3666 changed files with 258223 additions and 452462 deletions
--- a/.ci/apt-internal.gitlab-ci.yml
+++ b/.ci/apt-internal.gitlab-ci.yml
@ -1,151 +0,0 @@
 .register_inputs: &register_inputs
  stage: release-internal
  runOnBranches: "^master$"
  COMPONENT: "common"
 .register_inputs_stable_bookworm: &register_inputs_stable_bookworm
  <<: *register_inputs
  runOnChangesTo: ['RELEASE_NOTES']
  FLAVOR: "bookworm"
  SERIES: "stable"
 .register_inputs_stable_trixie: &register_inputs_stable_trixie
  <<: *register_inputs
  runOnChangesTo: ['RELEASE_NOTES']
  FLAVOR: "trixie"
  SERIES: "stable"
 .register_inputs_next_bookworm: &register_inputs_next_bookworm
  <<: *register_inputs
  FLAVOR: "bookworm"
  SERIES: next
 .register_inputs_next_trixie: &register_inputs_next_trixie
  <<: *register_inputs
  FLAVOR: "trixie"
  SERIES: next
 ################################################
 ### Generate Debian Package for Internal APT ###
 ################################################
 .cloudflared-apt-build: &cloudflared_apt_build
  stage: package
  needs:
    - ci-image-get-image-ref
    - linux-packaging # For consistency, we only run this job after we knew we could build the packages for external delivery
  image: $BUILD_IMAGE
  cache: {}
  script:
    - make cloudflared-deb
  artifacts:
    paths:
      - cloudflared*.deb
 ##############
 ### Stable ###
 ##############
 cloudflared-amd64-stable:
  <<: *cloudflared_apt_build
  rules:
    - !reference [.default-rules, run-on-release]
  variables: &amd64-stable-vars
    GOOS: linux
    GOARCH: amd64
    FIPS: true
    ORIGINAL_NAME: true
    CGO_ENABLED: 1
 cloudflared-arm64-stable:
  <<: *cloudflared_apt_build
  rules:
    - !reference [.default-rules, run-on-release]
  variables: &arm64-stable-vars
    GOOS: linux
    GOARCH: arm64
    FIPS: false # TUN-7595
    ORIGINAL_NAME: true
    CGO_ENABLED: 1
 ############
 ### Next ###
 ############
 cloudflared-amd64-next:
  <<: *cloudflared_apt_build
  rules:
    - !reference [.default-rules, run-on-master]
  variables:
    <<: *amd64-stable-vars
    NIGHTLY: true
 cloudflared-arm64-next:
  <<: *cloudflared_apt_build
  rules:
    - !reference [.default-rules, run-on-master]
  variables:
    <<: *arm64-stable-vars
    NIGHTLY: true
 include:
  - local: .ci/commons.gitlab-ci.yml
  ##########################################
  ### Publish Packages to Internal Repos ###
  ##########################################
  # Bookworm AMD64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_stable_bookworm
      jobPrefix: cloudflared-bookworm-amd64
      needs: &amd64-stable ["cloudflared-amd64-stable"]
  # Bookworm ARM64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_stable_bookworm
      jobPrefix: cloudflared-bookworm-arm64
      needs: &arm64-stable ["cloudflared-arm64-stable"]
  # Trixie AMD64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_stable_trixie
      jobPrefix: cloudflared-trixie-amd64
      needs: *amd64-stable
  # Trixie ARM64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_stable_trixie
      jobPrefix: cloudflared-trixie-arm64
      needs: *arm64-stable
  ##################################################
  ### Publish Nightly Packages to Internal Repos ###
  ##################################################
  # Bookworm AMD64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_next_bookworm
      jobPrefix: cloudflared-nightly-bookworm-amd64
      needs: &amd64-next ['cloudflared-amd64-next']
  # Bookworm ARM64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_next_bookworm
      jobPrefix: cloudflared-nightly-bookworm-arm64
      needs: &arm64-next ['cloudflared-arm64-next']
  # Trixie AMD64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_next_trixie
      jobPrefix: cloudflared-nightly-trixie-amd64
      needs: *amd64-next
  # Trixie ARM64
  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
    inputs:
      <<: *register_inputs_next_trixie
      jobPrefix: cloudflared-nightly-trixie-arm64
      needs: *arm64-next
--- a/.ci/ci-image.gitlab-ci.yml
+++ b/.ci/ci-image.gitlab-ci.yml
@ -1,31 +0,0 @@
 # Builds a custom CI Image when necessary
 include:
  #####################################################
  ############## Build and Push CI Image ##############
  #####################################################
  - component: $CI_SERVER_FQDN/cloudflare/ci/docker-image/build-push-image@~latest
    inputs:
      stage: pre-build
      jobPrefix: ci-image
      runOnChangesTo: [".ci/image/**"]
      runOnMR: true
      runOnBranches: '^master$'
      commentImageRefs: false
      runner: vm-linux-x86-4cpu-8gb
      EXTRA_DIB_ARGS: "--manifest=.ci/image/.docker-images"
  #####################################################
  ## Resolve the image reference for downstream jobs ##
  #####################################################
  - component: $CI_SERVER_FQDN/cloudflare/ci/docker-image/get-image-ref@~latest
    inputs:
      stage: pre-build
      jobPrefix: ci-image
      runOnMR: true
      runOnBranches: '^master$'
      IMAGE_PATH: "$REGISTRY_HOST/stash/tun/cloudflared/ci-image/master"
      VARIABLE_NAME: BUILD_IMAGE
      needs:
        - job: ci-image-build-push-image
          optional: true
--- a/.ci/commons.gitlab-ci.yml
+++ b/.ci/commons.gitlab-ci.yml
@ -1,45 +0,0 @@
 ## A set of predefined rules to use on the different jobs
 .default-rules:
  # Rules to run the job only on the master branch
  run-on-master:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: on_success
    - when: never
  # Rules to run the job only on merge requests
  run-on-mr:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: on_success
    - when: never
  # Rules to run the job on merge_requests and master branch
  run-always:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH != null && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: on_success
    - when: never
  # Rules to run the job only when a release happens
  run-on-release:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
          - 'RELEASE_NOTES'
      when: on_success
    - when: never
 .component-tests:
  image: $BUILD_IMAGE
  rules:
    - !reference [.default-rules, run-always]
  variables:
    COMPONENT_TESTS_CONFIG: component-test-config.yaml
    COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiBjbG91ZGZsYXJlZC5leGUKY3JlZGVudGlhbHNfZmlsZTogY3JlZC5qc29uCm9yaWdpbmNlcnQ6IGNlcnQucGVtCnpvbmVfZG9tYWluOiBhcmdvdHVubmVsdGVzdC5jb20Kem9uZV90YWc6IDQ4Nzk2ZjFlNzBiYjc2NjljMjliYjUxYmEyODJiZjY1
  secrets:
    DNS_API_TOKEN:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/_terraform_atlantis/component_tests_token/data@kv
      file: false
    COMPONENT_TESTS_ORIGINCERT:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/component_tests_cert_pem/data@kv
      file: false
  cache: {}
--- a/.ci/github.gitlab-ci.yml
+++ b/.ci/github.gitlab-ci.yml
@ -1,17 +0,0 @@
 include:
  - local: .ci/commons.gitlab-ci.yml
 ######################################
 ### Sync master branch with Github ###
 ######################################
 push-github:
  stage: sync
  rules:
    - !reference [.default-rules, run-on-master]
  script:
    - ./.ci/scripts/github-push.sh
  secrets:
    CLOUDFLARED_DEPLOY_SSH_KEY:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cloudflared_github_ssh/data@kv
      file: false
  cache: {}
--- a/.ci/image/.docker-images
+++ b/.ci/image/.docker-images
@ -1,2 +0,0 @@
 images:
  - name: ci-image
--- a/.ci/image/Dockerfile
+++ b/.ci/image/Dockerfile
@ -1,35 +0,0 @@
 ARG CLOUDFLARE_DOCKER_REGISTRY_HOST
 FROM ${CLOUDFLARE_DOCKER_REGISTRY_HOST:-registry.cfdata.org}/stash/cf/debian-images/bookworm/main:2025.7.0@sha256:6350da2f7e728dae2c1420f6dafc38e23cacc0b399d3d5b2f40fe48d9c8ff1ca
 RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install --no-install-recommends --allow-downgrades -y \
        build-essential \
        git \
        go-boring=1.24.9-1 \
        libffi-dev \
        procps \
        python3-dev \
        python3-pip \
        python3-setuptools \
        python3-venv \
        # libmsi and libgcab are libraries the wixl binary depends on.
        libmsi-dev \
        libgcab-dev \
        # deb and rpm build tools
        rubygem-fpm \
        rpm \
        # create deb and rpm repository files
        reprepro \
        createrepo-c \
        # gcc for cross architecture compilation in arm
        gcc-aarch64-linux-gnu \
        libc6-dev-arm64-cross && \
    rm -rf /var/lib/apt/lists/* && \
    # Install wixl
    curl -o /usr/local/bin/wixl -L https://pkg.cloudflare.com/binaries/wixl && \
    chmod a+x /usr/local/bin/wixl && \
    mkdir -p opt
 WORKDIR /opt
--- a/.ci/linux.gitlab-ci.yml
+++ b/.ci/linux.gitlab-ci.yml
@ -1,122 +0,0 @@
 .golang-inputs: &golang_inputs
  runOnMR: true
  runOnBranches: '^master$'
  outputDir: artifacts
  runner: linux-x86-8cpu-16gb
  stage: build
  golangVersion: "boring-1.24"
  imageVersion: "3371-f5539bd6f83d@sha256:a2a68f580070f9411d0d3155959ed63b700ef319b5fcc62db340e92227bbc628"
  CGO_ENABLED: 1
 .default-packaging-job: &packaging-job-defaults
  stage: package
  needs:
    - ci-image-get-image-ref
  rules:
    - !reference [.default-rules, run-on-master]
  image: $BUILD_IMAGE
  cache: {}
  artifacts:
    paths:
      - artifacts/*
 include:
  ###################
  ### Linux Build ###
  ###################
  - component: $CI_SERVER_FQDN/cloudflare/ci/golang/boring-make@~latest
    inputs:
      <<: *golang_inputs
      jobPrefix: linux-build
      GOLANG_MAKE_TARGET: ci-build
  ########################
  ### Linux FIPS Build ###
  ########################
  - component: $CI_SERVER_FQDN/cloudflare/ci/golang/boring-make@~latest
    inputs:
      <<: *golang_inputs
      jobPrefix: linux-fips-build
      GOLANG_MAKE_TARGET: ci-fips-build
  #################
  ### Unit Tests ##
  #################
  - component: $CI_SERVER_FQDN/cloudflare/ci/golang/boring-make@~latest
    inputs:
      <<: *golang_inputs
      stage: test
      jobPrefix: test
      GOLANG_MAKE_TARGET: ci-test
  ######################
  ### Unit Tests FIPS ##
  ######################
  - component: $CI_SERVER_FQDN/cloudflare/ci/golang/boring-make@~latest
    inputs:
      <<: *golang_inputs
      stage: test
      jobPrefix: test-fips
      GOLANG_MAKE_TARGET: ci-fips-test
  #################
  ### Vuln Check ##
  #################
  - component: $CI_SERVER_FQDN/cloudflare/ci/golang/boring-make@~latest
    inputs:
      <<: *golang_inputs
      runOnBranches: '^$'
      stage: validate
      jobPrefix: vulncheck
      GOLANG_MAKE_TARGET: vulncheck
 #################################
 ### Run Linux Component Tests ###
 #################################
 linux-component-tests: &linux-component-tests
  stage: test
  extends: .component-tests
  needs:
    - ci-image-get-image-ref
    - linux-build-boring-make
  script:
    - ./.ci/scripts/component-tests.sh
  variables: &component-tests-variables
    CI: 1
    COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiAuL2Nsb3VkZmxhcmVkCmNyZWRlbnRpYWxzX2ZpbGU6IGNyZWQuanNvbgpvcmlnaW5jZXJ0OiBjZXJ0LnBlbQp6b25lX2RvbWFpbjogYXJnb3R1bm5lbHRlc3QuY29tCnpvbmVfdGFnOiA0ODc5NmYxZTcwYmI3NjY5YzI5YmI1MWJhMjgyYmY2NQ==
  tags:
    - linux-x86-8cpu-16gb
  artifacts:
    reports:
      junit: report.xml
 ######################################
 ### Run Linux FIPS Component Tests ###
 ######################################
 linux-component-tests-fips:
  <<: *linux-component-tests
  needs:
    - ci-image-get-image-ref
    - linux-fips-build-boring-make
  variables:
    <<: *component-tests-variables
    COMPONENT_TESTS_FIPS: 1
 ################################
 ####### Linux Packaging ########
 ################################
 linux-packaging:
  <<: *packaging-job-defaults
  parallel:
    matrix:
      - ARCH: ["386", "amd64", "arm", "armhf", "arm64"]
  script:
    - ./.ci/scripts/linux/build-packages.sh ${ARCH}
 ################################
 ##### Linux FIPS Packaging #####
 ################################
 linux-packaging-fips:
  <<: *packaging-job-defaults
  script:
    - ./.ci/scripts/linux/build-packages-fips.sh
--- a/.ci/mac.gitlab-ci.yml
+++ b/.ci/mac.gitlab-ci.yml
@ -1,66 +0,0 @@
 include:
  - local: .ci/commons.gitlab-ci.yml
 ###############################
 ### Defaults for Mac Builds ###
 ###############################
 .mac-build-defaults: &mac-build-defaults
  rules:
    - !reference [.default-rules, run-on-mr]
  tags:
    - "macstadium-${RUNNER_ARCH}"
  parallel:
    matrix:
      - RUNNER_ARCH: [arm, intel]
  cache: {}
 ######################################
 ### Build Cloudflared Mac Binaries ###
 ######################################
 macos-build-cloudflared: &mac-build
  <<: *mac-build-defaults
  stage: build
  artifacts:
    paths:
      - artifacts/*
  script:
    - '[ "${RUNNER_ARCH}" = "arm" ] && export TARGET_ARCH=arm64'
    - '[ "${RUNNER_ARCH}" = "intel" ] && export TARGET_ARCH=amd64'
    - ARCH=$(uname -m)
    - echo ARCH=$ARCH - TARGET_ARCH=$TARGET_ARCH
    - ./.ci/scripts/mac/install-go.sh
    - BUILD_SCRIPT=.ci/scripts/mac/build.sh
    - if [[ ! -x ${BUILD_SCRIPT} ]] ; then exit ; fi
    - set -euo pipefail
    - echo "Executing ${BUILD_SCRIPT}"
    - exec ${BUILD_SCRIPT}
 ###############################################
 ### Build and Sign Cloudflared Mac Binaries ###
 ###############################################
 macos-build-and-sign-cloudflared:
  <<: *mac-build
  rules:
    - !reference [.default-rules, run-on-master]
  secrets:
    APPLE_DEV_CA_CERT:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/apple_dev_ca_cert_v2/data@kv
      file: false
    CFD_CODE_SIGN_CERT:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cfd_code_sign_cert_v2/data@kv
      file: false
    CFD_CODE_SIGN_KEY:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cfd_code_sign_key_v2/data@kv
      file: false
    CFD_CODE_SIGN_PASS:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cfd_code_sign_pass_v2/data@kv
      file: false
    CFD_INSTALLER_CERT:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cfd_installer_cert_v2/data@kv
      file: false
    CFD_INSTALLER_KEY:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cfd_installer_key_v2/data@kv
      file: false
    CFD_INSTALLER_PASS:
      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cfd_installer_pass_v2/data@kv
      file: false
--- a/.ci/release.gitlab-ci.yml
+++ b/.ci/release.gitlab-ci.yml
@ -1,133 +0,0 @@
 include:
  - local: .ci/commons.gitlab-ci.yml
  ######################################
  ### Build and Push DockerHub Image ###
  ######################################
  - component: $CI_SERVER_FQDN/cloudflare/ci/docker-image/build-push-image@~latest
    inputs:
      stage: release
      jobPrefix: docker-hub
      runOnMR: false
      runOnBranches: '^master$'
      runOnChangesTo: ['RELEASE_NOTES']
      needs:
        - generate-version-file
        - release-cloudflared-to-r2
      commentImageRefs: false
      runner: vm-linux-x86-4cpu-8gb
      # Based on if the CI reference is protected or not the CI component will
      # either use _BRANCH or _PROD, therefore, to prevent the pipelines from failing
      # we simply set both to the same value.
      DOCKER_USER_BRANCH: &docker-hub-user svcgithubdockerhubcloudflar045
      DOCKER_PASSWORD_BRANCH: &docker-hub-password gitlab/cloudflare/tun/cloudflared/_dev/dockerhub/svc_password/data
      DOCKER_USER_PROD: *docker-hub-user
      DOCKER_PASSWORD_PROD: *docker-hub-password
      EXTRA_DIB_ARGS: --overwrite
 .default-release-job: &release-job-defaults
  stage: release
  image: $BUILD_IMAGE
  cache:
    paths:
      - .cache/pip
  variables: &release-job-variables
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
    # KV Vars
    KV_NAMESPACE: 380e19aa04314648949b6ad841417ebe
    KV_ACCOUNT: &cf-account 5ab4e9dfbd435d24068829fda0077963
    # R2 Vars
    R2_BUCKET: cloudflared-pkgs
    R2_ACCOUNT_ID: *cf-account
    # APT and RPM Repository Vars
    GPG_PUBLIC_KEY_URL: "https://pkg.cloudflare.com/cloudflare-ascii-pubkey.gpg"
    PKG_URL: "https://pkg.cloudflare.com/cloudflared"
    BINARY_NAME: cloudflared
  secrets:
    KV_API_TOKEN:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_kv_api_token/data@kv
      file: false
    API_KEY:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_github_api_key/data@kv
      file: false
    R2_CLIENT_ID:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/_terraform_atlantis/r2_api_token/client_id@kv
      file: false
    R2_CLIENT_SECRET:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/_terraform_atlantis/r2_api_token/client_secret@kv
      file: false
    LINUX_SIGNING_PUBLIC_KEY:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v1/public_key@kv
      file: false
    LINUX_SIGNING_PRIVATE_KEY:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v1/private_key@kv
      file: false
    LINUX_SIGNING_PUBLIC_KEY_2:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v2/public_key@kv
      file: false
    LINUX_SIGNING_PRIVATE_KEY_2:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v2/private_key@kv
      file: false
 ###########################################
 ### Push Cloudflared Binaries to Github ###
 ###########################################
 release-cloudflared-to-github:
  <<: *release-job-defaults
  rules:
    - !reference [.default-rules, run-on-release]
  needs:
    - ci-image-get-image-ref
    - linux-packaging
    - linux-packaging-fips
    - macos-build-and-sign-cloudflared
    - windows-package-sign
  script:
    - ./.ci/scripts/release-target.sh github-release
 #########################################
 ### Upload Cloudflared Binaries to R2 ###
 #########################################
 release-cloudflared-to-r2:
  <<: *release-job-defaults
  rules:
    - !reference [.default-rules, run-on-release]
  needs:
    - ci-image-get-image-ref
    - linux-packaging # We only release non-FIPS binaries to R2
    - release-cloudflared-to-github
  script:
    - ./.ci/scripts/release-target.sh r2-linux-release
 #################################################
 ### Upload Cloudflared Nightly Binaries to R2 ###
 #################################################
 release-cloudflared-nightly-to-r2:
  <<: *release-job-defaults
  rules:
    - !reference [.default-rules, run-on-master]
  variables:
    <<: *release-job-variables
    R2_BUCKET: cloudflared-pkgs-next
    GPG_PUBLIC_KEY_URL: "https://next.pkg.cloudflare.com/cloudflare-ascii-pubkey.gpg"
    PKG_URL: "https://next.pkg.cloudflare.com/cloudflared"
  needs:
    - ci-image-get-image-ref
    - linux-packaging # We only release non-FIPS binaries to R2
  script:
    - ./.ci/scripts/release-target.sh r2-linux-release
 #############################
 ### Generate Version File ###
 #############################
 generate-version-file:
  <<: *release-job-defaults
  rules:
    - !reference [.default-rules, run-on-release]
  needs:
    - ci-image-get-image-ref
  script:
    - make generate-docker-version
  artifacts:
    paths:
      - versions
--- a/.ci/scripts/component-tests.sh
+++ b/.ci/scripts/component-tests.sh
@ -1,25 +0,0 @@
 #!/bin/bash
 set -e -o pipefail
 # Fetch cloudflared from the artifacts folder
 mv ./artifacts/cloudflared ./cloudflared
 python3 -m venv env
 . env/bin/activate
 pip install --upgrade -r component-tests/requirements.txt
 # Creates and routes a Named Tunnel for this build. Also constructs
 # config file from env vars.
 python3 component-tests/setup.py --type create
 # Define the cleanup function
 cleanup() {
    # The Named Tunnel is deleted and its route unprovisioned here.
    python3 component-tests/setup.py --type cleanup
 }
 # The trap will call the cleanup function on script exit
 trap cleanup EXIT
 pytest component-tests -o log_cli=true --log-cli-level=INFO --junit-xml=report.xml
--- a/.ci/scripts/fmt-check.sh
+++ b/.ci/scripts/fmt-check.sh
@ -1,13 +0,0 @@
 #!/bin/bash
 set -e -o pipefail
 OUTPUT=$(go run -mod=readonly golang.org/x/tools/cmd/goimports@v0.30.0 -l -d -local github.com/cloudflare/cloudflared $(go list -mod=vendor -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc))
 if [ -n "$OUTPUT" ] ; then
  PAGER=$(which colordiff || echo cat)
  echo
  echo "Code formatting issues found, use 'make fmt' to correct them"
  echo
  echo "$OUTPUT" | $PAGER
  exit 1
 fi
--- a/.ci/scripts/github-push.sh
+++ b/.ci/scripts/github-push.sh
@ -1,31 +0,0 @@
 #!/bin/bash
 set -e -o pipefail
 BRANCH="master"
 TMP_PATH="$PWD/tmp"
 PRIVATE_KEY_PATH="$TMP_PATH/github-deploy-key"
 PUBLIC_KEY_GITHUB_PATH="$TMP_PATH/github.pub"
 mkdir -p $TMP_PATH
 # Setup Private Key
 echo "$CLOUDFLARED_DEPLOY_SSH_KEY" > $PRIVATE_KEY_PATH
 chmod 400 $PRIVATE_KEY_PATH
 # Download GitHub Public Key for KnownHostsFile
 ssh-keyscan -t ed25519 github.com > $PUBLIC_KEY_GITHUB_PATH
 # Setup git ssh command with the right configurations
 export GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=$PUBLIC_KEY_GITHUB_PATH -o IdentitiesOnly=yes -i $PRIVATE_KEY_PATH"
