
+	"github.com/cloudflare/cloudflared/signal"
+)
+
+type mockProtocolSelector struct {
+	protocols []connection.Protocol
+	index     int
+}
+
+func (m *mockProtocolSelector) Current() connection.Protocol {
+	return m.protocols[m.index]
+}
+
+func (m *mockProtocolSelector) Fallback() (connection.Protocol, bool) {
+	m.index++
+	if m.index == len(m.protocols) {
+		return m.protocols[len(m.protocols)-1], false
+	}
+
+	return m.protocols[m.index], true
+}
+
+type mockEdgeTunnelServer struct {
+	config *TunnelConfig
+}
+
+func (m *mockEdgeTunnelServer) Serve(ctx context.Context, connIndex uint8, protocolFallback *protocolFallback, connectedSignal *signal.Signal) error {
+	// This is to mock the first connection falling back because of connectivity issues.
+	protocolFallback.protocol, _ = m.config.ProtocolSelector.Fallback()
+	connectedSignal.Notify()
+	return nil
+}
+
+// Test to check if initialize sets all the different connections to the same protocol should the first
+// tunnel fall back.
+func Test_Initialize_Same_Protocol(t *testing.T) {
+	edgeIPs, err := edgediscovery.ResolveEdge(&zerolog.Logger{}, "us", allregions.Auto)
+	assert.Nil(t, err)
+	s := Supervisor{
+		edgeIPs: edgeIPs,
+		config: &TunnelConfig{
+			ProtocolSelector: &mockProtocolSelector{protocols: []connection.Protocol{connection.QUIC, connection.HTTP2, connection.H2mux}},
+		},
+		tunnelsProtocolFallback: make(map[int]*protocolFallback),
+		edgeTunnelServer: &mockEdgeTunnelServer{
+			config: &TunnelConfig{
+				ProtocolSelector: &mockProtocolSelector{protocols: []connection.Protocol{connection.QUIC, connection.HTTP2, connection.H2mux}},
+			},
+		},
+	}
+
+	ctx := context.Background()
+	connectedSignal := signal.New(make(chan struct{}))
+	s.initialize(ctx, connectedSignal)
+
+	// Make sure we fell back to http2 as the mock Serve is wont to do.
+	assert.Equal(t, s.tunnelsProtocolFallback[0].protocol, connection.HTTP2)
+
+	// Ensure all the protocols we set to try are the same as what the first tunnel has fallen back to.
+	for _, protocolFallback := range s.tunnelsProtocolFallback {
+		assert.Equal(t, protocolFallback.protocol, s.tunnelsProtocolFallback[0].protocol)
+	}
+}
@@ -19,10 +19,8 @@ import (
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/edgediscovery"
 	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
-	"github.com/cloudflare/cloudflared/features"
 	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/ingress"
-	"github.com/cloudflare/cloudflared/management"
 	"github.com/cloudflare/cloudflared/orchestration"
 	quicpogs "github.com/cloudflare/cloudflared/quic"
 	"github.com/cloudflare/cloudflared/retry"
@@ -33,7 +31,13 @@ import (
 )

 const (
-	dialTimeout = 15 * time.Second
+	dialTimeout              = 15 * time.Second
+	FeatureSerializedHeaders = "serialized_headers"
+	FeatureQuickReconnects   = "quick_reconnects"
+	FeatureAllowRemoteConfig = "allow_remote_config"
+	FeatureDatagramV2        = "support_datagram_v2"
+	FeaturePostQuantum       = "postquantum"
+	FeatureQUICSupportEOF    = "support_quic_eof"
 )

 type TunnelConfig struct {
@@ -45,7 +49,6 @@ type TunnelConfig struct {
 	EdgeAddrs          []string
 	Region             string
 	EdgeIPVersion      allregions.ConfigIPVersion
-	EdgeBindAddr       net.IP
 	HAConnections      int
 	IncidentLookup     IncidentLookup
 	IsAutoupdated      bool
@@ -65,6 +68,7 @@ type TunnelConfig struct {
 	PQKexIdx int