 # Add GitHub as a new remote
 git remote add github git@github.com:cloudflare/cloudflared.git || true
 # GitLab doesn't pull branch references, instead it creates a new one on each pipeline.
 # Therefore, we need to manually fetch the reference to then push it to GitHub.
 git fetch origin $BRANCH:$BRANCH
 git push -u github $BRANCH
 if TAG="$(git describe --tags --exact-match 2>/dev/null)"; then
  git push -u github "$TAG"
 fi
--- a/.ci/scripts/linux/build-packages-fips.sh
+++ b/.ci/scripts/linux/build-packages-fips.sh
@ -1,26 +0,0 @@
 #!/bin/bash
 VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
 # This controls the directory the built artifacts go into
 export ARTIFACT_DIR=artifacts/
 mkdir -p $ARTIFACT_DIR
 arch=("amd64")
 export TARGET_ARCH=$arch
 export TARGET_OS=linux
 export FIPS=true
 # For BoringCrypto to link, we need CGO enabled. Otherwise compilation fails.
 export CGO_ENABLED=1
 make cloudflared-deb
 mv cloudflared-fips\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-fips-linux-$arch.deb
 # rpm packages invert the - and _ and use x86_64 instead of amd64.
 RPMVERSION=$(echo $VERSION | sed -r 's/-/_/g')
 RPMARCH="x86_64"
 make cloudflared-rpm
 mv cloudflared-fips-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-fips-linux-$RPMARCH.rpm
 # finally move the linux binary as well.
 mv ./cloudflared $ARTIFACT_DIR/cloudflared-fips-linux-$arch
--- a/.ci/scripts/linux/build-packages.sh
+++ b/.ci/scripts/linux/build-packages.sh
@ -1,59 +0,0 @@
 #!/bin/bash
 # Check if architecture argument is provided
 if [ $# -eq 0 ]; then
    echo "Error: Architecture argument is required"
    echo "Usage: $0 <architecture>"
    exit 1
 fi
 # Parameters
 arch=$1
 # Get Version
 VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
 # Disable FIPS module in go-boring
 export GOEXPERIMENT=noboringcrypto
 export CGO_ENABLED=0
 # This controls the directory the built artifacts go into
 export ARTIFACT_DIR=artifacts/
 mkdir -p $ARTIFACT_DIR
 export TARGET_OS=linux
 unset TARGET_ARM
 export TARGET_ARCH=$arch
 ## Support for arm platforms without hardware FPU enabled
 if [[ $arch == arm ]] ; then
    export TARGET_ARCH=arm
    export TARGET_ARM=5
 fi
 ## Support for armhf builds
 if [[ $arch == armhf ]] ; then
    export TARGET_ARCH=arm
    export TARGET_ARM=7
 fi
 make cloudflared-deb
 mv cloudflared\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-linux-$arch.deb
 # rpm packages invert the - and _ and use x86_64 instead of amd64.
 RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
 RPMARCH=$arch
 if [ $arch == "amd64" ];then
    RPMARCH="x86_64"
 fi
 if [ $arch == "arm64" ]; then
    RPMARCH="aarch64"
 fi
 make cloudflared-rpm
 mv cloudflared-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-linux-$RPMARCH.rpm
 # finally move the linux binary as well.
 mv ./cloudflared $ARTIFACT_DIR/cloudflared-linux-$arch
--- a/.ci/scripts/mac/build.sh
+++ b/.ci/scripts/mac/build.sh
@ -1,228 +0,0 @@
 #!/bin/bash
 set -exo pipefail
 if [[ "$(uname)" != "Darwin" ]] ; then
    echo "This should be run on macOS"
    exit 1
 fi
 if [[ "amd64" != "${TARGET_ARCH}" && "arm64" != "${TARGET_ARCH}" ]]
 then
  echo "TARGET_ARCH must be amd64 or arm64"
  exit 1
 fi
 go version
 export GO111MODULE=on
 # build 'cloudflared-darwin-amd64.tgz'
 mkdir -p artifacts
 TARGET_DIRECTORY=".build"
 BINARY_NAME="cloudflared"
 VERSION=$(git describe --tags --always --dirty="-dev")
 PRODUCT="cloudflared"
 APPLE_CA_CERT="apple_dev_ca.cert"
 CODE_SIGN_PRIV="code_sign.p12"
 CODE_SIGN_CERT="code_sign.cer"
 INSTALLER_PRIV="installer.p12"
 INSTALLER_CERT="installer.cer"
 BUNDLE_ID="com.cloudflare.cloudflared"
 SEC_DUP_MSG="security: SecKeychainItemImport: The specified item already exists in the keychain."
 export PATH="$PATH:/usr/local/bin"
 FILENAME="$(pwd)/artifacts/cloudflared-darwin-$TARGET_ARCH.tgz"
 PKGNAME="$(pwd)/artifacts/cloudflared-$TARGET_ARCH.pkg"
 mkdir -p ../src/github.com/cloudflare/    
 cp -r . ../src/github.com/cloudflare/cloudflared
 cd ../src/github.com/cloudflare/cloudflared 
 # Imports certificates to the Apple KeyChain
 import_certificate() {
    local CERTIFICATE_NAME=$1
    local CERTIFICATE_ENV_VAR=$2
    local CERTIFICATE_FILE_NAME=$3
    echo "Importing $CERTIFICATE_NAME"
    if [[ ! -z "$CERTIFICATE_ENV_VAR" ]]; then
      # write certificate to disk and then import it keychain
      echo -n -e ${CERTIFICATE_ENV_VAR} | base64 -D > ${CERTIFICATE_FILE_NAME}
      # we set || true  here and for every `security import invoke` because the  "duplicate SecKeychainItemImport" error
      # will cause set -e to exit 1. It is okay we do this because we deliberately handle this error in the lines below.
      local out=$(security import ${CERTIFICATE_FILE_NAME} -T /usr/bin/pkgbuild -A 2>&1) || true
      local exitcode=$?
      # delete the certificate from disk
      rm -rf ${CERTIFICATE_FILE_NAME}
      if [ -n "$out" ]; then
        if [ $exitcode -eq 0 ]; then
            echo "$out"
        else
            if [ "$out" != "${SEC_DUP_MSG}" ]; then
                echo "$out" >&2
                exit $exitcode
            else
                echo "already imported code signing certificate"
            fi
        fi
      fi
    fi
 }
 create_cloudflared_build_keychain() {
  # Reusing the private key password as the keychain key
  local PRIVATE_KEY_PASS=$1
  # Create keychain only if it doesn't already exist
  if [ ! -f "$HOME/Library/Keychains/cloudflared_build_keychain.keychain-db" ]; then
    security create-keychain -p "$PRIVATE_KEY_PASS" cloudflared_build_keychain
  else
    echo "Keychain already exists: cloudflared_build_keychain"
  fi
  # Append temp keychain to the user domain
  security list-keychains -d user -s cloudflared_build_keychain $(security list-keychains -d user | sed s/\"//g)
  # Remove relock timeout
  security set-keychain-settings cloudflared_build_keychain
  # Unlock keychain so it doesn't require password
  security unlock-keychain -p "$PRIVATE_KEY_PASS" cloudflared_build_keychain
 }
 # Imports private keys to the Apple KeyChain
 import_private_keys() {
    local PRIVATE_KEY_NAME=$1
    local PRIVATE_KEY_ENV_VAR=$2
    local PRIVATE_KEY_FILE_NAME=$3
    local PRIVATE_KEY_PASS=$4
    echo "Importing $PRIVATE_KEY_NAME"
    if [[ ! -z "$PRIVATE_KEY_ENV_VAR" ]]; then
      if [[ ! -z "$PRIVATE_KEY_PASS" ]]; then
        # write private key to disk and then import it keychain
        echo -n -e ${PRIVATE_KEY_ENV_VAR} | base64 -D > ${PRIVATE_KEY_FILE_NAME}
        # we set || true  here and for every `security import invoke` because the  "duplicate SecKeychainItemImport" error
        # will cause set -e to exit 1. It is okay we do this because we deliberately handle this error in the lines below.
        local out=$(security import ${PRIVATE_KEY_FILE_NAME} -k cloudflared_build_keychain -P "$PRIVATE_KEY_PASS" -T /usr/bin/pkgbuild -A -P "${PRIVATE_KEY_PASS}" 2>&1) || true
        local exitcode=$?
        rm -rf ${PRIVATE_KEY_FILE_NAME}
        if [ -n "$out" ]; then
          if [ $exitcode -eq 0 ]; then
              echo "$out"
          else
              if [ "$out" != "${SEC_DUP_MSG}" ]; then
                  echo "$out" >&2
                  exit $exitcode
              fi
          fi
        fi
      fi
    fi
 }
 # Create temp keychain only for this build
 create_cloudflared_build_keychain "${CFD_CODE_SIGN_PASS}"
 # Add Apple Root Developer certificate to the key chain
 import_certificate "Apple Developer CA" "${APPLE_DEV_CA_CERT}" "${APPLE_CA_CERT}"
 # Add code signing private key to the key chain
 import_private_keys "Developer ID Application" "${CFD_CODE_SIGN_KEY}" "${CODE_SIGN_PRIV}" "${CFD_CODE_SIGN_PASS}"
 # Add code signing certificate to the key chain
 import_certificate "Developer ID Application" "${CFD_CODE_SIGN_CERT}" "${CODE_SIGN_CERT}"
 # Add package signing private key to the key chain
 import_private_keys "Developer ID Installer" "${CFD_INSTALLER_KEY}" "${INSTALLER_PRIV}" "${CFD_INSTALLER_PASS}"
 # Add package signing certificate to the key chain
 import_certificate "Developer ID Installer" "${CFD_INSTALLER_CERT}" "${INSTALLER_CERT}"
 # get the code signing certificate name
 if [[ ! -z "$CFD_CODE_SIGN_NAME" ]]; then
  CODE_SIGN_NAME="${CFD_CODE_SIGN_NAME}"
 else
  if [[ -n "$(security find-certificate -c "Developer ID Application" cloudflared_build_keychain | cut -d'"' -f 4 -s | grep "Developer ID Application:" | head -1)" ]]; then
    CODE_SIGN_NAME=$(security find-certificate -c "Developer ID Application" cloudflared_build_keychain | cut -d'"' -f 4 -s | grep "Developer ID Application:" | head -1)
  else
    CODE_SIGN_NAME=""
  fi
 fi
 # get the package signing certificate name
 if [[ ! -z "$CFD_INSTALLER_NAME" ]]; then
  PKG_SIGN_NAME="${CFD_INSTALLER_NAME}"
 else
  if [[ -n "$(security find-certificate -c "Developer ID Installer" cloudflared_build_keychain | cut -d'"' -f 4 -s | grep "Developer ID Installer:" | head -1)" ]]; then
    PKG_SIGN_NAME=$(security find-certificate -c "Developer ID Installer" cloudflared_build_keychain | cut -d'"' -f 4 -s | grep "Developer ID Installer:" | head -1)
  else
    PKG_SIGN_NAME=""
  fi
 fi
 # cleanup the build directory because the previous execution might have failed without cleaning up.
 rm -rf "${TARGET_DIRECTORY}"
 export TARGET_OS="darwin"
 GOCACHE="$PWD/../../../../" GOPATH="$PWD/../../../../" CGO_ENABLED=1 make cloudflared
 # This allows apple tools to use the certificates in the keychain without requiring password input.
 # This command always needs to run after the certificates have been loaded into the keychain
 if [[ ! -z "$CFD_CODE_SIGN_PASS" ]]; then
  security set-key-partition-list -S apple-tool:,apple: -s -k "${CFD_CODE_SIGN_PASS}" cloudflared_build_keychain
 fi
 # sign the cloudflared binary
 if [[ ! -z "$CODE_SIGN_NAME" ]]; then
  codesign --keychain $HOME/Library/Keychains/cloudflared_build_keychain.keychain-db -s "${CODE_SIGN_NAME}" -fv --options runtime --timestamp ${BINARY_NAME}
 # notarize the binary
 # TODO: TUN-5789
 fi
 ARCH_TARGET_DIRECTORY="${TARGET_DIRECTORY}/${TARGET_ARCH}-build"
 # creating build directory
 rm -rf $ARCH_TARGET_DIRECTORY
 mkdir -p "${ARCH_TARGET_DIRECTORY}"
 mkdir -p "${ARCH_TARGET_DIRECTORY}/contents"
 cp -r ".mac_resources/scripts" "${ARCH_TARGET_DIRECTORY}/scripts"
 # copy cloudflared into the build directory
 cp ${BINARY_NAME} "${ARCH_TARGET_DIRECTORY}/contents/${PRODUCT}"
 # compress cloudflared into a tar and gzipped file
 tar czf "$FILENAME" "${BINARY_NAME}"
 # build the installer package
 if [[ ! -z "$PKG_SIGN_NAME" ]]; then
  pkgbuild --identifier com.cloudflare.${PRODUCT} \
      --version ${VERSION} \
      --scripts ${ARCH_TARGET_DIRECTORY}/scripts \
      --root ${ARCH_TARGET_DIRECTORY}/contents \
      --install-location /usr/local/bin \
      --keychain cloudflared_build_keychain \
      --sign "${PKG_SIGN_NAME}" \
      ${PKGNAME}
      # notarize the package
      # TODO: TUN-5789
 else
    pkgbuild --identifier com.cloudflare.${PRODUCT} \
      --version ${VERSION} \
      --scripts ${ARCH_TARGET_DIRECTORY}/scripts \
      --root ${ARCH_TARGET_DIRECTORY}/contents \
      --install-location /usr/local/bin \
      ${PKGNAME}
 fi
 # cleanup build directory because this script is not ran within containers,
 # which might lead to future issues in subsequent runs.
 rm -rf "${TARGET_DIRECTORY}"
 # cleanup the keychain
 security default-keychain -d user -s login.keychain-db
 security list-keychains -d user -s login.keychain-db
 security delete-keychain cloudflared_build_keychain
--- a/.ci/scripts/mac/install-go.sh
+++ b/.ci/scripts/mac/install-go.sh
@ -1,10 +0,0 @@
 rm -rf /tmp/go
 export GOCACHE=/tmp/gocache
 rm -rf $GOCACHE
 brew install go@1.24
 go version
 which go
 go env
--- a/.ci/scripts/package-windows.sh
+++ b/.ci/scripts/package-windows.sh
@ -1,23 +0,0 @@
 #!/bin/bash
 python3 -m venv env
 . env/bin/activate
 pip install pynacl==1.4.0 pygithub==1.55
 VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
 export TARGET_OS=windows
 # This controls the directory the built artifacts go into
 export BUILT_ARTIFACT_DIR=artifacts/
 export FINAL_ARTIFACT_DIR=artifacts/
 mkdir -p $BUILT_ARTIFACT_DIR
 mkdir -p $FINAL_ARTIFACT_DIR
 windowsArchs=("amd64" "386")
 for arch in ${windowsArchs[@]}; do
    export TARGET_ARCH=$arch
    # Copy .exe from artifacts directory
    cp $BUILT_ARTIFACT_DIR/cloudflared-windows-$arch.exe ./cloudflared.exe
    make cloudflared-msi
    # Copy msi into final directory
    mv cloudflared-$VERSION-$arch.msi $FINAL_ARTIFACT_DIR/cloudflared-windows-$arch.msi
 done
--- a/.ci/scripts/release-target.sh
+++ b/.ci/scripts/release-target.sh
@ -1,18 +0,0 @@
 #!/bin/bash
 set -e -o pipefail
 # Check if a make target is provided as an argument
 if [ $# -eq 0 ]; then
    echo "Error: Make target argument is required"
    echo "Usage: $0 <make-target>"
    exit 1
 fi
 MAKE_TARGET=$1
 python3 -m venv venv
 source venv/bin/activate
 # Our release scripts are written in python, so we should install their dependecies here.
 pip install pynacl==1.4.0 pygithub==1.55 boto3==1.22.9 python-gnupg==0.4.9
 make $MAKE_TARGET
--- a/.ci/scripts/vuln-check.sh
+++ b/.ci/scripts/vuln-check.sh
@ -1,52 +0,0 @@
 #!/bin/bash
 set -e
 # Define the file to store the list of vulnerabilities to ignore.
 IGNORE_FILE=".vulnignore"
 # Check if the ignored vulnerabilities file exists. If not, create an empty one.
 if [ ! -f "$IGNORE_FILE" ]; then
    touch "$IGNORE_FILE"
    echo "Created an empty file to store ignored vulnerabilities: $IGNORE_FILE"
    echo "# Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line." >> "$IGNORE_FILE"
    echo "# You can also add comments on the same line after the ID." >> "$IGNORE_FILE"
    echo "" >> "$IGNORE_FILE"
 fi
 # Run govulncheck and capture its output.
 VULN_OUTPUT=$(go run -mod=readonly golang.org/x/vuln/cmd/govulncheck@latest ./... || true)
 # Print the govuln output
 echo "====================================="
 echo "Full Output of govulncheck:"
 echo "====================================="
 echo "$VULN_OUTPUT"
 echo "====================================="
 echo "End of govulncheck Output"
 echo "====================================="
 # Process the ignore file to remove comments and empty lines.
 # The 'cut' command gets the vulnerability ID and removes anything after the '#'.
 # The 'grep' command filters out empty lines and lines starting with '#'.
 CLEAN_IGNORES=$(grep -v '^\s*#' "$IGNORE_FILE" | cut -d'#' -f1 | sed 's/ //g' | sort -u || true)
 # Filter out the ignored vulnerabilities.
 UNIGNORED_VULNS=$(echo "$VULN_OUTPUT" | grep 'Vulnerability')
 # If the list of ignored vulnerabilities is not empty, filter them out.
 if [ -n "$CLEAN_IGNORES" ]; then
    UNIGNORED_VULNS=$(echo "$UNIGNORED_VULNS" | grep -vFf <(echo "$CLEAN_IGNORES") || true)
 fi
 # If there are any vulnerabilities that were not in our ignore list, print them and exit with an error.
 if [ -n "$UNIGNORED_VULNS" ]; then
    echo "🚨 Found new, unignored vulnerabilities:"
    echo "-------------------------------------"
    echo "$UNIGNORED_VULNS"
    echo "-------------------------------------"
    echo "Exiting with an error. ❌"
    exit 1
 else
    echo "🎉 No new vulnerabilities found. All clear! ✨"
    exit 0
 fi
--- a/.ci/scripts/windows/builds.ps1
+++ b/.ci/scripts/windows/builds.ps1
@ -1,29 +0,0 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 $ProgressPreference = "SilentlyContinue"
 $env:TARGET_OS = "windows"
 $env:LOCAL_OS = "windows"
 $TIMESTAMP_RFC3161 = "http://timestamp.digicert.com"
 New-Item -Path ".\artifacts" -ItemType Directory
 Write-Output "Building for amd64"
 $env:TARGET_ARCH = "amd64"
 $env:LOCAL_ARCH = "amd64"
 $env:CGO_ENABLED = 1
 & make cloudflared
 if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for amd64" }
 # Sign build
 azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
 copy .\cloudflared.exe .\artifacts\cloudflared-windows-amd64.exe
 Write-Output "Building for 386"
 $env:TARGET_ARCH = "386"
 $env:LOCAL_ARCH = "386"
 $env:CGO_ENABLED = 0
 & make cloudflared
 if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for 386" }
 ## Sign build
 azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
 copy .\cloudflared.exe .\artifacts\cloudflared-windows-386.exe
--- a/.ci/scripts/windows/component-test.ps1
+++ b/.ci/scripts/windows/component-test.ps1
@ -1,40 +0,0 @@
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 $ProgressPreference = "SilentlyContinue"
 $env:TARGET_OS = "windows"
 $env:LOCAL_OS = "windows"
 $env:TARGET_ARCH = "amd64"
 $env:LOCAL_ARCH = "amd64"
 $env:CGO_ENABLED = 1
 python --version
 python -m pip --version
 Write-Host "Building cloudflared"
 & make cloudflared
 if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared" }
 Write-Host "Running unit tests"
 # Not testing with race detector because of https://github.com/golang/go/issues/61058
 # We already test it on other platforms
 go test -failfast -v -mod=vendor ./...
 if ($LASTEXITCODE -ne 0) { throw "Failed unit tests" }
 # On Gitlab runners we need to add all of this addresses to the NO_PROXY list in order for the tests to run.
 $env:NO_PROXY = "pypi.org,files.pythonhosted.org,api.cloudflare.com,argotunneltest.com,argotunnel.com,trycloudflare.com,${env:NO_PROXY}"
 Write-Host "No Proxy: ${env:NO_PROXY}"
 Write-Host "Running component tests"
 try {
    python -m pip --disable-pip-version-check install --upgrade -r component-tests/requirements.txt --use-pep517
    python component-tests/setup.py --type create
    python -m pytest component-tests -o log_cli=true --log-cli-level=INFO --junit-xml=report.xml
    if ($LASTEXITCODE -ne 0) {
        throw "Failed component tests"
    }
 } finally {
    python component-tests/setup.py --type cleanup
 }
--- a/.ci/scripts/windows/go-wrapper.ps1
+++ b/.ci/scripts/windows/go-wrapper.ps1
@ -1,69 +0,0 @@
 Param(
    [string]$GoVersion,
    [string]$ScriptToExecute
 )
 # The script is a wrapper that downloads a specific version
 # of go, adds it to the PATH and executes a script with that go
 # version in the path.
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Stop"
 $ProgressPreference = "SilentlyContinue"
 # Get the path to the system's temporary directory.
 $tempPath = [System.IO.Path]::GetTempPath()
 # Create a unique name for the new temporary folder.
 $folderName = "go_" + (Get-Random)
 # Join the temp path and the new folder name to create the full path.
 $fullPath = Join-Path -Path $tempPath -ChildPath $folderName
 # Store the current value of PATH environment variable.
 $oldPath = $env:Path
 # Use a try...finally block to ensure the temporrary folder and PATH are cleaned up.
 try {
    # Create the temporary folder.
    Write-Host "Creating temporary folder at: $fullPath"
    $newTempFolder = New-Item -ItemType Directory -Path $fullPath -Force
    # Download go
    $url = "https://go.dev/dl/$GoVersion.windows-amd64.zip"
    $destinationFile = Join-Path -Path $newTempFolder.FullName -ChildPath "go$GoVersion.windows-amd64.zip"
    Write-Host "Downloading go from: $url"
    Invoke-WebRequest -Uri $url -OutFile $destinationFile
    Write-Host "File downloaded to: $destinationFile"
    # Unzip the downloaded file.
    Write-Host "Unzipping the file..."
    Expand-Archive -Path $destinationFile -DestinationPath $newTempFolder.FullName -Force
    Write-Host "File unzipped successfully."
    # Define the go/bin path wich is inside the temporary folder
    $goBinPath = Join-Path -Path $fullPath -ChildPath "go\bin"
    # Add the go/bin path to the PATH environment variable.
    $env:Path = "$goBinPath;$($env:Path)"
    Write-Host "Added $goBinPath to the environment PATH."
    go env
    go version
    & $ScriptToExecute
 } finally {
    # Cleanup: Remove the path from the environment variable and then the temporary folder.
    Write-Host "Starting cleanup..."
    $env:Path = $oldPath
    Write-Host "Reverted changes in the environment PATH."
    # Remove the temporary folder and its contents.
    if (Test-Path -Path $fullPath) {
        Remove-Item -Path $fullPath -Recurse -Force
        Write-Host "Temporary folder and its contents have been removed."
    } else {
        Write-Host "Temporary folder does not exist, no cleanup needed."
    }
 }
--- a/.ci/scripts/windows/sign-msi.ps1
+++ b/.ci/scripts/windows/sign-msi.ps1
@ -1,26 +0,0 @@
 # Sign Windows artifacts using azuretool
 # This script processes MSI files from the artifacts directory
 $ErrorActionPreference = "Stop"
 # Define paths
 $ARTIFACT_DIR = "artifacts"
 $TIMESTAMP_RFC3161 = "http://timestamp.digicert.com"
 Write-Host "Looking for Windows artifacts to sign in $ARTIFACT_DIR..."
 # Find all Windows MSI files
 $msiFiles = Get-ChildItem -Path $ARTIFACT_DIR -Filter "cloudflared-windows-*.msi" -ErrorAction SilentlyContinue
 if ($msiFiles.Count -eq 0) {
    Write-Host "No Windows MSI files found in $ARTIFACT_DIR"
    exit 1
 }
 Write-Host "Found $($msiFiles.Count) file(s) to sign:"
 foreach ($file in $msiFiles) {
    Write-Host "Running azuretool sign for $($file.Name)"
    azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\\$ARTIFACT_DIR\\$($file.Name)
 }
 Write-Host "Signing process completed"
--- a/.ci/windows.gitlab-ci.yml
+++ b/.ci/windows.gitlab-ci.yml
@ -1,114 +0,0 @@
 include:
  - local: .ci/commons.gitlab-ci.yml
 ###################################
 ### Defaults for Windows Builds ###
 ###################################
 .windows-build-defaults: &windows-build-defaults
  rules:
    - !reference [.default-rules, run-always]
  tags:
    - windows-x86
  cache: {}
 ##########################################
 ### Build Cloudflared Windows Binaries ###
 ##########################################
 windows-build-cloudflared:
  <<: *windows-build-defaults
  stage: build
  script:
    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\go-wrapper.ps1" "${GO_VERSION}" ".\.ci\scripts\windows\builds.ps1"
  artifacts:
    paths:
      - artifacts/*
 ######################################################
 ### Load Environment Variables for Component Tests ###
 ######################################################
 windows-load-env-variables:
  stage: pre-build
  extends: .component-tests
  script:
    - echo "COMPONENT_TESTS_CONFIG=$COMPONENT_TESTS_CONFIG" >> windows.env
    - echo "COMPONENT_TESTS_CONFIG_CONTENT=$COMPONENT_TESTS_CONFIG_CONTENT" >> windows.env
    - echo "DNS_API_TOKEN=$DNS_API_TOKEN" >> windows.env
    # We have to encode the `COMPONENT_TESTS_ORIGINCERT` secret, because it content is a file, otherwise we can't export it using gitlab
    - echo "COMPONENT_TESTS_ORIGINCERT=$(echo "$COMPONENT_TESTS_ORIGINCERT" | base64 -w0)" >> windows.env
    - echo "KEY_VAULT_URL=$KEY_VAULT_URL" >> windows.env
    - echo "KEY_VAULT_CLIENT_ID=$KEY_VAULT_CLIENT_ID" >> windows.env
    - echo "KEY_VAULT_TENANT_ID=$KEY_VAULT_TENANT_ID" >> windows.env
    - echo "KEY_VAULT_SECRET=$KEY_VAULT_SECRET" >> windows.env
    - echo "KEY_VAULT_CERTIFICATE=$KEY_VAULT_CERTIFICATE" >> windows.env
  variables:
    COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiAuL2Nsb3VkZmxhcmVkLmV4ZQpjcmVkZW50aWFsc19maWxlOiBjcmVkLmpzb24Kb3JpZ2luY2VydDogY2VydC5wZW0Kem9uZV9kb21haW46IGFyZ290dW5uZWx0ZXN0LmNvbQp6b25lX3RhZzogNDg3OTZmMWU3MGJiNzY2OWMyOWJiNTFiYTI4MmJmNjU=
  secrets:
    KEY_VAULT_URL:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_url@kv
      file: false
    KEY_VAULT_CLIENT_ID:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_client_id@kv
      file: false
    KEY_VAULT_TENANT_ID:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_tenant_id@kv
      file: false
    KEY_VAULT_SECRET:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/secret/key_vault_secret@kv
      file: false
    KEY_VAULT_CERTIFICATE:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/certificate_v2/key_vault_certificate@kv
      file: false
  artifacts:
    access: 'none'
    reports:
      dotenv: windows.env
 ###################################
 ### Run Windows Component Tests ###
 ###################################
 windows-component-tests-cloudflared:
  <<: *windows-build-defaults
  stage: test
  needs: ["windows-load-env-variables"]
  script:
    # We have to decode the secret we encoded on the `windows-load-env-variables` job
    - $env:COMPONENT_TESTS_ORIGINCERT = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($env:COMPONENT_TESTS_ORIGINCERT))
    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\go-wrapper.ps1" "${GO_VERSION}" ".\.ci\scripts\windows\component-test.ps1"
  artifacts:
    reports:
      junit: report.xml
 ################################
 ### Package Windows Binaries ###
 ################################
 windows-package:
  rules:
    - !reference [.default-rules, run-on-master]
  stage: package
  needs:
    - ci-image-get-image-ref
    - windows-build-cloudflared
  image: $BUILD_IMAGE
  script:
    - .ci/scripts/package-windows.sh
  cache: {}
  artifacts:
    paths:
      - artifacts/*
 #############################
 ### Sign Windows Binaries ###
 #############################
 windows-package-sign:
  <<: *windows-build-defaults
  rules:
    - !reference [.default-rules, run-on-master]
  stage: package
  needs:
    - windows-package
    - windows-load-env-variables
  script:
    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\sign-msi.ps1"
  artifacts:
    paths:
      - artifacts/*
--- a/.docker-images
+++ b/.docker-images
@ -1,12 +1,8 @@
 images:
  - name: cloudflared
-    dockerfile: Dockerfile.$ARCH
+    dockerfile: Dockerfile
    context: .
    version_file: versions
    registries:
    - name: docker.io/cloudflare
      user: env:DOCKER_USER
      password: env:DOCKER_PASSWORD
    architectures:
    - amd64
    - arm64
--- a/.github/ISSUE_TEMPLATE/---bug-report.md
+++ b/.github/ISSUE_TEMPLATE/---bug-report.md
@ -1,34 +0,0 @@
 ---
 name: "\U0001F41B Bug report"
 about: Create a report to help us improve cloudflared
 title: "\U0001F41B"
 labels: 'Priority: Normal, Type: Bug'
 ---
 **Describe the bug**
 A clear and concise description of what the bug is.
 **To Reproduce**
 Steps to reproduce the behavior:
 1. Configure '...'
 2. Run '....'
 3. See error
 If it's an issue with Cloudflare Tunnel:
 4. Tunnel ID : 
 5. cloudflared config: 
 **Expected behavior**
 A clear and concise description of what you expected to happen.
 **Environment and versions**
 - OS: [e.g. MacOS]
 - Architecture: [e.g. AMD, ARM]
 - Version: [e.g. 2022.02.0]
 **Logs and errors**
 If applicable, add logs or errors to help explain your problem.
 **Additional context**
 Add any other context about the problem here.
--- a/.github/ISSUE_TEMPLATE/---documentation.md
+++ b/.github/ISSUE_TEMPLATE/---documentation.md
@ -1,16 +0,0 @@
 ---
 name: "\U0001F4DD Documentation"
 about: Request new or updated documentation for cloudflared
 title: "\U0001F4DD"
 labels: 'Priority: Normal, Type: Documentation'
 ---
 **Available Documentation**
 A link to the documentation that is available today and the areas which could be improved. 
 **Suggested Documentation**
 A clear and concise description of the documentation, tutorial, or guide that should be added. 
 **Additional context**
 Add any other context or screenshots about the documentation request here.
--- a/.github/ISSUE_TEMPLATE/---feature-request.md
+++ b/.github/ISSUE_TEMPLATE/---feature-request.md
@ -1,16 +0,0 @@
 ---
 name: "\U0001F4A1 Feature request"
 about: Suggest a feature or enhancement for cloudflared
 title: "\U0001F4A1"
 labels: 'Priority: Normal, Type: Feature Request'
 ---
 **Describe the feature you'd like**
 A clear and concise description of the feature. What problem does it solve for you?
 **Describe alternatives you've considered**
 Are there any alternatives to solving this problem? If so, what was your experience with them?
 **Additional context**
 Add any other context or screenshots about the feature request here.
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@ -4,15 +4,17 @@ jobs:
  check:
    strategy:
      matrix:
-        go-version: [1.22.x]
+        go-version: [1.17.x]
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
    - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v2
      with:
        go-version: ${{ matrix.go-version }}
    - name: Install go-sumtype
      run: go get github.com/sudarshan-reddy/go-sumtype
    - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
    - name: Test
      run: make test
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@ -1,24 +0,0 @@
 on:
  pull_request: {}
  workflow_dispatch: {}
  push: 
    branches:
      - main
      - master
  schedule:
    - cron: '0 0 * * *'
 name: Semgrep config
 jobs:
  semgrep:
    name: semgrep/ci
    runs-on: ubuntu-latest
    env:
      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
      SEMGREP_URL: https://cloudflare.semgrep.dev
      SEMGREP_APP_URL: https://cloudflare.semgrep.dev
      SEMGREP_VERSION_CHECK_URL: https://cloudflare.semgrep.dev/api/check-version
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@v4
      - run: semgrep ci
--- a/.gitignore
+++ b/.gitignore
@ -10,11 +10,9 @@ cscope.*
 /cloudflared.exe
 /cloudflared.msi
 /cloudflared-x86-64*
 /cloudflared.1
 /packaging
 .DS_Store
 *-session.log
 ssh_server_tests/.env
 /.cover
 built_artifacts/
 component-tests/.venv
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -1,58 +0,0 @@
 variables:
  GO_VERSION: "go1.24.9"
  GIT_DEPTH: "0"
 default:
  id_tokens:
    VAULT_ID_TOKEN:
      aud: https://vault.cfdata.org
 stages: [sync, pre-build, build, validate, test, package, release, release-internal, review]
 include:
  #####################################################
  ########## Import Commons Configurations ############
  #####################################################
  - local: .ci/commons.gitlab-ci.yml
  #####################################################
  ########### Sync Repository with Github #############
  #####################################################
  - local: .ci/github.gitlab-ci.yml
  #####################################################
  ############# Build or Fetch CI Image ###############
  #####################################################
  - local: .ci/ci-image.gitlab-ci.yml
  #####################################################
  ################## Linux Builds ###################
  #####################################################
  - local: .ci/linux.gitlab-ci.yml
  #####################################################
  ################## Windows Builds ###################
  #####################################################
  - local: .ci/windows.gitlab-ci.yml
  #####################################################
  ################### macOS Builds ####################
  #####################################################
  - local: .ci/mac.gitlab-ci.yml
  #####################################################
  ################# Release Packages ##################
  #####################################################
  - local: .ci/release.gitlab-ci.yml
  #####################################################
  ########## Release Packages Internally ##############
  #####################################################
  - local: .ci/apt-internal.gitlab-ci.yml
  #####################################################
  ############## Manual Claude Review #################
  #####################################################
  - component: $CI_SERVER_FQDN/cloudflare/ci/ai/review@~latest
    inputs:
      whenToRun: "manual"
--- a/.golangci.yaml
+++ b/.golangci.yaml
@ -1,89 +0,0 @@
 linters:
  enable:
    # Some of the linters below are commented out. We should uncomment and start running them, but they return
    # too many problems to fix in one commit. Something for later.
    - asasalint        # Check for pass []any as any in variadic func(...any).
    - asciicheck       # Checks that all code identifiers does not have non-ASCII symbols in the name.
    - bidichk          # Checks for dangerous unicode character sequences.
    - bodyclose        # Checks whether HTTP response body is closed successfully.
    - decorder         # Check declaration order and count of types, constants, variables and functions.
    - dogsled          # Checks assignments with too many blank identifiers (e.g. x, , , _, := f()).
    - dupl             # Tool for code clone detection.
    - dupword          # Checks for duplicate words in the source code.
    - durationcheck    # Check for two durations multiplied together.
    - errcheck         # Errcheck is a program for checking for unchecked errors in Go code. These unchecked errors can be critical bugs in some cases.
    - errname          # Checks that sentinel errors are prefixed with the Err and error types are suffixed with the Error.
    - exhaustive       # Check exhaustiveness of enum switch statements.
    - gofmt            # Gofmt checks whether code was gofmt-ed. By default this tool runs with -s option to check for code simplification.
    - goimports        # Check import statements are formatted according to the 'goimport' command. Reformat imports in autofix mode.
    - gosec            # Inspects source code for security problems.
    - gosimple         # Linter for Go source code that specializes in simplifying code.
    - govet            # Vet examines Go source code and reports suspicious constructs. It is roughly the same as 'go vet' and uses its passes.
    - ineffassign      # Detects when assignments to existing variables are not used.
    - importas         # Enforces consistent import aliases.
    - misspell         # Finds commonly misspelled English words.
    - prealloc         # Finds slice declarations that could potentially be pre-allocated.
    - promlinter       # Check Prometheus metrics naming via promlint.
    - sloglint         # Ensure consistent code style when using log/slog.
    - sqlclosecheck    # Checks that sql.Rows, sql.Stmt, sqlx.NamedStmt, pgx.Query are closed.
    - staticcheck      # It's a set of rules from staticcheck. It's not the same thing as the staticcheck binary.
    - usetesting       # Reports uses of functions with replacement inside the testing package.
    - testableexamples # Linter checks if examples are testable (have an expected output).
    - testifylint      # Checks usage of github.com/stretchr/testify.
    - tparallel        # Tparallel detects inappropriate usage of t.Parallel() method in your Go test codes.
    - unconvert        # Remove unnecessary type conversions.
    - unused           # Checks Go code for unused constants, variables, functions and types.
    - wastedassign     # Finds wasted assignment statements.
    - whitespace       # Whitespace is a linter that checks for unnecessary newlines at the start and end of functions, if, for, etc.
    - zerologlint      # Detects the wrong usage of zerolog that a user forgets to dispatch with Send or Msg.
  # Other linters are disabled, list of all is here: https://golangci-lint.run/usage/linters/
 run:
  timeout: 5m
  modules-download-mode: vendor
 # output configuration options
 output:
  formats:
    - format: 'colored-line-number'
  print-issued-lines: true
  print-linter-name: true
 issues:
  # Maximum issues count per one linter.
  # Set to 0 to disable.
  # Default: 50
  max-issues-per-linter: 50
  # Maximum count of issues with the same text.
  # Set to 0 to disable.
  # Default: 3
  max-same-issues: 15
  # Show only new issues: if there are unstaged changes or untracked files,
  # only those changes are analyzed, else only changes in HEAD~ are analyzed.
  # It's a super-useful option for integration of golangci-lint into existing large codebase.
  # It's not practical to fix all existing issues at the moment of integration:
  # much better don't allow issues in new code.
  #
  # Default: false
  new: true
  # Show only new issues created after git revision `REV`.
  # Default: ""
  new-from-rev: ac34f94d423273c8fa8fdbb5f2ac60e55f2c77d5
  # Show issues in any part of update files (requires new-from-rev or new-from-patch).
  # Default: false
  whole-files: true
  # Which dirs to exclude: issues from them won't be reported.
  # Can use regexp here: `generated.*`, regexp is applied on full path,
  # including the path prefix if one is set.
  # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default).
  # "/" will be replaced by current OS file path separator to properly work on Windows.
  # Default: []
  exclude-dirs:
    - vendor
 linters-settings:
  # Check exhaustiveness of enum switch statements.
  exhaustive:
    # Presence of "default" case in switch statements satisfies exhaustiveness,
    # even if all enum members are not listed.
    # Default: false
    default-signifies-exhaustive: true
--- a/.teamcity/build-macos.sh
+++ b/.teamcity/build-macos.sh
@ -0,0 +1,187 @@
 #!/bin/bash
 if [[ "$(uname)" != "Darwin" ]] ; then
    echo "This should be run on macOS"
    exit 1
 fi
 go version
 export GO111MODULE=on
 # build 'cloudflared-darwin-amd64.tgz'
 mkdir -p artifacts
 FILENAME="$(pwd)/artifacts/cloudflared-darwin-amd64.tgz"
 PKGNAME="$(pwd)/artifacts/cloudflared-amd64.pkg"
 TARGET_DIRECTORY=".build"
 BINARY_NAME="cloudflared"
 VERSION=$(git describe --tags --always --dirty="-dev")
 PRODUCT="cloudflared"
 CODE_SIGN_PRIV="code_sign.p12"
 CODE_SIGN_CERT="code_sign.cer"
 INSTALLER_PRIV="installer.p12"
 INSTALLER_CERT="installer.cer"
 BUNDLE_ID="com.cloudflare.cloudflared"
 SEC_DUP_MSG="security: SecKeychainItemImport: The specified item already exists in the keychain."
 export PATH="$PATH:/usr/local/bin"
 mkdir -p ../src/github.com/cloudflare/    
 cp -r . ../src/github.com/cloudflare/cloudflared
 cd ../src/github.com/cloudflare/cloudflared 
 GOCACHE="$PWD/../../../../" GOPATH="$PWD/../../../../" CGO_ENABLED=1 make cloudflared
 # Add code signing private key to the key chain
 if [[ ! -z "$CFD_CODE_SIGN_KEY" ]]; then
  if [[ ! -z "$CFD_CODE_SIGN_PASS" ]]; then
    # write private key to disk and then import it keychain
    echo -n -e ${CFD_CODE_SIGN_KEY} | base64 -D > ${CODE_SIGN_PRIV}
    out=$(security import ${CODE_SIGN_PRIV} -A -P "${CFD_CODE_SIGN_PASS}" 2>&1)
    exitcode=$?
    if [ -n "$out" ]; then
      if [ $exitcode -eq 0 ]; then
          echo "$out"
      else
          if [ "$out" != "${SEC_DUP_MSG}" ]; then
              echo "$out" >&2
              exit $exitcode
          fi
      fi
    fi
    rm ${CODE_SIGN_PRIV}
  fi
 fi
 # Add code signing certificate to the key chain
 if [[ ! -z "$CFD_CODE_SIGN_CERT" ]]; then
  # write certificate to disk and then import it keychain
  echo -n -e ${CFD_CODE_SIGN_CERT} | base64 -D > ${CODE_SIGN_CERT}
  out1=$(security import ${CODE_SIGN_CERT} -A 2>&1)
  exitcode1=$?
  if [ -n "$out1" ]; then
    if [ $exitcode1 -eq 0 ]; then
        echo "$out1"
    else
        if [ "$out1" != "${SEC_DUP_MSG}" ]; then
            echo "$out1" >&2
            exit $exitcode1
        else 
            echo "already imported code signing certificate"
        fi
    fi
  fi
  rm ${CODE_SIGN_CERT}
 fi
 # Add package signing private key to the key chain
 if [[ ! -z "$CFD_INSTALLER_KEY" ]]; then
  if [[ ! -z "$CFD_INSTALLER_PASS" ]]; then
    # write private key to disk and then import it into the keychain
    echo -n -e ${CFD_INSTALLER_KEY} | base64 -D > ${INSTALLER_PRIV}
    out2=$(security import ${INSTALLER_PRIV} -A -P "${CFD_INSTALLER_PASS}" 2>&1)
    exitcode2=$?