 	NamedTunnel      *connection.NamedTunnelProperties
+	MuxerConfig      *connection.MuxerConfig
 	ProtocolSelector connection.ProtocolSelector
 	EdgeTLSConfigs   map[connection.Protocol]*tls.Config
 	PacketConfig     *ingress.GlobalRouterConfig
@@ -86,7 +90,7 @@ func (c *TunnelConfig) registrationOptions(connectionID uint8, OriginLocalIP str
 		OriginLocalIP:        OriginLocalIP,
 		IsAutoupdated:        c.IsAutoupdated,
 		RunFromTerminal:      c.RunFromTerminal,
-		CompressionQuality:   0,
+		CompressionQuality:   uint64(c.MuxerConfig.CompressionSetting),
 		UUID:                 uuid.String(),
 		Features:             c.SupportedFeatures(),
 	}
@@ -101,17 +105,17 @@ func (c *TunnelConfig) connectionOptions(originLocalAddr string, numPreviousAtte
 		Client:              c.NamedTunnel.Client,
 		OriginLocalIP:       originIP,
 		ReplaceExisting:     c.ReplaceExisting,
-		CompressionQuality:  0,
+		CompressionQuality:  uint8(c.MuxerConfig.CompressionSetting),
 		NumPreviousAttempts: numPreviousAttempts,
 	}
 }

 func (c *TunnelConfig) SupportedFeatures() []string {
-	supported := []string{features.FeatureSerializedHeaders}
+	features := []string{FeatureSerializedHeaders}
 	if c.NamedTunnel == nil {
-		supported = append(supported, features.FeatureQuickReconnects)
+		features = append(features, FeatureQuickReconnects)
 	}
-	return supported
+	return features
 }

 func StartTunnelDaemon(
@@ -199,11 +203,11 @@ func (f *ipAddrFallback) ShouldGetNewAddress(connIndex uint8, err error) (needsN

 type EdgeTunnelServer struct {
 	config            *TunnelConfig
+	cloudflaredUUID   uuid.UUID
 	orchestrator      *orchestration.Orchestrator
 	credentialManager *reconnectCredentialManager
 	edgeAddrHandler   EdgeAddrHandler
 	edgeAddrs         *edgediscovery.Edge
-	edgeBindAddr      net.IP
 	reconnectCh       chan ReconnectSignal
 	gracefulShutdownC <-chan struct{}
 	tracker           *tunnelstate.ConnTracker
@@ -239,7 +243,6 @@ func (e *EdgeTunnelServer) Serve(ctx context.Context, connIndex uint8, protocolF
 	}

 	logger := e.config.Log.With().
-		Int(management.EventTypeKey, int(management.Cloudflared)).
 		IPAddr(connection.LogFieldIPAddress, addr.UDP.IP).
 		Uint8(connection.LogFieldConnIndex, connIndex).
 		Logger()
@@ -485,7 +488,7 @@ func (e *EdgeTunnelServer) serveConnection(
 	)

 	switch protocol {
-	case connection.QUIC:
+	case connection.QUIC, connection.QUICWarp:
 		connOptions := e.config.connectionOptions(addr.UDP.String(), uint8(backoff.Retries()))
 		return e.serveQUIC(ctx,
 			addr.UDP,
@@ -494,8 +497,8 @@ func (e *EdgeTunnelServer) serveConnection(
 			controlStream,
 			connIndex)

-	case connection.HTTP2:
-		edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, e.config.EdgeTLSConfigs[protocol], addr.TCP, e.edgeBindAddr)
+	case connection.HTTP2, connection.HTTP2Warp:
+		edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, e.config.EdgeTLSConfigs[protocol], addr.TCP)
 		if err != nil {
 			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection with Cloudflare edge")
 			return err, true
@@ -514,7 +517,21 @@ func (e *EdgeTunnelServer) serveConnection(
 		}

 	default:
-		return fmt.Errorf("invalid protocol selected: %s", protocol), false
+		edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, e.config.EdgeTLSConfigs[protocol], addr.TCP)
+		if err != nil {
+			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection with Cloudflare edge")
+			return err, true
+		}
+
+		if err := e.serveH2mux(
+			ctx,
+			connLog,
+			edgeConn,
+			connIndex,
+			connectedFuse,
+		); err != nil {
+			return err, false
+		}
 	}
 	return
 }
@@ -527,6 +544,55 @@ func (r unrecoverableError) Error() string {
 	return r.err.Error()
 }