    if [ -n "$out2" ]; then
      if [ $exitcode2 -eq 0 ]; then
          echo "$out2"
      else
          if [ "$out2" != "${SEC_DUP_MSG}" ]; then
              echo "$out2" >&2
              exit $exitcode2
          fi
      fi
    fi
    rm ${INSTALLER_PRIV}
  fi
 fi
 # Add package signing certificate to the key chain
 if [[ ! -z "$CFD_INSTALLER_CERT" ]]; then
  # write certificate to disk and then import it keychain
  echo -n -e ${CFD_INSTALLER_CERT} | base64 -D > ${INSTALLER_CERT}
  out3=$(security import ${INSTALLER_CERT} -A 2>&1)
  exitcode3=$?
  if [ -n "$out3" ]; then
    if [ $exitcode3 -eq 0 ]; then
        echo "$out3"
    else
        if [ "$out3" != "${SEC_DUP_MSG}" ]; then
            echo "$out3" >&2
            exit $exitcode3
        else 
            echo "already imported installer certificate"
        fi
    fi
  fi
  rm ${INSTALLER_CERT}
 fi
 # get the code signing certificate name
 if [[ ! -z "$CFD_CODE_SIGN_NAME" ]]; then
  CODE_SIGN_NAME="${CFD_CODE_SIGN_NAME}"
 else
  if [[ -n "$(security find-certificate -c "Developer ID Application" | cut -d'"' -f 4 -s | grep "Developer ID Application:" | head -1)" ]]; then
    CODE_SIGN_NAME=$(security find-certificate -c "Developer ID Application" | cut -d'"' -f 4 -s | grep "Developer ID Application:" | head -1)
  else
    CODE_SIGN_NAME=""
  fi
 fi
 # get the package signing certificate name
 if [[ ! -z "$CFD_INSTALLER_NAME" ]]; then
  PKG_SIGN_NAME="${CFD_INSTALLER_NAME}"
 else
  if [[ -n "$(security find-certificate -c "Developer ID Installer" | cut -d'"' -f 4 -s | grep "Developer ID Installer:" | head -1)" ]]; then
    PKG_SIGN_NAME=$(security find-certificate -c "Developer ID Installer" | cut -d'"' -f 4 -s | grep "Developer ID Installer:" | head -1)
  else
    PKG_SIGN_NAME=""
  fi
 fi
 # sign the cloudflared binary
 if [[ ! -z "$CODE_SIGN_NAME" ]]; then
  codesign -s "${CODE_SIGN_NAME}" -f -v --timestamp --options runtime ${BINARY_NAME}
  # notarize the binary
  if [[ ! -z "$CFD_NOTE_PASSWORD" ]]; then
    zip "${BINARY_NAME}.zip" ${BINARY_NAME} 
    xcrun altool --notarize-app -f "${BINARY_NAME}.zip" -t osx -u ${CFD_NOTE_USERNAME} -p ${CFD_NOTE_PASSWORD} --primary-bundle-id ${BUNDLE_ID}
  fi
 fi
 # creating build directory
 rm -rf $TARGET_DIRECTORY
 mkdir "${TARGET_DIRECTORY}"
 mkdir "${TARGET_DIRECTORY}/contents"
 cp -r ".mac_resources/scripts" "${TARGET_DIRECTORY}/scripts"
 # copy cloudflared into the build directory
 cp ${BINARY_NAME} "${TARGET_DIRECTORY}/contents/${PRODUCT}"
 # compress cloudflared into a tar and gzipped file
 tar czf "$FILENAME" "${BINARY_NAME}"
 # build the installer package
 if [[ ! -z "$PKG_SIGN_NAME" ]]; then
  pkgbuild --identifier com.cloudflare.${PRODUCT} \
      --version ${VERSION} \
      --scripts ${TARGET_DIRECTORY}/scripts \
      --root ${TARGET_DIRECTORY}/contents \
      --install-location /usr/local/bin \
      --sign "${PKG_SIGN_NAME}" \
      ${PKGNAME}
      # notarize the package
      if [[ ! -z "$CFD_NOTE_PASSWORD" ]]; then
        xcrun altool --notarize-app -f ${PKGNAME} -t osx -u ${CFD_NOTE_USERNAME} -p ${CFD_NOTE_PASSWORD} --primary-bundle-id ${BUNDLE_ID}
        xcrun stapler staple ${PKGNAME}
      fi
 else
    pkgbuild --identifier com.cloudflare.${PRODUCT} \
      --version ${VERSION} \
      --scripts ${TARGET_DIRECTORY}/scripts \
      --root ${TARGET_DIRECTORY}/contents \
      --install-location /usr/local/bin \
      ${PKGNAME}
 fi
 # cleaning up the build directory
 rm -rf $TARGET_DIRECTORY
--- a/.teamcity/update-homebrew.sh
+++ b/.teamcity/update-homebrew.sh
@ -0,0 +1,67 @@
 #!/bin/bash
 set -euo pipefail
 FILENAME="${PWD}/artifacts/cloudflared-darwin-amd64.tgz"
 if ! VERSION="$(git describe --tags --exact-match 2>/dev/null)" ; then
    echo "Skipping public release for an untagged commit."
    echo "##teamcity[buildStatus status='SUCCESS' text='Skipped due to lack of tag']"
    exit 0
 fi
 if [[ ! -f "$FILENAME" ]] ; then
    echo "Missing $FILENAME"
    exit 1
 fi
 if [[ "${GITHUB_PRIVATE_KEY:-}" == "" ]] ; then
    echo "Missing GITHUB_PRIVATE_KEY"
    exit 1
 fi
 # upload to s3 bucket for use by Homebrew formula
 s3cmd \
    --acl-public --signature-v2 --access_key="$AWS_ACCESS_KEY_ID" --secret_key="$AWS_SECRET_ACCESS_KEY" --host-bucket="%(bucket)s.s3.cfdata.org" \
    put "$FILENAME" "s3://cftunnel-docs/dl/cloudflared-$VERSION-darwin-amd64.tgz"
 s3cmd \
    --acl-public --signature-v2 --access_key="$AWS_ACCESS_KEY_ID" --secret_key="$AWS_SECRET_ACCESS_KEY" --host-bucket="%(bucket)s.s3.cfdata.org" \
    cp "s3://cftunnel-docs/dl/cloudflared-$VERSION-darwin-amd64.tgz" "s3://cftunnel-docs/dl/cloudflared-stable-darwin-amd64.tgz"
 SHA256=$(sha256sum "$FILENAME" | cut -b1-64)
 # set up git (note that UserKnownHostsFile is an absolute path so we can cd wherever)
 mkdir -p tmp
 ssh-keyscan -t rsa github.com > tmp/github.txt
 echo "$GITHUB_PRIVATE_KEY" > tmp/private.key
 chmod 0400 tmp/private.key
 export GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=$PWD/tmp/github.txt -i $PWD/tmp/private.key -o IdentitiesOnly=yes"
 # clone Homebrew repo into tmp/homebrew-cloudflare
 git clone git@github.com:cloudflare/homebrew-cloudflare.git tmp/homebrew-cloudflare    
 cd tmp/homebrew-cloudflare
 git checkout -f master
 git reset --hard origin/master
 # modify cloudflared.rb
 URL="https://packages.argotunnel.com/dl/cloudflared-$VERSION-darwin-amd64.tgz"
 tee cloudflared.rb <<EOF
 class Cloudflared < Formula
  desc 'Cloudflare Tunnel'
  homepage 'https://developers.cloudflare.com/cloudflare-one/connections/connect-apps'
  url '$URL'
  sha256 '$SHA256'
  version '$VERSION'
  def install
    bin.install 'cloudflared'
  end
 end
 EOF
 # push cloudflared.rb
 git add cloudflared.rb
 git diff
 git config user.name "cloudflare-warp-bot"
 git config user.email "warp-bot@cloudflare.com"
 git commit -m "Release Cloudflare Tunnel $VERSION"
 git push -v origin master
--- a/.vulnignore
+++ b/.vulnignore
@ -1,3 +0,0 @@
 # Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line.
 # You can also add comments on the same line after the ID.
 GO-2025-3942 # Ignore core-dns vulnerability since we will be removing the proxy-dns feature in the near future
--- a/CHANGES.md
+++ b/CHANGES.md
@ -1,176 +1,4 @@
-## 2025.7.1
+**Experimental**: This is a new format for release notes. The format and availability is subject to change.
 ### Notices
 - `cloudflared` will no longer officially support Debian and Ubuntu distros that reached end-of-life: `buster`, `bullseye`, `impish`, `trusty`.
 ## 2025.1.1
 ### New Features
 - This release introduces the use of new Post Quantum curves and the ability to use Post Quantum curves when running tunnels with the QUIC protocol this applies to non-FIPS and FIPS builds.
 ## 2024.12.2
 ### New Features
 - This release introduces the ability to collect troubleshooting information from one instance of cloudflared running on the local machine. The command can be executed as `cloudflared tunnel diag`.
 ## 2024.12.1
 ### Notices
 - The use of the `--metrics` is still honoured meaning that if this flag is set the metrics server will try to bind it, however, this version includes a change that makes the metrics server bind to a port with a semi-deterministic approach. If the metrics flag is not present the server will bind to the first available port of the range 20241 to 20245. In case of all ports being unavailable then the fallback is to bind to a random port.
 ## 2024.10.0
 ### Bug Fixes
 - We fixed a bug related to `--grace-period`. Tunnels that use QUIC as transport weren't abiding by this waiting period before forcefully closing the connections to the edge. From now on, both QUIC and HTTP2 tunnels will wait for either the grace period to end (defaults to 30 seconds) or until the last in-flight request is handled. Users that wish to maintain the previous behavior should set `--grace-period` to 0 if `--protocol` is set to `quic`. This will force `cloudflared` to shutdown as soon as either SIGTERM or SIGINT is received.
 ## 2024.2.1
 ### Notices
 - Starting from this version, tunnel diagnostics will be enabled by default. This will allow the engineering team to remotely get diagnostics from cloudflared during debug activities. Users still have the capability to opt-out of this feature by defining `--management-diagnostics=false` (or env `TUNNEL_MANAGEMENT_DIAGNOSTICS`).
 ## 2023.9.0
 ### Notices
 - The `warp-routing` `enabled: boolean` flag is no longer supported in the configuration file. Warp Routing traffic (eg TCP, UDP, ICMP) traffic is proxied to cloudflared if routes to the target tunnel are configured. This change does not affect remotely managed tunnels, but for locally managed tunnels, users that might be relying on this feature flag to block traffic should instead guarantee that tunnel has no Private Routes configured for the tunnel.
 ## 2023.7.0
 ### New Features
 - You can now enable additional diagnostics over the management.argotunnel.com service for your active cloudflared connectors via a new runtime flag `--management-diagnostics` (or env `TUNNEL_MANAGEMENT_DIAGNOSTICS`). This feature is provided as opt-in and requires the flag to enable. Endpoints such as /metrics provides your prometheus metrics endpoint another mechanism to be reached. Additionally /debug/pprof/(goroutine|heap) are also introduced to allow for remotely retrieving active pprof information from a running cloudflared connector.
 ## 2023.4.1
 ### New Features
 - You can now stream your logs from your remote cloudflared to your local terminal with `cloudflared tail <TUNNEL-ID>`. This new feature requires the remote cloudflared to be version 2023.4.1 or higher.
 ## 2023.3.2
 ### Notices
 - Due to the nature of QuickTunnels (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/do-more-with-tunnels/trycloudflare/) and its intended usage for testing and experiment of Cloudflare Tunnels, starting from 2023.3.2, QuickTunnels only make a single connection to the edge. If users want to use Tunnels in a production environment, they should move to Named Tunnels instead. (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/remote/#set-up-a-tunnel-remotely-dashboard-setup)
 ## 2023.3.1
 ### Breaking Change
 - Running a tunnel without ingress rules defined in configuration file nor from the CLI flags will no longer provide a default ingress rule to localhost:8080 and instead will return HTTP response code 503 for all incoming HTTP requests.
 ### Security Fixes
 - Windows 32 bit machines MSI now defaults to Program Files to install cloudflared. (See CVE-2023-1314). The cloudflared client itself is unaffected. This just changes how the installer works on 32 bit windows machines.
 ### Bug Fixes
 - Fixed a bug that would cause running tunnel on Bastion mode and without ingress rules to crash.
 ## 2023.2.2
 ### Notices
 - Legacy tunnels were officially deprecated on December 1, 2022. Starting with this version, cloudflared no longer supports connecting legacy tunnels.
 - h2mux tunnel connection protocol is no longer supported. Any tunnels still configured to use this protocol will alert and use http2 tunnel protocol instead. We recommend using quic protocol for all tunnels going forward.
 ## 2023.2.1
 ### Bug fixes
 - Fixed a bug in TCP connection proxy that could result in the connection being closed before all data was written.
 - cloudflared now correctly aborts body write if connection to origin service fails after response headers were sent already.
 - Fixed a bug introduced in the previous release where debug endpoints were removed.
 ## 2022.12.0
 ### Improvements
 - cloudflared now attempts to try other edge addresses before falling back to a lower protocol.
 - cloudflared tunnel no longer spins up a quick tunnel. The call has to be explicit and provide a --url flag.
 - cloudflared will now randomly pick the first or second region to connect to instead of always connecting to region2 first.
 ## 2022.9.0
 ### New Features
 - cloudflared now rejects ingress rules with invalid http status codes for http_status.
 ## 2022.8.1
 ### New Features
 - cloudflared now remembers if it connected to a certain protocol successfully. If it did, it does not fall back to a lower
  protocol on connection failures.
 ## 2022.7.1
 ### New Features
 - It is now possible to connect cloudflared tunnel to Cloudflare Global Network with IPv6. See `cloudflared tunnel --help` and look for `edge-ip-version` for more information. For now, the default behavior is to still connect with IPv4 only.
 ### Bug Fixes
 - Several bug fixes related with QUIC transport (used between cloudflared tunnel and Cloudflare Global Network). Updating to this version is highly recommended.
 ## 2022.4.0
 ### Bug Fixes
 - `cloudflared tunnel run` no longer logs the Tunnel token or JSON credentials in clear text as those are the secret
 that allows to run the Tunnel.
 ## 2022.3.4
 ### New Features
 - It is now possible to retrieve the credentials that allow to run a Tunnel in case you forgot/lost them. This is
 achievable with: `cloudflared tunnel token --cred-file /path/to/file.json TUNNEL`. This new feature only works for
 Tunnels created with cloudflared version 2022.3.0 or more recent.
 ### Bug Fixes
 - `cloudflared service install` now starts the underlying agent service on Linux operating system (similarly to the
 behaviour in Windows and MacOS).
 ## 2022.3.3
 ### Bug Fixes
 - `cloudflared service install` now starts the underlying agent service on Windows operating system (similarly to the
 behaviour in MacOS).
 ## 2022.3.1
 ### Bug Fixes
 - Various fixes to the reliability of `quic` protocol, including an edge case that could lead to cloudflared crashing.
 ## 2022.3.0
 ### New Features
 - It is now possible to configure Ingress Rules to point to an origin served by unix socket with either HTTP or HTTPS.
 If the origin starts with `unix:/` then we assume HTTP (existing behavior). Otherwise, the origin can start with
 `unix+tls:/` for HTTPS.
 ## 2022.2.1
 ### New Features
 - This project now has a new LICENSE that is more compliant with open source purposes.
 ### Bug Fixes
 - Various fixes to the reliability of `quic` protocol.
 ## 2022.1.3
 ### New Features
 - New `cloudflared tunnel vnet` commands to allow for private routing to be virtualized. This means that the same CIDR
 can now be used to point to two different Tunnels with `cloudflared tunnel route ip` command. More information will be
 made available on blog.cloudflare.com and developers.cloudflare.com/cloudflare-one once the feature is globally available.
 ### Bug Fixes
 - Correctly handle proxying UDP datagrams with no payload.
 - Bug fix for origins that use Server-Sent Events (SSE).
 ## 2022.1.0
 ### Improvements
 - If a specific `protocol` property is defined (e.g. for `quic`), cloudflared no longer falls back to an older protocol
 (such as `http2`) in face of connectivity errors. This is important because some features are only supported in a specific
 protocol (e.g. UDP proxying only works for `quic`). Hence, if a user chooses a protocol, cloudflared now adheres to it
 no matter what.
 ### Bug Fixes
 - Stopping cloudflared running with `quic` protocol now respects graceful shutdown.
 ## 2021.12.2
 ### Bug Fixes
 - Fix logging when `quic` transport is used and UDP traffic is proxied.
 - FIPS compliant cloudflared binaries will now be released as separate artifacts. Recall that these are only for linux
 and amd64.
 ## 2021.12.1
 ### Bug Fixes
 - Fixes Github issue #530 where cloudflared 2021.12.0 could not reach origins that were HTTPS and using certain encryption
 methods forbidden by FIPS compliance (such as Let's Encrypt certificates). To address this fix we have temporarily reverted
 FIPS compliance from amd64 linux binaries that was recently introduced (or fixed actually as it was never working before).
 ## 2021.12.0
 ### New Features
 - Cloudflared binary released for amd64 linux is now FIPS compliant.
 ### Improvements
 - Logging about connectivity to Cloudflare edge now only yields `ERR` level logging if there are no connections to
 Cloudflare edge that are active. Otherwise it logs `WARN` level.
 ### Bug Fixes
 - Fixes Github issue #501.
 ## 2021.11.0
 ### Improvements
 - Fallback from `protocol:quic` to `protocol:http2` immediately if UDP connectivity isn't available. This could be because of a firewall or 
 egress rule.
 ## 2021.10.4
 ### Improvements
 - Collect quic transport metrics on RTT, packets and bytes transferred.
 ### Bug Fixes
 - Fix race condition that was writing to the connection after the http2 handler returns.
 ## 2021.9.2
--- a/23
+++ b/23
@ -1,15 +1,11 @@
 # use a builder image for building cloudflare
 ARG TARGET_GOOS
 ARG TARGET_GOARCH
-FROM golang:1.24.9 AS builder
+FROM golang:1.17.1 as builder
 ENV GO111MODULE=on \
-  CGO_ENABLED=0 \
+    CGO_ENABLED=0 \
-  TARGET_GOOS=${TARGET_GOOS} \
+    TARGET_GOOS=${TARGET_GOOS} \
-  TARGET_GOARCH=${TARGET_GOARCH} \
+    TARGET_GOARCH=${TARGET_GOARCH}
  # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual
  # which changes how cloudflared binds the metrics server
  CONTAINER_BUILD=1
 WORKDIR /go/src/github.com/cloudflare/cloudflared/
@ -20,18 +16,13 @@ COPY . .
 RUN make cloudflared
 # use a distroless base image with glibc
-FROM gcr.io/distroless/base-debian12:nonroot
+FROM gcr.io/distroless/base-debian10:nonroot
 LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"
 # copy our compiled binary
 COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/
-# run as nonroot user
+# run as non-privileged user
-# We need to use numeric user id's because Kubernetes doesn't support strings:
+USER nonroot
 # https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49
 # The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18
 USER 65532:65532
 # command / entrypoint of container
 ENTRYPOINT ["cloudflared", "--no-autoupdate"]
--- a/Dockerfile.amd64
+++ b/Dockerfile.amd64
@ -1,33 +0,0 @@
 # use a builder image for building cloudflare
 FROM golang:1.24.9 AS builder
 ENV GO111MODULE=on \
  CGO_ENABLED=0 \
  # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual
  # which changes how cloudflared binds the metrics server
  CONTAINER_BUILD=1 
 WORKDIR /go/src/github.com/cloudflare/cloudflared/
 # copy our sources into the builder image
 COPY . .
 # compile cloudflared
 RUN GOOS=linux GOARCH=amd64 make cloudflared
 # use a distroless base image with glibc
 FROM gcr.io/distroless/base-debian12:nonroot
 LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"
 # copy our compiled binary
 COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/
 # run as nonroot user
 # We need to use numeric user id's because Kubernetes doesn't support strings:
 # https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49
 # The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18
 USER 65532:65532
 # command / entrypoint of container
 ENTRYPOINT ["cloudflared", "--no-autoupdate"]
 CMD ["version"]
--- a/Dockerfile.arm64
+++ b/Dockerfile.arm64
@ -1,33 +0,0 @@
 # use a builder image for building cloudflare
 FROM golang:1.24.9 AS builder
 ENV GO111MODULE=on \
  CGO_ENABLED=0 \
  # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual
  # which changes how cloudflared binds the metrics server
  CONTAINER_BUILD=1
 WORKDIR /go/src/github.com/cloudflare/cloudflared/
 # copy our sources into the builder image
 COPY . .
 # compile cloudflared
 RUN GOOS=linux GOARCH=arm64 make cloudflared
 # use a distroless base image with glibc
 FROM gcr.io/distroless/base-debian12:nonroot-arm64
 LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"
 # copy our compiled binary
 COPY --from=builder --chown=nonroot /go/src/github.com/cloudflare/cloudflared/cloudflared /usr/local/bin/
 # run as nonroot user
 # We need to use numeric user id's because Kubernetes doesn't support strings:
 # https://github.com/kubernetes/kubernetes/blob/v1.33.2/pkg/kubelet/kuberuntime/security_context_others.go#L49
 # The `nonroot` user maps to `65532`, from: https://github.com/GoogleContainerTools/distroless/blob/main/common/variables.bzl#L18
 USER 65532:65532
 # command / entrypoint of container
 ENTRYPOINT ["cloudflared", "--no-autoupdate"]
 CMD ["version"]
--- a/313
+++ b/313
@ -1,202 +1,155 @@
 SERVICES AGREEMENT
-                                 Apache License
+Your installation of this software is symbol of your signature indicating that
-                           Version 2.0, January 2004
+you accept the terms of this Services Agreement (this "Agreement").  This
-                        http://www.apache.org/licenses/
+Agreement is a legal agreement between you (either an individual or a single
 entity) and CloudFlare, Inc. for the services being provided to you by
 CloudFlare or its authorized representative (the "Services"), including any
 computer software and any associated media, printed materials, and "online" or
 electronic documentation provided in connection with the Services (the
 "Software" and together with the Services are hereinafter collectively referred
 to as the "Solution").  If the user is not an individual, then "you" means your
 company, its officers, members, employees, agents, representatives, successors
 and assigns.  BY USING THE SOLUTION, YOU ARE INDICATING THAT YOU HAVE READ, AND
 AGREE TO BE BOUND BY, THE POLICIES, TERMS, AND CONDITIONS SET FORTH BELOW IN
 THEIR ENTIRETY WITHOUT LIMITATION OR QUALIFICATION, AS WELL AS BY ALL APPLICABLE
 LAWS AND REGULATIONS, AS IF YOU HAD HANDWRITTEN YOUR NAME ON A CONTRACT.  IF YOU
 DO NOT AGREE TO THESE TERMS AND CONDITIONS, YOU MAY NOT USE THE SOLUTION.
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+1.    GRANT OF RIGHTS
-   1. Definitions.
+1.1	Grant of License.  The Solution is licensed by CloudFlare and its
 licensors, not sold.  Subject to the terms and conditions of this Agreement,
 CloudFlare hereby grants you a nonexclusive, nonsublicensable, nontransferable
 license to use the Solution.  You may examine source code, if provided to you,
 solely for the limited purpose of evaluating the Software for security flaws.
 You may also use the Service to create derivative works which are exclusively
 compatible with any CloudFlare product serviceand no other product or service.
 This license applies to the parts of the Solution developed by CloudFlare.  The
 Solution may also incorporate externally maintained libraries and other open software.
 These resources may be governed by other licenses.
-      "License" shall mean the terms and conditions for use, reproduction,
+1.2	Restrictions.  The license granted herein is granted solely to you and
-      and distribution as defined by Sections 1 through 9 of this document.
+not, by implication or otherwise, to any of your parents, subsidiaries or
 affiliates.  No right is granted hereunder to use the Solution to perform
 services for third parties. All rights not expressly granted hereunder are
 reserved to CloudFlare.  You may not use the Solution except as explicitly
 permitted under this Agreement.  You are expressly prohibited from modifying,
 adapting, translating, preparing derivative works from, decompiling, reverse
 engineering, disassembling or otherwise attempting to derive source code from
 the Software used to provide the Services or any internal data files generated
 by the Solution.  You are also prohibited from removing, obscuring or altering
 any copyright notice, trademarks, or other proprietary rights notices affixed to
 or associated with the Solution.
-      "Licensor" shall mean the copyright owner or entity authorized by
+1.3	Ownership.  As between the parties, CloudFlare and/or its licensors own
-      the copyright owner that is granting the License.
+and shall retain all right, title, and interest in and to the Solution,
 including any and all technology embodied therein, including all copyrights,
 patents, trade secrets, trade dress and other proprietary rights associated
 therewith, and any derivative works created there from.
-      "Legal Entity" shall mean the union of the acting entity and all
+2.	LIMITATION OF LIABILITY
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.
-      "You" (or "Your") shall mean an individual or Legal Entity
+YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT DOWNLOADING THE SOFTWARE IS AT YOUR
-      exercising permissions granted by this License.
+SOLE RISK.  THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTY OF ANY KIND
 AND CLOUDFLARE, ITS LICENSORS AND ITS AUTHORIZED REPRESENTATIVES (TOGETHER FOR
 PURPOSES HEREOF, "CLOUDFLARE") EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS OR
 IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  CLOUDFLARE DOES NOT
 WARRANT THAT THE FUNCTIONS CONTAINED IN THE SOFTWARE WILL MEET YOUR
 REQUIREMENTS, OR THAT THE OPERATION OF THE SOFTWARE WILL BE UNINTERRUPTED OR
 ERROR-FREE, OR THAT DEFECTS IN THE SOFTWARE WILL BE CORRECTED.  FURTHERMORE,
 CLOUDFLARE DOES NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE SOFTWARE
 OR RELATED DOCUMENTATION IN TERMS OF THEIR CORRECTNESS, ACCURACY, RELIABILITY,
 OR OTHERWISE. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY CLOUDFLARE SHALL
 CREATE A WARRANTY OR IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY.
-      "Source" form shall mean the preferred form for making modifications,
+3.	CONFIDENTIALITY
      including but not limited to software source code, documentation
      source, and configuration files.
-      "Object" form shall mean any form resulting from mechanical
+It may be necessary during the set up and performance of the Solution for the
-      transformation or translation of a Source form, including but
+parties to exchange Confidential Information. "Confidential Information" means
-      not limited to compiled object code, generated documentation,
+any information whether oral, or written, of a private, secret, proprietary or
-      and conversions to other media types.
+confidential nature, concerning either party or its business operations,
 including without limitation: (a) your data and (b) CloudFlare's access control
 systems, specialized network equipment and techniques related to the Solution,
 use policies, which include trade secrets of CloudFlare and its licensors. Each
 party agrees to use the same degree of care to protect the confidentiality of
 the Confidential Information of the other party and to prevent its unauthorized
 use or dissemination as it uses to protect its own Confidential Information of a
 similar nature, but in no event shall exercise less than due diligence and
 reasonable care. Each party agrees to use the Confidential Information of the
 other party only for purposes related to the performance of this Agreement. All
 Confidential Information remains the property of the party disclosing the
 information and no license or other rights to Confidential Information is
 granted or implied hereby.
-      "Work" shall mean the work of authorship, whether in Source or
+4.	TERM AND TERMINATION
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).
-      "Derivative Works" shall mean any work, whether in Source or Object
+4.1	Term.  This Agreement shall be effective upon download or install of the
-      form, that is based on (or derived from) the Work and for which the
+Software.
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.
-      "Contribution" shall mean any work of authorship, including
+4.2	Termination. This Agreement may be terminated by CloudFlare or its
-      the original version of the Work and any modifications or additions
+authorized representative by written notice to you if any of the following
-      to that Work or Derivative Works thereof, that is intentionally
+events occur:  (i) you fail to pay any amounts due for the Services and the
-      submitted to Licensor for inclusion in the Work by the copyright owner
+Solution when due and after written notice of such nonpayment has been given to
-      or by an individual or Legal Entity authorized to submit on behalf of
+you; (ii) you are in material breach of any term, condition, or provision of
-      the copyright owner. For the purposes of this definition, "submitted"
+this Agreement or any other agreement executed by you with CloudFlare or its
-      means any form of electronic, verbal, or written communication sent
+authorized representative in connection with the provision of the Solution and
-      to the Licensor or its representatives, including but not limited to
+Services (a "Related Agreement"); or (iii) you terminate or suspend your
-      communication on electronic mailing lists, source code control systems,
+business, becomes subject to any bankruptcy or insolvency proceeding under
-      and issue tracking systems that are managed by, or on behalf of, the
+federal or state statutes, or become insolvent or subject to direct control by a
-      Licensor for the purpose of discussing and improving the Work, but
+trustee, receiver or similar authority.
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."
-      "Contributor" shall mean Licensor and any individual or Legal Entity
+4.3	Effect of Termination.  Upon the termination of this Agreement for any
-      on behalf of whom a Contribution has been received by Licensor and
+reason: (1) all license rights granted hereunder shall terminate and (2) all
-      subsequently incorporated within the Work.
+Confidential Information shall be returned to the disclosing party or destroyed.
-   2. Grant of Copyright License. Subject to the terms and conditions of
+5.	MISCELLANEOUS
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.
-   3. Grant of Patent License. Subject to the terms and conditions of
+5.1	Assignment.  You may not assign any of your rights or delegate any of
-      this License, each Contributor hereby grants to You a perpetual,
+your obligations under this Agreement, whether by operation of law or otherwise,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+without the prior express written consent of CloudFlare or its authorized
-      (except as stated in this section) patent license to make, have made,
+representative.  Any such assignment without the prior express written consent
-      use, offer to sell, sell, import, and otherwise transfer the Work,
+of CloudFlare or its authorized representative shall be void.  Subject to the
-      where such license applies only to those patent claims licensable
+foregoing, this Agreement will bind and inure to the benefit of the parties,
-      by such Contributor that are necessarily infringed by their
+their respective successors and permitted assigns.
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.
-   4. Redistribution. You may reproduce and distribute copies of the
+5.2	Waiver and Amendment.  No modification, amendment or waiver of any
-      Work or Derivative Works thereof in any medium, with or without
+provision of this Agreement shall be effective unless in writing and signed by
-      modifications, and in Source or Object form, provided that You
+the party to be charged.  No failure or delay by either party in exercising any
-      meet the following conditions:
+right, power, or remedy under this Agreement, except as specifically provided
 herein, shall operate as a waiver of any such right, power or remedy.  Without
 limiting the foregoing, terms and conditions on any purchase orders or similar
 materials submitted by you to CloudFlare or its authorized representative shall
 be of no force or effect.
-      (a) You must give any other recipients of the Work or
+5.3	Governing Law.  This Agreement shall be governed by the laws of the State
-          Derivative Works a copy of this License; and
+of California, USA, excluding conflict of laws and provisions, and excluding the
 United Nations Convention on Contracts for the International Sale of Goods.
-      (b) You must cause any modified files to carry prominent notices
+5.4	Notices.  All notices, demands or consents required or permitted under
-          stating that You changed the files; and
+this Agreement shall be in writing.  Notice shall be sent to you at the e-mail
 address provided by you to CloudFlare or its authorized representative in
 connection with the Solution.
-      (c) You must retain, in the Source form of any Derivative Works
+5.5	Independent Contractors. The parties are independent contractors.
-          that You distribute, all copyright, patent, trademark, and
+Neither party shall be deemed to be an employee, agent, partner or legal
-          attribution notices from the Source form of the Work,
+representative of the other for any purpose and neither shall have any right,
-          excluding those notices that do not pertain to any part of
+power or authority to create any obligation or responsibility on behalf of the
-          the Derivative Works; and
+other.
-      (d) If the Work includes a "NOTICE" text file as part of its
+5.6	Severability.  If any provision of this Agreement is held by a court of
-          distribution, then any Derivative Works that You distribute must
+competent jurisdiction to be contrary to law, such provision shall be changed
-          include a readable copy of the attribution notices contained
+and interpreted so as to best accomplish the objectives of the original
-          within such NOTICE file, excluding those notices that do not
+provision to the fullest extent allowed by law and the remaining provisions of
-          pertain to any part of the Derivative Works, in at least one
+this Agreement shall remain in full force and effect.
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.
-      You may add Your own copyright statement to Your modifications and
+5.7	Force Majeure.  CloudFlare shall not be liable to the other party for any
-      may provide additional or different license terms and conditions
+failure or delay in performance caused by reasons beyond its reasonable control.
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.
-   5. Submission of Contributions. Unless You explicitly state otherwise,
+5.8	Complete Understanding.  This Agreement and the Related Agreement
-      any Contribution intentionally submitted for inclusion in the Work
+constitute the final, complete and exclusive agreement between the parties with
-      by You to the Licensor shall be under the terms and conditions of
+respect to the subject matter hereof, and supersedes all previous written and
-      this License, without any additional terms or conditions.
+oral agreements and communications related to the subject matter of this
-      Notwithstanding the above, nothing herein shall supersede or modify
+Agreement.  To the extent this Agreement and the Related Agreement conflict,
-      the terms of any separate license agreement you may have executed
+this Agreement shall control.
      with Licensor regarding such Contributions.
   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.
   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.
   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
   END OF TERMS AND CONDITIONS
   APPENDIX: How to apply the Apache License to your work.
      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.
   Copyright [yyyy] [name of copyright owner]
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at
       http://www.apache.org/licenses/LICENSE-2.0
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
--- a/335
+++ b/335
@ -1,67 +1,30 @@
-# The targets cannot be run in parallel
+VERSION       := $(shell git describe --tags --always --dirty="-dev" --match "[0-9][0-9][0-9][0-9].*.*")
 .NOTPARALLEL:
 VERSION       := $(shell git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 MSI_VERSION   := $(shell git tag -l --sort=v:refname | grep "w" | tail -1 | cut -c2-)
 #MSI_VERSION expects the format of the tag to be: (wX.X.X). Starts with the w character to not break cfsetup.
 #e.g. w3.0.1 or w4.2.10. It trims off the w character when creating the MSI.
-ifeq ($(ORIGINAL_NAME), true)
+ifeq ($(FIPS), true)
-	# Used for builds that want FIPS compilation but want the artifacts generated to still have the original name.
+	GO_BUILD_TAGS := $(GO_BUILD_TAGS) fips
-	BINARY_NAME := cloudflared
+endif
-else ifeq ($(FIPS), true)
+
-	# Used for FIPS compliant builds that do not match the case above.
+ifneq ($(GO_BUILD_TAGS),)
-	BINARY_NAME := cloudflared-fips
+	GO_BUILD_TAGS := -tags $(GO_BUILD_TAGS)
 else
 	# Used for all other (non-FIPS) builds.
 	BINARY_NAME := cloudflared
 endif
 ifeq ($(NIGHTLY), true)
-	DEB_PACKAGE_NAME := $(BINARY_NAME)-nightly
+	DEB_PACKAGE_NAME := cloudflared-nightly
 	NIGHTLY_FLAGS := --conflicts cloudflared --replaces cloudflared
 else
-	DEB_PACKAGE_NAME := $(BINARY_NAME)
+	DEB_PACKAGE_NAME := cloudflared
 endif
-# Use git in windows since we don't have access to the `date` tool
+DATE          := $(shell date -u '+%Y-%m-%d-%H%M UTC')
-ifeq ($(TARGET_OS), windows)
+VERSION_FLAGS := -ldflags='-X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"'
 	DATE := $(shell git log -1 --format="%ad" --date=format-local:'%Y-%m-%dT%H:%M UTC' -- RELEASE_NOTES)
 else
 	DATE := $(shell date -u -r RELEASE_NOTES '+%Y-%m-%d-%H:%M UTC')
 endif
-VERSION_FLAGS := -X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"
+IMPORT_PATH   := github.com/cloudflare/cloudflared
-ifdef PACKAGE_MANAGER
+PACKAGE_DIR   := $(CURDIR)/packaging
-	VERSION_FLAGS := $(VERSION_FLAGS) -X "github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=$(PACKAGE_MANAGER)"
+INSTALL_BINDIR := /usr/bin/
-endif
+MAN_DIR := /usr/share/man/man1/
 ifdef CONTAINER_BUILD
 	VERSION_FLAGS := $(VERSION_FLAGS) -X "github.com/cloudflare/cloudflared/metrics.Runtime=virtual"
 endif
 LINK_FLAGS :=
 ifeq ($(FIPS), true)
 	LINK_FLAGS := -linkmode=external -extldflags=-static $(LINK_FLAGS)
 	# Prevent linking with libc regardless of CGO enabled or not.
 	GO_BUILD_TAGS := $(GO_BUILD_TAGS) osusergo netgo fips
 	VERSION_FLAGS := $(VERSION_FLAGS) -X "main.BuildType=FIPS"
 endif
 LDFLAGS := -ldflags='$(VERSION_FLAGS) $(LINK_FLAGS)'
 ifneq ($(GO_BUILD_TAGS),)
 	GO_BUILD_TAGS := -tags "$(GO_BUILD_TAGS)"
 endif
 ifeq ($(debug), 1)
 	GO_BUILD_TAGS += -gcflags="all=-N -l"
 endif
 IMPORT_PATH    := github.com/cloudflare/cloudflared
 PACKAGE_DIR    := $(CURDIR)/packaging
 PREFIX         := /usr
 INSTALL_BINDIR := $(PREFIX)/bin/
 INSTALL_MANDIR := $(PREFIX)/share/man/man1/
 LOCAL_ARCH ?= $(shell uname -m)
 ifneq ($(GOARCH),)
@ -70,8 +33,6 @@ else ifeq ($(LOCAL_ARCH),x86_64)
    TARGET_ARCH ?= amd64
 else ifeq ($(LOCAL_ARCH),amd64)
    TARGET_ARCH ?= amd64
 else ifeq ($(LOCAL_ARCH),386)
    TARGET_ARCH ?= 386
 else ifeq ($(LOCAL_ARCH),i686)
    TARGET_ARCH ?= amd64
 else ifeq ($(shell echo $(LOCAL_ARCH) | head -c 5),armv8)
@ -82,8 +43,6 @@ else ifeq ($(LOCAL_ARCH),arm64)
    TARGET_ARCH ?= arm64
 else ifeq ($(shell echo $(LOCAL_ARCH) | head -c 4),armv)
    TARGET_ARCH ?= arm
 else ifeq ($(LOCAL_ARCH),s390x)
    TARGET_ARCH ?= s390x
 else
    $(error This system's architecture $(LOCAL_ARCH) isn't supported)
 endif
@ -97,16 +56,14 @@ else ifeq ($(LOCAL_OS),windows)
    TARGET_OS ?= windows
 else ifeq ($(LOCAL_OS),freebsd)
    TARGET_OS ?= freebsd
 else ifeq ($(LOCAL_OS),openbsd)
    TARGET_OS ?= openbsd
 else
    $(error This system's OS $(LOCAL_OS) isn't supported)
 endif
 ifeq ($(TARGET_OS), windows)
-	EXECUTABLE_PATH=./$(BINARY_NAME).exe
+	EXECUTABLE_PATH=./cloudflared.exe
 else
-	EXECUTABLE_PATH=./$(BINARY_NAME)
+	EXECUTABLE_PATH=./cloudflared
 endif
 ifeq ($(FLAVOR), centos-7)
@ -115,21 +72,6 @@ else
 	TARGET_PUBLIC_REPO ?= $(FLAVOR)
 endif
 ifneq ($(TARGET_ARM), )
 	ARM_COMMAND := GOARM=$(TARGET_ARM)
 endif
 ifeq ($(TARGET_ARM), 7)
 	PACKAGE_ARCH := armhf
 else
 	PACKAGE_ARCH := $(TARGET_ARCH)
 endif
 #for FIPS compliance, FPM defaults to MD5.
 RPM_DIGEST := --rpm-digest sha256
 GO_TEST_LOG_OUTPUT = /tmp/gotest.log
 .PHONY: all
 all: cloudflared test
@ -137,155 +79,188 @@ all: cloudflared test
 clean:
 	go clean
 .PHONY: vulncheck
 vulncheck:
 	@./.ci/scripts/vuln-check.sh
 .PHONY: cloudflared
-cloudflared:
+cloudflared: 
 ifeq ($(FIPS), true)
 	$(info Building cloudflared with go-fips)
 	-test -f fips/fips.go && mv fips/fips.go fips/fips.go.linux-amd64
 	mv fips/fips.go.linux-amd64 fips/fips.go
 endif
-	GOOS=$(TARGET_OS) GOARCH=$(TARGET_ARCH) $(ARM_COMMAND) go build -mod=vendor $(GO_BUILD_TAGS) $(LDFLAGS) $(IMPORT_PATH)/cmd/cloudflared
+
 	GOOS=$(TARGET_OS) GOARCH=$(TARGET_ARCH) go build -v -mod=vendor $(GO_BUILD_TAGS) $(VERSION_FLAGS) $(IMPORT_PATH)/cmd/cloudflared
 ifeq ($(FIPS), true)
-	./check-fips.sh cloudflared
+	mv fips/fips.go fips/fips.go.linux-amd64
 endif
 .PHONY: container
 container:
 	docker build --build-arg=TARGET_ARCH=$(TARGET_ARCH) --build-arg=TARGET_OS=$(TARGET_OS) -t cloudflare/cloudflared-$(TARGET_OS)-$(TARGET_ARCH):"$(VERSION)" .
 .PHONY: generate-docker-version
 generate-docker-version:
 	echo latest $(VERSION) > versions
 .PHONY: test
 test: vet
-	$Q go test -json -v -mod=vendor -race $(LDFLAGS) ./... 2>&1 | tee $(GO_TEST_LOG_OUTPUT)
+ifndef CI
-ifneq ($(FIPS), true)
+	go test -v -mod=vendor -race $(VERSION_FLAGS) ./...