+func (e *EdgeTunnelServer) serveH2mux(
+	ctx context.Context,
+	connLog *ConnAwareLogger,
+	edgeConn net.Conn,
+	connIndex uint8,
+	connectedFuse *connectedFuse,
+) error {
+	if e.config.NeedPQ {
+		return unrecoverableError{errors.New("H2Mux transport does not support post-quantum")}
+	}
+	connLog.Logger().Debug().Msgf("Connecting via h2mux")
+	// Returns error from parsing the origin URL or handshake errors
+	handler, err, recoverable := connection.NewH2muxConnection(
+		e.orchestrator,
+		e.config.GracePeriod,
+		e.config.MuxerConfig,
+		edgeConn,
+		connIndex,
+		e.config.Observer,
+		e.gracefulShutdownC,
+		e.config.Log,
+	)
+	if err != nil {
+		if !recoverable {
+			return unrecoverableError{err}
+		}
+		return err
+	}
+
+	errGroup, serveCtx := errgroup.WithContext(ctx)
+
+	errGroup.Go(func() error {
+		connOptions := e.config.connectionOptions(edgeConn.LocalAddr().String(), uint8(connectedFuse.backoff.Retries()))
+		return handler.ServeNamedTunnel(serveCtx, e.config.NamedTunnel, connOptions, connectedFuse)
+	})
+
+	errGroup.Go(func() error {
+		err := listenReconnect(serveCtx, e.reconnectCh, e.gracefulShutdownC)
+		if err != nil {
+			// forcefully break the connection (this is only used for testing)
+			// errgroup will return context canceled for the handler.ServeClassicTunnel
+			connLog.Logger().Debug().Msg("Forcefully breaking h2mux connection")
+		}
+		return err
+	})
+
+	return errGroup.Wait()
+}
+
 func (e *EdgeTunnelServer) serveHTTP2(
 	ctx context.Context,
 	connLog *ConnAwareLogger,
@@ -607,7 +673,6 @@ func (e *EdgeTunnelServer) serveQUIC(
 	quicConn, err := connection.NewQUICConnection(
 		quicConfig,
 		edgeAddr,
-		e.edgeBindAddr,
 		connIndex,
 		tlsConfig,
 		e.orchestrator,
@@ -18,7 +18,7 @@ type dynamicMockFetcher struct {
 	err              error
 }

-func (dmf *dynamicMockFetcher) fetch() edgediscovery.PercentageFetcher {
+func (dmf *dynamicMockFetcher) fetch() connection.PercentageFetcher {
 	return func() (edgediscovery.ProtocolPercents, error) {
 		return dmf.protocolPercents, dmf.err
 	}
@@ -32,22 +32,24 @@ func TestWaitForBackoffFallback(t *testing.T) {
 	}
 	log := zerolog.Nop()
 	resolveTTL := time.Duration(0)
+	namedTunnel := &connection.NamedTunnelProperties{}
 	mockFetcher := dynamicMockFetcher{
-		protocolPercents: edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "quic", Percentage: 100}},
+		protocolPercents: edgediscovery.ProtocolPercents{edgediscovery.ProtocolPercent{Protocol: "http2", Percentage: 100}},
 	}
+	warpRoutingEnabled := false
 	protocolSelector, err := connection.NewProtocolSelector(
 		"auto",
-		"",
-		false,
-		false,
+		warpRoutingEnabled,
+		namedTunnel,
 		mockFetcher.fetch(),
 		resolveTTL,
 		&log,
+		false,
 	)
 	assert.NoError(t, err)

 	initProtocol := protocolSelector.Current()
-	assert.Equal(t, connection.QUIC, initProtocol)
+	assert.Equal(t, connection.HTTP2, initProtocol)

 	protoFallback := &protocolFallback{
 		backoff,
@@ -98,12 +100,12 @@ func TestWaitForBackoffFallback(t *testing.T) {
 	// The reason why there's no fallback available is because we pick a specific protocol instead of letting it be auto.
 	protocolSelector, err = connection.NewProtocolSelector(
 		"quic",
-		"",
-		false,
-		false,
+		warpRoutingEnabled,
+		namedTunnel,
 		mockFetcher.fetch(),
 		resolveTTL,
 		&log,
+		false,
 	)
 	assert.NoError(t, err)
 	protoFallback = &protocolFallback{backoff, protocolSelector.Current(), false}
--- a/Show More
+++ b/Show More