-	@go run -mod=readonly github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@latest -input $(GO_TEST_LOG_OUTPUT)
+else
 	@mkdir -p .cover
 	go test -v -mod=vendor -race $(VERSION_FLAGS) -coverprofile=".cover/c.out" ./...
 	go tool cover -html ".cover/c.out" -o .cover/all.html
 endif
-.PHONY: cover
+.PHONY: test-ssh-server
-cover:
+test-ssh-server:
-	@echo ""
+	docker-compose -f ssh_server_tests/docker-compose.yml up
 	@echo "=====> Total test coverage: <====="
 	@echo ""
 	# Print the overall coverage here for quick access.
 	$Q go tool cover -func ".cover/c.out" | grep "total:" | awk '{print $$3}'
 	# Generate the HTML report that can be viewed from the browser in CI.
 	$Q go tool cover -html ".cover/c.out" -o .cover/all.html
-.PHONY: fuzz
+define publish_package
-fuzz:
+	chmod 664 cloudflared*.$(1); \
-	@go test -fuzz=FuzzIPDecoder -fuzztime=600s ./packet
+	for HOST in $(CF_PKG_HOSTS); do \
-	@go test -fuzz=FuzzICMPDecoder -fuzztime=600s ./packet
+		ssh-keyscan -t rsa $$HOST >> ~/.ssh/known_hosts; \
-	@go test -fuzz=FuzzSessionWrite -fuzztime=600s ./quic/v3
+		scp -p -4 cloudflared*.$(1) cfsync@$$HOST:/state/cf-pkg/staging/$(2)/$(TARGET_PUBLIC_REPO)/cloudflared/; \
-	@go test -fuzz=FuzzSessionRead -fuzztime=600s ./quic/v3
+	done
-	@go test -fuzz=FuzzRegistrationDatagram -fuzztime=600s ./quic/v3
+endef
 	@go test -fuzz=FuzzPayloadDatagram -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzRegistrationResponseDatagram -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzNewIdentity -fuzztime=600s ./tracing
 	@go test -fuzz=FuzzNewAccessValidator -fuzztime=600s ./validation
-cloudflared.1: cloudflared_man_template
+.PHONY: publish-deb
-	sed -e 's/\$${VERSION}/$(VERSION)/; s/\$${DATE}/$(DATE)/' cloudflared_man_template > cloudflared.1
+publish-deb: cloudflared-deb
 	$(call publish_package,deb,apt)
-install: cloudflared cloudflared.1
+.PHONY: publish-rpm
-	mkdir -p $(DESTDIR)$(INSTALL_BINDIR) $(DESTDIR)$(INSTALL_MANDIR)
+publish-rpm: cloudflared-rpm
-	install -m755 cloudflared $(DESTDIR)$(INSTALL_BINDIR)/cloudflared
+	$(call publish_package,rpm,yum)
 	install -m644 cloudflared.1 $(DESTDIR)$(INSTALL_MANDIR)/cloudflared.1
 # When we build packages, the package name will be FIPS-aware.
 # But we keep the binary installed by it to be named "cloudflared" regardless.
 define build_package
 	mkdir -p $(PACKAGE_DIR)
 	cp cloudflared $(PACKAGE_DIR)/cloudflared
-	cp cloudflared.1 $(PACKAGE_DIR)/cloudflared.1
+	cat cloudflared_man_template | sed -e 's/\$${VERSION}/$(VERSION)/; s/\$${DATE}/$(DATE)/' > $(PACKAGE_DIR)/cloudflared.1
-	fpm -C $(PACKAGE_DIR) -s dir -t $(1) \
+	fakeroot fpm -C $(PACKAGE_DIR) -s dir -t $(1) \
 		--description 'Cloudflare Tunnel daemon' \
 		--vendor 'Cloudflare' \
-		--license 'Apache License Version 2.0' \
+		--license 'Cloudflare Service Agreement' \
 		--url 'https://github.com/cloudflare/cloudflared' \
 		-m 'Cloudflare <support@cloudflare.com>' \
-	    -a $(PACKAGE_ARCH) -v $(VERSION) -n $(DEB_PACKAGE_NAME) $(RPM_DIGEST) $(NIGHTLY_FLAGS) --after-install postinst.sh --after-remove postrm.sh \
+		-a $(TARGET_ARCH) -v $(VERSION) -n $(DEB_PACKAGE_NAME) $(NIGHTLY_FLAGS) --after-install postinst.sh --after-remove postrm.sh \
-		cloudflared=$(INSTALL_BINDIR) cloudflared.1=$(INSTALL_MANDIR)
+		cloudflared=$(INSTALL_BINDIR) cloudflared.1=$(MAN_DIR)
 endef
 .PHONY: cloudflared-deb
-cloudflared-deb: cloudflared cloudflared.1
+cloudflared-deb: cloudflared
 	$(call build_package,deb)
 .PHONY: cloudflared-rpm
-cloudflared-rpm: cloudflared cloudflared.1
+cloudflared-rpm: cloudflared
 	$(call build_package,rpm)
 .PHONY: cloudflared-pkg
 cloudflared-pkg: cloudflared
 	$(call build_package,osxpkg)
 .PHONY: cloudflared-msi
-cloudflared-msi:
+cloudflared-msi: cloudflared
 	wixl --define Version=$(VERSION) --define Path=$(EXECUTABLE_PATH) --output cloudflared-$(VERSION)-$(TARGET_ARCH).msi cloudflared.wxs
-.PHONY: github-release-dryrun
+.PHONY: cloudflared-darwin-amd64.tgz
-github-release-dryrun:
+cloudflared-darwin-amd64.tgz: cloudflared
-	python3 github_release.py --path $(PWD)/built_artifacts --release-version $(VERSION) --dry-run
+	tar czf cloudflared-darwin-amd64.tgz cloudflared
 	rm cloudflared
 .PHONY: cloudflared-junos
 cloudflared-junos: cloudflared jetez-certificate.pem jetez-key.pem
 	jetez --source . \
 		  -j jet.yaml \
 		  --key jetez-key.pem \
 		  --cert jetez-certificate.pem \
 		  --version $(VERSION)
 	rm jetez-*.pem
 jetez-certificate.pem:
 ifndef JETEZ_CERT
 	$(error JETEZ_CERT not defined)
 endif
 	@echo "Writing JetEZ certificate"
 	@echo "$$JETEZ_CERT" > jetez-certificate.pem
 jetez-key.pem:
 ifndef JETEZ_KEY
 	$(error JETEZ_KEY not defined)
 endif
 	@echo "Writing JetEZ key"
 	@echo "$$JETEZ_KEY" > jetez-key.pem
 .PHONY: publish-cloudflared-junos
 publish-cloudflared-junos: cloudflared-junos cloudflared-x86-64.latest.s3
 ifndef S3_ENDPOINT
 	$(error S3_HOST not defined)
 endif
 ifndef S3_URI
 	$(error S3_URI not defined)
 endif
 ifndef S3_ACCESS_KEY
 	$(error S3_ACCESS_KEY not defined)
 endif
 ifndef S3_SECRET_KEY
 	$(error S3_SECRET_KEY not defined)
 endif
 	sha256sum cloudflared-x86-64-$(VERSION).tgz | awk '{printf $$1}' > cloudflared-x86-64-$(VERSION).tgz.shasum
 	s4cmd --endpoint-url $(S3_ENDPOINT) --force --API-GrantRead=uri=http://acs.amazonaws.com/groups/global/AllUsers \
 		put cloudflared-x86-64-$(VERSION).tgz $(S3_URI)/cloudflared-x86-64-$(VERSION).tgz
 	s4cmd --endpoint-url $(S3_ENDPOINT) --force --API-GrantRead=uri=http://acs.amazonaws.com/groups/global/AllUsers \
 		put cloudflared-x86-64-$(VERSION).tgz.shasum $(S3_URI)/cloudflared-x86-64-$(VERSION).tgz.shasum
 	dpkg --compare-versions "$(VERSION)" gt "$(shell cat cloudflared-x86-64.latest.s3)" && \
 		echo -n "$(VERSION)" > cloudflared-x86-64.latest && \
 		s4cmd --endpoint-url $(S3_ENDPOINT) --force --API-GrantRead=uri=http://acs.amazonaws.com/groups/global/AllUsers \
 			put cloudflared-x86-64.latest $(S3_URI)/cloudflared-x86-64.latest || \
 		echo "Latest version not updated"
 cloudflared-x86-64.latest.s3:
 	s4cmd --endpoint-url $(S3_ENDPOINT) --force \
 		get $(S3_URI)/cloudflared-x86-64.latest cloudflared-x86-64.latest.s3
 .PHONY: homebrew-upload
 homebrew-upload: cloudflared-darwin-amd64.tgz
 	aws s3 --endpoint-url $(S3_ENDPOINT) cp --acl public-read $$^ $(S3_URI)/cloudflared-$$(VERSION)-$1.tgz
 	aws s3 --endpoint-url $(S3_ENDPOINT) cp --acl public-read $(S3_URI)/cloudflared-$$(VERSION)-$1.tgz  $(S3_URI)/cloudflared-stable-$1.tgz
 .PHONY: homebrew-release
 homebrew-release: homebrew-upload
 	./publish-homebrew-formula.sh cloudflared-darwin-amd64.tgz $(VERSION) homebrew-cloudflare
 .PHONY: github-release
-github-release:
+github-release: cloudflared
-	python3 github_release.py --path $(PWD)/artifacts/ --release-version $(VERSION)
+	python3 github_release.py --path $(EXECUTABLE_PATH) --release-version $(VERSION)
 .PHONY: github-release-built-pkgs
 github-release-built-pkgs:
 	python3 github_release.py --path $(PWD)/built_artifacts --release-version $(VERSION)
 .PHONY: github-message
 github-message:
 	python3 github_message.py --release-version $(VERSION)
-.PHONY: r2-linux-release
+.PHONY: github-mac-upload
-r2-linux-release:
+github-mac-upload:
-	python3 ./release_pkgs.py
+	python3 github_release.py --path artifacts/cloudflared-darwin-amd64.tgz --release-version $(VERSION) --name cloudflared-darwin-amd64.tgz
 	python3 github_release.py --path artifacts/cloudflared-amd64.pkg --release-version $(VERSION) --name cloudflared-amd64.pkg
-.PHONY: r2-next-linux-release
+.PHONY: tunnelrpc-deps
-# Publishes to a separate R2 repository during GPG key rollover, using dual-key signing.
+tunnelrpc-deps:
 r2-next-linux-release:
 	python3 ./release_pkgs.py --upload-repo-file
 .PHONY: capnp
 capnp:
 	which capnp  # https://capnproto.org/install.html
-	which capnpc-go  # go install zombiezen.com/go/capnproto2/capnpc-go@latest
+	which capnpc-go  # go get zombiezen.com/go/capnproto2/capnpc-go
-	capnp compile -ogo tunnelrpc/proto/tunnelrpc.capnp tunnelrpc/proto/quic_metadata_protocol.capnp
+	capnp compile -ogo tunnelrpc/tunnelrpc.capnp
 .PHONY: quic-deps
 quic-deps: 
 	which capnp 
 	which capnpc-go
 	capnp compile -ogo quic/schema/quic_metadata_protocol.capnp
 .PHONY: vet
 vet:
-	$Q go vet -mod=vendor github.com/cloudflare/cloudflared/...
+	go vet -mod=vendor ./...
 	# go get github.com/sudarshan-reddy/go-sumtype (don't do this in build directory or this will cause vendor issues)
 	# Note: If you have github.com/BurntSushi/go-sumtype then you might have to use the repo above instead
 	# for now because it uses an older version of golang.org/x/tools.
 	which go-sumtype  
 	go-sumtype $$(go list -mod=vendor ./...)
-.PHONY: fmt
+.PHONY: goimports
-fmt:
+goimports:
-	@goimports -l -w -local github.com/cloudflare/cloudflared $$(go list -mod=vendor -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc/proto)
+	for d in $$(go list -mod=readonly -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc) ; do goimports -format-only -local github.com/cloudflare/cloudflared -w $$d ; done
 	@go fmt $$(go list -mod=vendor -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc/proto)
 .PHONY: fmt-check
 fmt-check:
 	@./.ci/scripts/fmt-check.sh
 .PHONY: lint
 lint:
 	@golangci-lint run
 .PHONY: mocks
 mocks:
 	go generate mocks/mockgen.go
 .PHONY: ci-build
 ci-build:
 	@GOOS=linux GOARCH=amd64 $(MAKE) cloudflared
 	@mkdir -p artifacts
 	@mv cloudflared artifacts/cloudflared
 .PHONY: ci-fips-build
 ci-fips-build:
 	@FIPS=true GOOS=linux GOARCH=amd64 $(MAKE) cloudflared
 	@mkdir -p artifacts
 	@mv cloudflared artifacts/cloudflared
 .PHONY: ci-test
 ci-test: fmt-check lint test
 	@go run -mod=readonly github.com/jstemmer/go-junit-report/v2@latest -in $(GO_TEST_LOG_OUTPUT) -parser gojson -out report.xml -set-exit-code
 .PHONY: ci-fips-test
 ci-fips-test:
 	@FIPS=true $(MAKE) ci-test
--- a/README.md
+++ b/README.md
@ -3,14 +3,14 @@
 Contains the command-line client for Cloudflare Tunnel, a tunneling daemon that proxies traffic from the Cloudflare network to your origins.
 This daemon sits between Cloudflare network and your origin (e.g. a webserver). Cloudflare attracts client requests and sends them to you
 via this daemon, without requiring you to poke holes on your firewall --- your origin can remain as closed as possible.
-Extensive documentation can be found in the [Cloudflare Tunnel section](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel) of the Cloudflare Docs.
+Extensive documentation can be found in the [Cloudflare Tunnel section](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps) of the Cloudflare Docs.
 All usages related with proxying to your origins are available under `cloudflared tunnel help`.
 You can also use `cloudflared` to access Tunnel origins (that are protected with `cloudflared tunnel`) for TCP traffic
 at Layer 4 (i.e., not HTTP/websocket), which is relevant for use cases such as SSH, RDP, etc.
 Such usages are available under `cloudflared access help`.
-You can instead use [WARP client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/warp/)
+You can instead use [WARP client](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/private-networks)
 to access private origins behind Tunnels for Layer 4 traffic without requiring `cloudflared access` commands on the client side.
@ -19,64 +19,42 @@ to access private origins behind Tunnels for Layer 4 traffic without requiring `
 Before you use Cloudflare Tunnel, you'll need to complete a few steps in the Cloudflare dashboard: you need to add a
 website to your Cloudflare account. Note that today it is possible to use Tunnel without a website (e.g. for private
 routing), but for legacy reasons this requirement is still necessary:
-1. [Add a website to Cloudflare](https://developers.cloudflare.com/fundamentals/manage-domains/add-site/)
+1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
-2. [Change your domain nameservers to Cloudflare](https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/)
+2. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708)
 ## Installing `cloudflared`
-Downloads are available as standalone binaries, a Docker image, and Debian, RPM, and Homebrew packages. You can also find releases [here](https://github.com/cloudflare/cloudflared/releases) on the `cloudflared` GitHub repository.
+Downloads are available as standalone binaries, a Docker image, and Debian, RPM, and Homebrew packages. You can also find releases here on the `cloudflared` GitHub repository.
-* You can [install on macOS](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#macos) via Homebrew or by downloading the [latest Darwin amd64 release](https://github.com/cloudflare/cloudflared/releases)
+* You can [install on macOS](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#macos) via Homebrew or by downloading the [latest Darwin amd64 release](https://github.com/cloudflare/cloudflared/releases)
-* Binaries, Debian, and RPM packages for Linux [can be found here](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#linux)
+* Binaries, Debian, and RPM packages for Linux [can be found here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#linux)
 * A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared)
-* You can install on Windows machines with the [steps here](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#windows)
+* You can install on Windows machines with the [steps here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#windows)
 * To build from source, install the required version of go, mentioned in the [Development](#development) section below. Then you can run `make cloudflared`.
-User documentation for Cloudflare Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/
+User documentation for Cloudflare Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
 ## Creating Tunnels and routing traffic
 Once installed, you can authenticate `cloudflared` into your Cloudflare account and begin creating Tunnels to serve traffic to your origins.
-* Create a Tunnel with [these instructions](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/)
+* Create a Tunnel with [these instructions](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/create-tunnel)
 * Route traffic to that Tunnel:
-  * Via public [DNS records in Cloudflare](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns/)
+  * Via public [DNS records in Cloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/dns)
-  * Or via a public hostname guided by a [Cloudflare Load Balancer](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/)
+  * Or via a public hostname guided by a [Cloudflare Load Balancer](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb)
-  * Or from [WARP client private traffic](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/)
+  * Or from [WARP client private traffic](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/private-networks)
 ## TryCloudflare
-Want to test Cloudflare Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/).
+Want to test Cloudflare Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare).
 ## Deprecated versions
-Cloudflare currently supports versions of cloudflared that are **within one year** of the most recent release. Breaking changes unrelated to feature availability may be introduced that will impact versions released more than one year ago. You can read more about upgrading cloudflared in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/).
+Cloudflare currently supports versions of `cloudflared` 2020.5.1 and later. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1. You can read more about upgrading `cloudflared` in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#updating-cloudflared).
-For example, as of January 2023 Cloudflare will support cloudflared version 2023.1.1 to cloudflared 2022.1.1.
+| Version(s) | Deprecation status |
-
+|---|---|
-## Development
+| 2020.5.1 and later | Supported |
-
+| Versions prior to 2020.5.1 | No longer supported |
 ### Requirements
 - [GNU Make](https://www.gnu.org/software/make/)
 - [capnp](https://capnproto.org/install.html)
 - [go >= 1.24](https://go.dev/doc/install)
 - Optional tools:
  - [capnpc-go](https://pkg.go.dev/zombiezen.com/go/capnproto2/capnpc-go)
  - [goimports](https://pkg.go.dev/golang.org/x/tools/cmd/goimports)
  - [golangci-lint](https://github.com/golangci/golangci-lint)
  - [gomocks](https://pkg.go.dev/go.uber.org/mock)
 ### Build
 To build cloudflared locally run `make cloudflared`
 ### Test
 To locally run the tests run `make test`
 ### Linting
 To format the code and keep a good code quality use `make fmt` and `make lint`
 ### Mocks
 After changes on interfaces you might need to regenerate the mocks, so run `make mock`
--- a/943
+++ b/943
@ -1,946 +1,3 @@
 2025.11.1
 - 2025-11-07 TUN-9800: Fix docker hub push step
 2025.11.0
 - 2025-11-06 TUN-9863: Introduce Code Signing for Windows Builds
 - 2025-11-06 TUN-9800: Prefix gitlab steps with operating system
 - 2025-11-04 chore: Update cloudflared signing key name in index.html
 - 2025-10-31 chore: add claude review
 - 2025-10-31 Chore: Update documentation links in README
 - 2025-10-31 TUN-9800: Add pipelines for linux packaging
 2025.10.1
 - 2025-10-30 chore: Update ci image to use goboring 1.24.9
 - 2025-10-28 TUN-9849: Add cf-proxy-* to control response headers
 - 2025-10-24 TUN-9961: Add pkg.cloudflared.com index.html to git repo
 - 2025-10-23 TUN-9954: Update from go1.24.6 to go1.24.9
 - 2025-10-23 Fix systemd service installation hanging
 - 2025-10-21 TUN-9941: Use new GPG key for RPM builds
 - 2025-10-21 TUN-9941: Fix typo causing r2-release-next deployment to fail
 - 2025-10-21 TUN-9941: Lookup correct key for RPM signature
 - 2025-10-15 TUN-9919: Make RPM postinstall scriplet idempotent
 - 2025-10-14 TUN-9916: Fix the cloudflared binary path used in the component test
 2025.10.0
 - 2025-10-14 chore: Fix upload of RPM repo file during double signing
 - 2025-10-13 TUN-9882: Bump datagram v3 write channel capacity
 - 2025-10-10 chore: Fix import of GPG keys when two keys are provided
 - 2025-10-10 chore: Fix parameter order when uploading RPM .repo file to R2
 - 2025-10-10 TUN-9883: Add new datagram v3 feature flag
 - 2025-10-09 chore: Force usage of go-boring 1.24
 - 2025-10-08 TUN-9882: Improve metrics for datagram v3
 - 2025-10-07 GRC-16749: Add fedramp tags to catalog
 - 2025-10-07 TUN-9882: Add buffers for UDP and ICMP datagrams in datagram v3
 - 2025-10-07 TUN-9882: Add write deadline for UDP origin writes
 - 2025-09-29 TUN-9776: Support signing Debian packages with two keys for rollover
 - 2025-09-22 TUN-9800: Add pipeline to sync between gitlab and github repos
 2025.9.1
 - 2025-09-22 TUN-9855: Create script to ignore vulnerabilities from govuln check
 - 2025-09-19 TUN-9852: Remove fmt.Println from cloudflared access command
 2025.9.0
 - 2025-09-15 TUN-9820: Add support for FedRAMP in originRequest Access config
 - 2025-09-11 TUN-9800: Migrate cloudflared-ci pipelines to Gitlab CI
 - 2025-09-04 TUN-9803: Add windows builds to gitlab-ci
 - 2025-08-27 TUN-9755: Set endpoint in tunnel credentials when generating locally managed tunnel with a Fed token
 2025.8.1
 - 2025-08-19 AUTH-7480 update fed callback url for login helper
 - 2025-08-19 CUSTESC-53681: Correct QUIC connection management for datagram handlers
 - 2025-08-12 AUTH-7260: Add support for login interstitial auto closure
 2025.8.0
 - 2025-08-07 vuln: Fix GO-2025-3770 vulnerability
 - 2025-07-23 TUN-9583: set proper url and hostname for cloudflared tail command
 - 2025-07-07 TUN-9542: Remove unsupported Debian-based releases
 2025.7.0
 - 2025-07-03 TUN-9540: Use numeric user id for Dockerfiles
 - 2025-07-01 TUN-9161: Remove P256Kyber768Draft00PQKex curve from nonFips curve preferences
 - 2025-07-01 TUN-9531: Bump go-boring from 1.24.2 to 1.24.4
 - 2025-07-01 TUN-9511: Add metrics for virtual DNS origin
 - 2025-06-30 TUN-9470: Add OriginDialerService to include TCP
 - 2025-06-30 TUN-9473: Add --dns-resolver-addrs flag
 - 2025-06-27 TUN-9472: Add virtual DNS service
 - 2025-06-23 TUN-9469: Centralize UDP origin proxy dialing as ingress service
 2025.6.1
 - 2025-06-16 TUN-9467: add vulncheck to cloudflared
 - 2025-06-16 TUN-9495: Remove references to cloudflare-go
 - 2025-06-16 TUN-9371: Add logging format as JSON
 - 2025-06-12 TUN-9467: bump coredns to solve CVE
 2025.6.0
 - 2025-06-06 TUN-9016: update go to 1.24
 - 2025-06-05 TUN-9171: Use `is_default_network` instead of `is_default` to create vnet's
 2025.5.0
 - 2025-05-14 TUN-9319: Add dynamic loading of features to connections via ConnectionOptionsSnapshot
 - 2025-05-13 TUN-9322: Add metric for unsupported RPC commands for datagram v3
 - 2025-05-07 TUN-9291: Remove dynamic reloading of features for datagram v3
 2025.4.2
 - 2025-04-30 chore: Do not use gitlab merge request pipelines
 - 2025-04-30 DEVTOOLS-16383: Create GitlabCI pipeline to release Mac builds
 - 2025-04-24 TUN-9255: Improve flush on write conditions in http2 tunnel type to match what is done on the edge
 - 2025-04-10 SDLC-3727 - Adding FIPS status to backstage
 2025.4.0
 - 2025-04-02 Fix broken links in `cmd/cloudflared/*.go` related to running tunnel as a service
 - 2025-04-02 chore: remove repetitive words
 - 2025-04-01 Fix messages to point to one.dash.cloudflare.com
 - 2025-04-01 feat: emit explicit errors for the `service` command on unsupported OSes
 - 2025-04-01 Use RELEASE_NOTES date instead of build date
 - 2025-04-01 chore: Update tunnel configuration link in the readme
 - 2025-04-01 fix: expand home directory for credentials file
 - 2025-04-01 fix: Use path and filepath operation appropriately
 - 2025-04-01 feat: Adds a new command line for tunnel run for token file
 - 2025-04-01 chore: fix linter rules
 - 2025-03-17 TUN-9101: Don't ignore errors on `cloudflared access ssh`
 - 2025-03-06 TUN-9089: Pin go import to v0.30.0, v0.31.0 requires go 1.23
 2025.2.1
 - 2025-02-26 TUN-9016: update base-debian to v12
 - 2025-02-25 TUN-8960: Connect to FED API GW based on the OriginCert's endpoint
 - 2025-02-25 TUN-9007: modify logic to resolve region when the tunnel token has an endpoint field
 - 2025-02-13 SDLC-3762: Remove backstage.io/source-location from catalog-info.yaml
 - 2025-02-06 TUN-8914: Create a flags module to group all cloudflared cli flags
 2025.2.0
 - 2025-02-03 TUN-8914: Add a new configuration to locally override the max-active-flows
 - 2025-02-03 Bump x/crypto to 0.31.0
 2025.1.1
 - 2025-01-30 TUN-8858: update go to 1.22.10 and include quic-go FIPS changes
 - 2025-01-30 TUN-8855: fix lint issues
 - 2025-01-30 TUN-8855: Update PQ curve preferences
 - 2025-01-30 TUN-8857: remove restriction for using FIPS and PQ
 - 2025-01-30 TUN-8894: report FIPS+PQ error to Sentry when dialling to the edge
 - 2025-01-22 TUN-8904: Rename Connect Response Flow Rate Limited metadata
 - 2025-01-21 AUTH-6633 Fix cloudflared access login + warp as auth
 - 2025-01-20 TUN-8861: Add session limiter to UDP session manager
 - 2025-01-20 TUN-8861: Rename Session Limiter to Flow Limiter
 - 2025-01-17 TUN-8900: Add import of Apple Developer Certificate Authority to macOS Pipeline
 - 2025-01-17 TUN-8871: Accept login flag to authenticate with Fedramp environment
 - 2025-01-16 TUN-8866: Add linter to cloudflared repository
 - 2025-01-14 TUN-8861: Add session limiter to TCP session manager
 - 2025-01-13 TUN-8861: Add configuration for active sessions limiter
 - 2025-01-09 TUN-8848: Don't treat connection shutdown as an error condition when RPC server is done
 2025.1.0
 - 2025-01-06 TUN-8842: Add Ubuntu Noble and 'any' debian distributions to release script
 - 2025-01-06 TUN-8807: Add support_datagram_v3 to remote feature rollout
 - 2024-12-20 TUN-8829: add CONTAINER_BUILD to dockerfiles
 2024.12.2
 - 2024-12-19 TUN-8822: Prevent concurrent usage of ICMPDecoder
 - 2024-12-18 TUN-8818: update changes document to reflect newly added diag subcommand
 - 2024-12-17 TUN-8817: Increase close session channel by one since there are two writers
 - 2024-12-13 TUN-8797: update CHANGES.md with note about semi-deterministic approach used to bind metrics server
 - 2024-12-13 TUN-8724: Add CLI command for diagnostic procedure
 - 2024-12-11 TUN-8786: calculate cli flags once for the diagnostic procedure
 - 2024-12-11 TUN-8792: Make diag/system endpoint always return a JSON
 - 2024-12-10 TUN-8783: fix log collectors for the diagnostic procedure
 - 2024-12-10 TUN-8785: include the icmp sources in the diag's tunnel state
 - 2024-12-10 TUN-8784: Set JSON encoder options to print formatted JSON when writing diag files
 2024.12.1
 - 2024-12-10 TUN-8795: update createrepo to createrepo_c to fix the release_pkgs.py script
 2024.12.0
 - 2024-12-09 TUN-8640: Add ICMP support for datagram V3
 - 2024-12-09 TUN-8789: make python package installation consistent
 - 2024-12-06 TUN-8781: Add Trixie, drop Buster. Default to Bookworm
 - 2024-12-05 TUN-8775: Make sure the session Close can only be called once
 - 2024-12-04 TUN-8725: implement diagnostic procedure
 - 2024-12-04 TUN-8767: include raw output from network collector in diagnostic zipfile
 - 2024-12-04 TUN-8770: add cli configuration and tunnel configuration to diagnostic zipfile
 - 2024-12-04 TUN-8768: add job report to diagnostic zipfile
 - 2024-12-03 TUN-8726: implement compression routine to be used in diagnostic procedure
 - 2024-12-03 TUN-8732: implement port selection algorithm
 - 2024-12-03 TUN-8762: fix argument order when invoking tracert and modify network info output parsing.
 - 2024-12-03 TUN-8769: fix k8s log collector arguments
 - 2024-12-03 TUN-8727: extend client to include function to get cli configuration and tunnel configuration
 - 2024-11-29 TUN-8729: implement network collection for diagnostic procedure
 - 2024-11-29 TUN-8727: implement metrics, runtime, system, and tunnelstate in diagnostic http client
 - 2024-11-27 TUN-8733: add log collection for docker
 - 2024-11-27 TUN-8734: add log collection for kubernetes
 - 2024-11-27 TUN-8640: Refactor ICMPRouter to support new ICMPResponders
 - 2024-11-26 TUN-8735: add managed/local log collection
 - 2024-11-25 TUN-8728: implement diag/tunnel endpoint
 - 2024-11-25 TUN-8730: implement diag/configuration
 - 2024-11-22 TUN-8737: update metrics server port selection
 - 2024-11-22 TUN-8731: Implement diag/system endpoint
 - 2024-11-21 TUN-8748: Migrated datagram V3 flows to use migrated context
 2024.11.1
 - 2024-11-18 Add cloudflared tunnel ready command
 - 2024-11-14 Make metrics a requirement for tunnel ready command
 - 2024-11-12 TUN-8701:  Simplify flow registration logs for datagram v3
 - 2024-11-11 add: new go-fuzz targets
 - 2024-11-07 TUN-8701: Add metrics and adjust logs for datagram v3
 - 2024-11-06 TUN-8709: Add session migration for datagram v3
 - 2024-11-04 Fixed 404 in README.md to TryCloudflare
 - 2024-09-24 Update semgrep.yml
 2024.11.0
 - 2024-11-05 VULN-66059: remove ssh server tests
 - 2024-11-04 TUN-8700: Add datagram v3 muxer
 - 2024-11-04 TUN-8646: Allow experimental feature support for datagram v3
 - 2024-11-04 TUN-8641: Expose methods to simplify V3 Datagram parsing on the edge
 - 2024-10-31 TUN-8708: Bump python min version to 3.10
 - 2024-10-31 TUN-8667: Add datagram v3 session manager
 - 2024-10-25 TUN-8692: remove dashes from session id
 - 2024-10-24 TUN-8694: Rework release script
 - 2024-10-24 TUN-8661: Refactor connection methods to support future different datagram muxing methods
 - 2024-07-22 TUN-8553: Bump go to 1.22.5 and go-boring 1.22.5-1
 2024.10.1
 - 2024-10-23 TUN-8694: Fix github release script
 - 2024-10-21 Revert "TUN-8592: Use metadata from the edge to determine if request body is empty for QUIC transport"
 - 2024-10-18 TUN-8688: Correct UDP bind for IPv6 edge connectivity on macOS
 - 2024-10-17 TUN-8685: Bump coredns dependency
 - 2024-10-16 TUN-8638: Add datagram v3 serializers and deserializers
 - 2024-10-15 chore: Remove h2mux code
 - 2024-10-11 TUN-8631: Abort release on version mismatch
 2024.10.0
 - 2024-10-01 TUN-8646: Add datagram v3 support feature flag
 - 2024-09-30 TUN-8621: Fix cloudflared version in change notes to account for release date
 - 2024-09-19 Adding semgrep yaml file
 - 2024-09-12 TUN-8632: Delay checking auto-update by the provided frequency
 - 2024-09-11 TUN-8630: Check checksum of downloaded binary to compare to current for auto-updating
 - 2024-09-09 TUN-8629: Cloudflared update on Windows requires running it twice to update
 - 2024-09-06 PPIP-2310: Update quick tunnel disclaimer
 - 2024-08-30 TUN-8621: Prevent QUIC connection from closing before grace period after unregistering
 - 2024-08-09 TUN-8592: Use metadata from the edge to determine if request body is empty for QUIC transport
 - 2024-06-26 TUN-8484: Print response when QuickTunnel can't be unmarshalled
 2024.9.1
 - 2024-09-10 Revert Release 2024.9.0
 2024.9.0
 - 2024-09-10 TUN-8621: Fix cloudflared version in change notes.
 - 2024-09-06 PPIP-2310: Update quick tunnel disclaimer
 - 2024-08-30 TUN-8621: Prevent QUIC connection from closing before grace period after unregistering
 - 2024-08-09 TUN-8592: Use metadata from the edge to determine if request body is empty for QUIC transport
 - 2024-06-26 TUN-8484: Print response when QuickTunnel can't be unmarshalled
 2024.8.3
 - 2024-08-15 TUN-8591 login command without extra text
 - 2024-03-25 remove code that will not be executed
 - 2024-03-25 remove code that will not be executed
 2024.8.2
 - 2024-08-05 TUN-8583: change final directory of artifacts
 - 2024-08-05 TUN-8585: Avoid creating GH client when dry-run is true
 2024.7.3
 - 2024-07-31 TUN-8546: Fix final artifacts paths
 2024.7.2
 - 2024-07-17 TUN-8546: rework MacOS build script
 2024.7.1
 - 2024-07-16 TUN-8543: use -p flag to create intermediate directories
 2024.7.0
 - 2024-07-05 TUN-8520: add macos arm64 build
 - 2024-07-05 TUN-8523: refactor makefile and cfsetup
 - 2024-07-02 TUN-8504: Use pre-installed python version instead of downloading it on Windows builds
 - 2024-06-26 TUN-8489: Add default noop logger for capnprpc
 - 2024-06-25 TUN-8487: Add user-agent for quick-tunnel requests
 - 2023-12-12 TUN-8057: cloudflared uses new PQ curve ID
 2024.6.1
 - 2024-06-12 TUN-8461: Don't log Failed to send session payload if the error is EOF
 - 2024-06-07 TUN-8456: Update quic-go to 0.45 and collect mtu and congestion control metrics
 - 2024-06-06 TUN-8452: Add flag to control QUIC stream-level flow control limit
 - 2024-06-06 TUN-8451: Log QUIC flow control frames and transport parameters received
 - 2024-06-05 TUN-8449: Add flag to control QUIC connection-level flow control limit and increase default to 30MB
 2024.6.0
 - 2024-05-30 TUN-8441: Correct UDP total sessions metric to a counter and add new ICMP metrics
 - 2024-05-28 TUN-8422: Add metrics for capnp method calls
 - 2024-05-24 TUN-8424: Refactor capnp registration server
 - 2024-05-23 TUN-8427: Fix BackoffHandler's internally shared clock structure
 - 2024-05-21 TUN-8425: Remove ICMP binding for quick tunnels
 - 2024-05-20 TUN-8423: Deprecate older legacy tunnel capnp interfaces
 - 2024-05-15 TUN-8419: Add capnp safe transport
 - 2024-05-13 TUN-8415: Refactor capnp rpc into a single module
 2024.5.0
 - 2024-05-07 TUN-8407: Upgrade go to version 1.22.2
 2024.4.1
 - 2024-04-22 TUN-8380: Add sleep before requesting quick tunnel as temporary fix for component tests
 - 2024-04-19 TUN-8374: Close UDP socket if registration fails
 - 2024-04-18 TUN-8371: Bump quic-go to v0.42.0
 - 2024-04-03 TUN-8333: Bump go-jose dependency to v4
 - 2024-04-02 TUN-8331: Add unit testing for AccessJWTValidator middleware
 2024.4.0
 - 2024-04-02 feat: provide short version (#1206)
 - 2024-04-02 Format code
 - 2024-01-18 feat: auto tls sni
 - 2023-12-24 fix checkInPingGroup bugs
 - 2023-12-15 Add environment variables for TCP tunnel hostname / destination / URL.
 2024.3.0
 - 2024-03-14 TUN-8281: Run cloudflared query list tunnels/routes endpoint in a paginated way
 - 2024-03-13 TUN-8297: Improve write timeout logging on safe_stream.go
 - 2024-03-07 TUN-8290: Remove `|| true` from postrm.sh
 - 2024-03-05 TUN-8275: Skip write timeout log on "no network activity"
 - 2024-01-23 Update postrm.sh to fix incomplete uninstall
 - 2024-01-05 fix typo in errcheck for response parsing logic in CreateTunnel routine
 - 2023-12-23 Update linux_service.go
 - 2023-12-07 ci: bump actions/checkout to v4
 - 2023-12-07 ci/check: bump actions/setup-go to v5
 - 2023-04-28 check.yaml: bump actions/setup-go to v4
 2024.2.1
 - 2024-02-20 TUN-8242: Update Changes.md file with new remote diagnostics behaviour
 - 2024-02-19 TUN-8238: Fix type mismatch introduced by fast-forward
 - 2024-02-16 TUN-8243: Collect metrics on the number of QUIC frames sent/received
 - 2024-02-15 TUN-8238: Refactor proxy logging
 - 2024-02-14 TUN-8242: Enable remote diagnostics by default
 - 2024-02-12 TUN-8236: Add write timeout to quic and tcp connections
 - 2024-02-09 TUN-8224: Fix safety of TCP stream logging, separate connect and ack log messages
 2024.2.0
 - 2024-02-07 TUN-8224: Count and collect metrics on stream connect successes/errors
 2024.1.5
 - 2024-01-22 TUN-8176: Support ARM platforms that don't have an FPU or have it enabled in kernel
 - 2024-01-15 TUN-8158: Bring back commit e6537418859afcac29e56a39daa08bcabc09e048 and fixes infinite loop on linux when the socket is closed
 2024.1.4
 - 2024-01-19 Revert "TUN-8158: Add logging to confirm when ICMP reply is returned to the edge"
 2024.1.3
 - 2024-01-15 TUN-8161: Fix broken ARM build for armv6
 - 2024-01-15 TUN-8158: Add logging to confirm when ICMP reply is returned to the edge
 2024.1.2
 - 2024-01-11 TUN-8147: Disable ECN usage due to bugs in detecting if supported
 - 2024-01-11 TUN-8146: Fix export path for install-go command
 - 2024-01-11 TUN-8146: Fix Makefile targets should not be run in parallel and install-go script was missing shebang
 - 2024-01-10 TUN-8140: Remove homebrew scripts
 2024.1.1
 - 2024-01-10 TUN-8134: Revert installed prefix to /usr
 - 2024-01-09 TUN-8130: Fix path to install go for mac build
 - 2024-01-09 TUN-8129: Use the same build command between branch and release builds
 - 2024-01-09 TUN-8130: Install go tool chain in /tmp on build agents
 - 2024-01-09 TUN-8134: Install cloudflare go as part of make install
 - 2024-01-08 TUN-8118: Disable FIPS module to build with go-boring without CGO_ENABLED
 2024.1.0
 - 2024-01-01 TUN-7934: Update quic-go to a version that queues datagrams for better throughput and drops large datagram
 - 2023-12-20 TUN-8072: Need to set GOCACHE in mac go installation script
 - 2023-12-17 TUN-8072: Add script to download cloudflare go for Mac build agents
 - 2023-12-15 Fix nil pointer dereference segfault when passing "null" config json to cloudflared tunnel ingress validate (#1070)
 - 2023-12-15 configuration.go: fix developerPortal link (#960)
 - 2023-12-14 tunnelrpc/pogs: fix dropped test errors (#1106)
 - 2023-12-14 cmd/cloudflared/updater: fix dropped error (#1055)
 - 2023-12-14 use os.Executable to discover the path to cloudflared (#1040)
 - 2023-12-14 Remove extraneous `period` from Path Environment Variable (#1009)
 - 2023-12-14 Use CLI context when running tunnel (#597)
 - 2023-12-14 TUN-8066: Define scripts to build on Windows agents
 - 2023-12-11 TUN-8052: Update go to 1.21.5
 - 2023-12-07 TUN-7970: Default to enable post quantum encryption for quic transport
 - 2023-12-04 TUN-8006: Update quic-go to latest upstream
 - 2023-11-15 VULN-44842 Add a flag that allows users to not send the Access JWT to stdout
 - 2023-11-13 TUN-7965: Remove legacy incident status page check
 - 2023-11-13 AUTH-5682 Org token flow in Access logins should pass CF_AppSession cookie
 2023.10.0
 - 2023-10-06 TUN-7864: Document cloudflared versions support
 - 2023-10-03 CUSTESC-33731: Make rule match test report rule in 0-index base
 - 2023-09-22 TUN-7824: Fix usage of systemctl status to detect which services are installed
 - 2023-09-20 TUN-7813: Improve tunnel delete command to use cascade delete
 - 2023-09-20 TUN-7787: cloudflared only list ip routes targeted for cfd_tunnel
 - 2023-09-15 TUN-7787: Refactor cloudflared to use new route endpoints based on route IDs
 - 2023-09-08 TUN-7776: Remove warp-routing flag from cloudflared
 - 2023-09-05 TUN-7756: Clarify that QUIC is mandatory to support ICMP proxying
 2023.8.2
 - 2023-08-25 TUN-7700: Implement feature selector to determine if connections will prefer post quantum cryptography
 - 2023-08-22 TUN-7707: Use X25519Kyber768Draft00 curve when post-quantum feature is enabled
 2023.8.1
 - 2023-08-23 TUN-7718: Update R2 Token to no longer encode secret
 2023.8.0
 - 2023-07-26 TUN-7584: Bump go 1.20.6
 2023.7.3
 - 2023-07-25 TUN-7628: Correct Host parsing for Access
 - 2023-07-24 TUN-7624: Fix flaky TestBackoffGracePeriod test in cloudflared
 2023.7.2
 - 2023-07-19 TUN-7599: Onboard cloudflared to Software Dashboard
 - 2023-07-19 TUN-7587: Remove junos builds
 - 2023-07-18 TUN-7597: Add flag to disable auto-update services to be installed
 - 2023-07-17 TUN-7594: Add nightly arm64 cloudflared internal deb publishes
 - 2023-07-14 TUN-7586: Upgrade go-jose/go-jose/v3 and core-os/go-oidc/v3
 - 2023-07-14 TUN-7589: Remove legacy golang.org/x/crypto/ssh/terminal package usage
 - 2023-07-14 TUN-7590: Remove usages of ioutil
 - 2023-07-14 TUN-7585: Remove h2mux compression
 - 2023-07-14 TUN-7588: Update package coreos/go-systemd
 2023.7.1
 - 2023-07-13 TUN-7582: Correct changelog wording for --management-diagnostics
 - 2023-07-12 TUN-7575: Add option to disable PTMU discovery over QUIC
 2023.7.0
 - 2023-07-06 TUN-7558: Flush on Writes for StreamBasedOriginProxy
 - 2023-07-05 TUN-7553: Add flag to enable management diagnostic services
 - 2023-07-05 TUN-7564: Support cf-trace-id for cloudflared access
 - 2023-07-05 TUN-7477: Decrement UDP sessions on shutdown
 - 2023-07-03 TUN-7545: Add support for full bidirectionally streaming with close signal propagation
 - 2023-06-30 TUN-7549: Add metrics route to management service
 - 2023-06-30 TUN-7551: Complete removal of raven-go to sentry-go
 - 2023-06-30 TUN-7550: Add pprof endpoint to management service
 - 2023-06-29 TUN-7543: Add --debug-stream flag to cloudflared access ssh
 - 2023-06-26 TUN-6011: Remove docker networks from ICMP Proxy test
 - 2023-06-20 AUTH-5328 Pass cloudflared_token_check param when running cloudflared access login
 2023.6.1
 - 2023-06-19 TUN-7480: Added a timeout for unregisterUDP.
 - 2023-06-16 TUN-7477: Add UDP/TCP session metrics
 - 2023-06-14 TUN-7468: Increase the limit of incoming streams
 2023.6.0
 - 2023-06-15 TUN-7471: Fixes cloudflared not closing the quic stream on unregister UDP session
 - 2023-06-09 TUN-7463: Add default ingress rule if no ingress rules are provided when updating the configuration
 - 2023-05-31 TUN-7447: Add a cover build to report code coverage
 2023.5.1
 - 2023-05-16 TUN-7424: Add CORS headers to host_details responses
 - 2023-05-11 TUN-7421: Add *.cloudflare.com to permitted Origins for management WebSocket requests
 - 2023-05-05 TUN-7404: Default configuration version set to -1
 - 2023-05-05 TUN-7227: Migrate to devincarr/quic-go
 2023.5.0
 - 2023-04-27 TUN-7398: Add support for quic safe stream to set deadline
 - 2023-04-26 TUN-7394: Retry StartFirstTunnel on quic.ApplicationErrors
 - 2023-04-26 TUN-7392: Ignore release checksum upload if asset already uploaded
 - 2023-04-25 TUN-7392: Ignore duplicate artifact uploads for github release
 - 2023-04-25 TUN-7393: Add json output for cloudflared tail
 - 2023-04-24 TUN-7390: Remove Debian stretch builds
 2023.4.2
 - 2023-04-24 TUN-7133: Add sampling support for streaming logs
 - 2023-04-21 TUN-7141: Add component tests for streaming logs
 - 2023-04-21 TUN-7373: Streaming logs override for same actor
 - 2023-04-20 TUN-7383: Bump requirements.txt
 - 2023-04-19 TUN-7361: Add a label to override hostname
 - 2023-04-19 TUN-7378: Remove RPC debug logs
 - 2023-04-18 TUN-7360: Add Get Host Details handler in management service
 - 2023-04-17 AUTH-3122 Verify that Access tokens are still valid in curl command
 - 2023-04-17 TUN-7129: Categorize TCP logs for streaming logs
 - 2023-04-17 TUN-7130: Categorize UDP logs for streaming logs
 - 2023-04-10 AUTH-4887 Add aud parameter to token transfer url
 2023.4.1
 - 2023-04-13 TUN-7368: Report destination address for TCP requests in logs
 - 2023-04-12 TUN-7134: Acquire token for cloudflared tail
 - 2023-04-12 TUN-7131: Add cloudflared log event to connection messages and enable streaming logs
 - 2023-04-11 TUN-7132 TUN-7136: Add filter support for streaming logs
 - 2023-04-06 TUN-7354: Don't warn for empty ingress rules when using --token
 - 2023-04-06 TUN-7128: Categorize logs from public hostname locations
 - 2023-04-06 TUN-7351: Add streaming logs session ping and timeout
 - 2023-04-06 TUN-7335: Fix cloudflared update not working in windows
 2023.4.0
 - 2023-04-07 TUN-7356: Bump golang.org/x/net package to 0.7.0
 - 2023-04-07 TUN-7357: Bump to go 1.19.6
 - 2023-04-06 TUN-7127: Disconnect logger level requirement for management
 - 2023-04-05 TUN-7332: Remove legacy tunnel force flag
 - 2023-04-05 TUN-7135: Add cloudflared tail
 - 2023-04-04 Add suport for OpenBSD (#916)
 - 2023-04-04 Fix typo (#918)
 - 2023-04-04 TUN-7125: Add management streaming logs WebSocket protocol
 - 2023-03-30 TUN-9999: Remove classic tunnel component tests
 - 2023-03-30 TUN-7126: Add Management logger io.Writer
 - 2023-03-29 TUN-7324: Add http.Hijacker to connection.ResponseWriter
 - 2023-03-29 TUN-7333: Default features checkable at runtime across all packages
 - 2023-03-21 TUN-7124: Add intercept ingress rule for management requests
 2023.3.1
 - 2023-03-13 TUN-7271: Return 503 status code when no ingress rules configured
 - 2023-03-10 TUN-7272: Fix cloudflared returning non supported status service which breaks configuration migration
 - 2023-03-09 TUN-7259: Add warning for missing ingress rules
 - 2023-03-09 TUN-7268: Default to Program Files as location for win32
 - 2023-03-07 TUN-7252: Remove h2mux connection
 - 2023-03-07 TUN-7253: Adopt http.ResponseWriter for connection.ResponseWriter
 - 2023-03-06 TUN-7245: Add bastion flag to origin service check
 - 2023-03-06 EDGESTORE-108: Remove deprecated s3v2 signature
 - 2023-03-02 TUN-7226: Fixed a missed rename
 2023.3.0
 - 2023-03-01 GH-352: Add Tunnel CLI option "edge-bind-address" (#870)
 - 2023-03-01 Fixed WIX template to allow MSI upgrades (#838)
 - 2023-02-28 TUN-7213: Decode Base64 encoded key before writing it
 - 2023-02-28 check.yaml: update actions to v3 (#876)
 - 2023-02-27 TUN-7213: Debug homebrew-cloudflare  build
 - 2023-02-15 RTG-2476 Add qtls override for Go 1.20
 2023.2.2
 - 2023-02-22 TUN-7197: Add connIndex tag to debug messages of incoming requests
 - 2023-02-08 TUN-7167: Respect protocol overrides with --token
 - 2023-02-06 TUN-7065: Remove classic tunnel creation
 - 2023-02-06 TUN-6938: Force h2mux protocol to http2 for named tunnels
 - 2023-02-06 TUN-6938: Provide QUIC as first in protocol list
 - 2023-02-03 TUN-7158: Correct TCP tracing propagation
 - 2023-02-01 TUN-7151: Update changes file with latest release notices
 2023.2.1
 - 2023-02-01 TUN-7065: Revert Ingress Rule check for named tunnel configurations
 - 2023-02-01 Revert "TUN-7065: Revert Ingress Rule check for named tunnel configurations"
 - 2023-02-01 Revert "TUN-7065: Remove classic tunnel creation"
 2023.1.0
 - 2023-01-10 TUN-7064: RPM digests are now sha256 instead of md5sum
 - 2023-01-04 RTG-2418 Update qtls
 - 2022-12-24 TUN-7057: Remove dependency github.com/gorilla/mux
 - 2022-12-24 TUN-6724: Migrate to sentry-go from raven-go
 2022.12.1
 - 2022-12-20 TUN-7021: Fix proxy-dns not starting when cloudflared tunnel is run
 - 2022-12-15 TUN-7010: Changelog for release 2022.12.0
 2022.12.0
 - 2022-12-14 TUN-6999: cloudflared should attempt other edge addresses before falling back on protocol
 - 2022-12-13 TUN-7004: Dont show local config dirs for remotely configured tuns
 - 2022-12-12 TUN-7003: Tempoarily disable erroneous notarize-app
 - 2022-12-12 TUN-7003: Add back a missing fi
 - 2022-12-07 TUN-7000: Reduce metric cardinality of closedConnections metric by removing error as tag
 - 2022-12-07 TUN-6994: Improve logging config file not found
 - 2022-12-07 TUN-7002: Randomise first region selection
 - 2022-12-07 TUN-6995: Disable quick-tunnels spin up by default
 - 2022-12-05 TUN-6984: Add bash set x to improve visibility during builds
 - 2022-12-05 TUN-6984: [CI] Ignore security import errors for code_sigining
 - 2022-12-05 TUN-6984: [CI] Don't fail on unset.
 - 2022-11-30 TUN-6984: Set euo pipefile for homebrew builds
 2022.11.1
 - 2022-11-29 TUN-6981: We should close UDP socket if failed to connecto to edge
 - 2022-11-25 CUSTESC-23757: Fix a bug where a wildcard ingress rule would match an host without starting with a dot
 - 2022-11-24 TUN-6970: Print newline when printing tunnel token
 - 2022-11-22 TUN-6963: Refactor Metrics service setup
 2022.11.0
 - 2022-11-16 Revert "TUN-6935: Cloudflared should use APIToken instead of serviceKey"
 - 2022-11-16 TUN-6929: Use same protocol for other connections as first one
 - 2022-11-14 TUN-6941: Reduce log level to debug when failing to proxy ICMP reply
 - 2022-11-14 TUN-6935: Cloudflared should use APIToken instead of serviceKey
 - 2022-11-14 TUN-6935: Cloudflared should use APIToken instead of serviceKey
 - 2022-11-11 TUN-6937: Bump golang.org/x/* packages to new release tags
 - 2022-11-10 ZTC-234: macOS tests
 - 2022-11-09 TUN-6927: Refactor validate access configuration to allow empty audTags only
 - 2022-11-08 ZTC-234: Replace ICMP funnels when ingress connection changes
 - 2022-11-04 TUN-6917: Bump go to 1.19.3
 - 2022-11-02 Issue #574: Better ssh config for short-lived cert (#763)
 - 2022-10-28 TUN-6898: Fix bug handling IPv6 based ingresses with missing port
 - 2022-10-28 TUN-6898: Refactor addPortIfMissing
 2022.10.3
 - 2022-10-24 TUN-6871: Add default feature to cloudflared to support EOF on QUIC connections
 - 2022-10-19 TUN-6876: Fix flaky TestTraceICMPRouterEcho by taking account request span can return before reply
 - 2022-10-18 TUN-6867: Clear spans right after they are serialized to avoid returning duplicate spans
 2022.10.2
 - 2022-10-18 TUN-6869: Fix Makefile complaining about missing GO packages
 - 2022-10-18 TUN-6864: Don't reuse port in quic unit tests
 - 2022-10-18 TUN-6868: Return left padded tracing ID when tracing identity is converted to string
 2022.10.1
 - 2022-10-16 TUN-6861: Trace ICMP on Windows
 - 2022-10-15 TUN-6860: Send access configuration keys to the edge
 - 2022-10-14 TUN-6858: Trace ICMP reply
 - 2022-10-13 TUN-6855: Add DatagramV2Type for IP packet with trace and tracing spans
 - 2022-10-13 TUN-6856: Refactor to lay foundation for tracing ICMP
 - 2022-10-13 TUN-6604: Trace icmp echo request on Linux and Darwin
 - 2022-10-12 Fix log message (#591)
 - 2022-10-12 TUN-6853: Reuse source port when connecting to the edge for quic connections
 - 2022-10-11 TUN-6829: Allow user of datagramsession to control logging level of errors
 - 2022-10-10 RTG-2276 Update qtls and go mod tidy
 - 2022-10-05 Add post-quantum flag to quick tunnel
 - 2022-10-05 TUN-6823: Update github release message to pull from KV
 - 2022-10-04 TUN-6825: Fix cloudflared:version images require arch hyphens
 - 2022-10-03 TUN-6806: Add ingress rule number to log when filtering due to middlware handler
 - 2022-08-17 Label correct container
 - 2022-08-16 Fix typo in help text for `cloudflared tunnel route lb`
 - 2022-07-18 drop usage of cat when sed is invoked to generate the manpage
 - 2021-03-15 update-build-readme
 - 2021-03-15 fix link
 2022.10.0
 - 2022-09-30 TUN-6755: Remove unused publish functions
 - 2022-09-30 TUN-6813: Only proxy ICMP packets when warp-routing is enabled
 - 2022-09-29 TUN-6811: Ping group range should be parsed as int32
 - 2022-09-29 TUN-6812: Drop IP packets if ICMP proxy is not initialized
 - 2022-09-28 TUN-6716: Document limitation of Windows ICMP proxy
 - 2022-09-28 TUN-6810: Add component test for post-quantum
 - 2022-09-27 TUN-6715: Provide suggestion to add cloudflared to ping_group_range if it failed to open ICMP socket
 - 2022-09-22 TUN-6792: Fix brew core release by not auditing the formula
 - 2022-09-22 TUN-6774: Validate OriginRequest.Access to add Ingress.Middleware
 - 2022-09-22 TUN-6775: Add middleware.Handler verification to ProxyHTTP
 - 2022-09-22 TUN-6791: Calculate ICMPv6 checksum
 - 2022-09-22 TUN-6801: Add punycode alternatives for ingress rules
 - 2022-09-21 TUN-6772: Add a JWT Validator as an ingress verifier
 - 2022-09-21 TUN-6772: Add a JWT Validator as an ingress verifier
 - 2022-09-21 TUN-6774: Validate OriginRequest.Access to add Ingress.Middleware
 - 2022-09-21 TUN-6772: Add a JWT Validator as an ingress verifier
 - 2022-09-20 TUN-6741: ICMP proxy tries to listen on specific IPv4 & IPv6 when possible
 2022.9.1
 - 2022-09-20 TUN-6777: Fix race condition in TestFunnelIdleTimeout
 - 2022-09-20 TUN-6595: Enable datagramv2 and icmp proxy by default
 - 2022-09-20 TUN-6773: Add access based configuration to ingress.OriginRequestConfig
 - 2022-09-19 TUN-6778: Cleanup logs about ICMP
 - 2022-09-19 TUN-6779: cloudflared should also use the root CAs from system pool to validate edge certificate
 - 2022-09-19 TUN-6780: Add support for certReload to also include support for client certificates
 - 2022-09-16 TUN-6767: Build ICMP proxy for Windows only when CGO is enabled
 - 2022-09-15 TUN-6590: Use Windows Teamcity agent to build binary
 - 2022-09-13 TUN-6592: Decrement TTL and return ICMP time exceed if it's 0
 - 2022-09-09 TUN-6749: Fix icmp_generic build
 - 2022-09-09 TUN-6744: On posix platforms, assign unique echo ID per (src, dst, echo ID)
 - 2022-09-08 TUN-6743: Support ICMPv6 echo on Windows
 - 2022-09-08 TUN-6689: Utilize new RegisterUDPSession to begin tracing
 - 2022-09-07 TUN-6688: Update RegisterUdpSession capnproto to include trace context
 - 2022-09-06 TUN-6740: Detect no UDP packets allowed and fallback from QUIC in that case
 - 2022-09-06 TUN-6654: Support ICMPv6 on Linux and Darwin
 - 2022-09-02 TUN-6696: Refactor flow into funnel and close idle funnels
 - 2022-09-02 TUN-6718: Bump go and go-boring 1.18.6
 - 2022-08-29 TUN-6531: Implement ICMP proxy for Windows using IcmpSendEcho
 - 2022-08-24 RTG-1339 Support post-quantum hybrid key exchange
 2022.9.0
 - 2022-09-05 TUN-6737: Fix datagramV2Type should be declared in its own block so it starts at 0
 - 2022-09-01 TUN-6725: Fix testProxySSEAllData
 - 2022-09-01 TUN-6726: Fix maxDatagramPayloadSize for Windows QUIC datagrams
 - 2022-09-01 TUN-6729: Fix flaky TestClosePreviousProxies
 - 2022-09-01 TUN-6728: Verify http status code ingress rule
 - 2022-08-25 TUN-6695: Implement ICMP proxy for linux
 2022.8.4
 - 2022-08-31 TUN-6717: Update Github action to run with Go 1.19
 - 2022-08-31 TUN-6720: Remove forcibly closing connection during reconnect signal
 - 2022-08-29 Release 2022.8.3
 2022.8.3
 - 2022-08-26 TUN-6708: Fix replace flow logic
 - 2022-08-25 TUN-6705: Tunnel should retry connections forever
 - 2022-08-25 TUN-6704: Honor protocol flag when edge discovery is unreachable
 - 2022-08-25 TUN-6699: Add metric for packet too big dropped
 - 2022-08-24 TUN-6691: Properly error check for net.ErrClosed
 - 2022-08-22 TUN-6679: Allow client side of quic request to close body
 - 2022-08-22 TUN-6586: Change ICMP proxy to only build for Darwin and use echo ID to track flows
 - 2022-08-18 TUN-6530: Implement ICMPv4 proxy
 - 2022-08-17 TUN-6666: Define packet package
 - 2022-08-17 TUN-6667: DatagramMuxerV2 provides a method to receive RawPacket
 - 2022-08-16 TUN-6657: Ask for Tunnel ID and Configuration on Bug Report
 - 2022-08-16 TUN-6676: Add suport for trailers in http2 connections
 - 2022-08-11 TUN-6575: Consume cf-trace-id from incoming http2 TCP requests
 2022.8.2
 - 2022-08-16 TUN-6656: Docker for arm64 should not be deployed in an amd64 container
 2022.8.1
 - 2022-08-15 TUN-6617: Updated CHANGES.md for protocol stickiness
 - 2022-08-12 EDGEPLAT-3918: bump go and go-boring to 1.18.5
 - 2022-08-12 TUN-6652: Publish dockerfile for both amd64 and arm64
 - 2022-08-11 TUN-6617: Dont fallback to http2 if QUIC conn was successful.
 - 2022-08-11 TUN-6617: Dont fallback to http2 if QUIC conn was successful.
 - 2022-08-11 Revert "TUN-6617: Dont fallback to http2 if QUIC conn was successful."
 - 2022-08-11 TUN-6617: Dont fallback to http2 if QUIC conn was successful.
 - 2022-08-01 TUN-6584: Define QUIC datagram v2 format to support proxying IP packets
 2022.8.0
 - 2022-08-10 TUN-6637: Upgrade quic-go
 - 2022-08-10 TUN-6646: Add support to SafeStreamCloser to close only write side of stream
 - 2022-08-09 TUN-6642: Fix unexpected close of quic stream triggered by upstream origin close
 - 2022-08-09 TUN-6639: Validate cyclic ingress configuration
 - 2022-08-08 TUN-6637: Upgrade go version and quic-go
 - 2022-08-08 TUN-6639: Validate cyclic ingress configuration
 - 2022-08-04 EDGEPLAT-3918: build cloudflared for Bookworm
 - 2022-08-02 Revert "TUN-6576: Consume cf-trace-id from incoming TCP requests to create root span"
 - 2022-07-27 TUN-6601: Update gopkg.in/yaml.v3 references in modules
 - 2022-07-26 TUN-6576: Consume cf-trace-id from incoming TCP requests to create root span
 - 2022-07-26 TUN-6576: Consume cf-trace-id from incoming TCP requests to create root span
 - 2022-07-25 TUN-6598: Remove auto assignees on github issues
 - 2022-07-20 TUN-6583: Remove legacy --ui flag
 - 2022-07-20 cURL supports stdin and uses os pipes directly without copying
 - 2022-07-07 TUN-6517: Use QUIC stream context while proxying HTTP requests and TCP connections
 2022.7.1
 - 2022-07-06 TUN-6503: Fix transport fallback from QUIC in face of dial error "no network activity"
 2022.7.0
 - 2022-07-05 TUN-6499: Remove log that is per datagram
 - 2022-06-24 TUN-6460: Rename metric label location to edge_location
 - 2022-06-24 TUN-6459: Add cloudflared user-agent to access calls
 - 2022-06-17 TUN-6427: Differentiate between upstream request closed/canceled and failed origin requests
 - 2022-06-17 TUN-6388: Fix first tunnel connection not retrying
 - 2022-06-13 TUN-6384: Correct duplicate connection error to fetch new IP first
 - 2022-06-13 TUN-6373: Add edge-ip-version to remotely pushed configuration
 - 2022-06-07 TUN-6010: Add component tests for --edge-ip-version
 - 2022-05-20 TUN-6007: Implement new edge discovery algorithm
 - 2022-02-18 Ensure service install directories are created before writing file
 2022.6.3
 - 2022-06-20 TUN-6362: Add armhf support to cloudflare packaging
 2022.6.2
 - 2022-06-13 TUN-6381: Write error data on QUIC stream when we fail to talk to the origin; separate logging for protocol errors vs. origin errors.
 - 2022-06-17 TUN-6414: Remove go-sumtype from cloudflared build process
 - 2022-06-01 Add Http2Origin option to force HTTP/2 origin connections
 - 2022-06-02 fix ingress rules unit test
 - 2022-06-09 Update remaining OriginRequestConfig functions for Http2Origins
 - 2022-05-31 Add image source label to docker container.
 - 2022-05-10 Warp Private Network link updated
 2022.6.1
 - 2022-06-14 TUN-6395: Fix writing RPM repo data
 2022.6.0
 - 2022-06-14 Revert "TUN-6010: Add component tests for --edge-ip-version"
 - 2022-06-14 Revert "TUN-6373: Add edge-ip-version to remotely pushed configuration"
 - 2022-06-14 Revert "TUN-6384: Correct duplicate connection error to fetch new IP first"
 - 2022-06-14 Revert "TUN-6007: Implement new edge discovery algorithm"
 - 2022-06-13 TUN-6385: Don't share err between acceptStream loop and per-stream goroutines
 - 2022-06-13 TUN-6384: Correct duplicate connection error to fetch new IP first
 - 2022-06-13 TUN-6373: Add edge-ip-version to remotely pushed configuration
 - 2022-06-13 TUN-6380: Enforce connect and keep-alive timeouts for TCP connections in both WARP routing and websocket based TCP proxy.
 - 2022-06-11 Update issue templates
 - 2022-06-11 Amendment to previous PR
 - 2022-06-09 TUN-6347: Add TCP stream logs with FlowID
 - 2022-06-08 TUN-6361: Add cloudflared arm builds to pkging as well
 - 2022-06-07 TUN-6357: Add connector id to ready check endpoint
 - 2022-06-07 TUN-6010: Add component tests for --edge-ip-version
 - 2022-06-06 TUN-6191: Update quic-go to v0.27.1 and with custom patch to allow keep alive period to be configurable
 - 2022-06-03 TUN-6343: Fix QUIC->HTTP2 fallback
 - 2022-06-02 TUN-6339: Add config for IPv6 support
 - 2022-06-02 TUN-6341: Fix default config value for edge-ip-version
 - 2022-06-01 TUN-6323: Add Xenial and Trusty for Ubuntu pkging
 - 2022-05-31 TUN-6210: Add cloudflared.repo to make it easy for yum installs
 - 2022-05-30 TUN-6293: Update yaml v3 to latest hotfix
 - 2022-05-20 TUN-6007: Implement new edge discovery algorithm
 2022.5.3
 - 2022-05-30 TUN-6308: Add debug logs to see if packets are sent/received from edge
 - 2022-05-30 TUN-6301: Allow to update logger used by UDP session manager
 2022.5.2
 - 2022-05-23 TUN-6270: Import gpg keys from environment variables
 - 2022-05-24 TUN-6209: Improve feedback process if release_pkgs to deb and rpm fail
 - 2022-05-24 TUN-6280: Don't wrap qlog connection tracer for gatethering QUIC metrics since we're not writing qlog files.
 - 2022-05-25 TUN-6209: Sign RPM packages
 - 2022-05-25 TUN-6285: Upload pkg assets to repos when cloudflared is released.
 - 2022-05-24 TUN-6282: Upgrade golang to 1.17.10, go-boring to 1.17.9
 - 2022-05-26 TUN-6292: Debug builds for cloudflared
 - 2022-05-28 TUN-6304: Fixed some file permission issues
 - 2022-05-11 TUN-6197: Publish to brew core should not try to open the browser
 - 2022-05-12 TUN-5943: Add RPM support
 - 2022-05-18 TUN-6248: Fix panic in cloudflared during tracing when origin doesn't provide header map
 - 2022-05-18 TUN-6250: Add upstream response status code to tracing span attributes
 2022.5.1
 - 2022-05-06 TUN-6146: Release_pkgs is now a generic command line script
 - 2022-05-06 TUN-6185: Fix tcpOverWSOriginService not using original scheme for String representation
 - 2022-05-05 TUN-6175: Simply debian packaging by structural upload
 - 2022-05-05 TUN-5945: Added support for Ubuntu releases
 - 2022-05-04 TUN-6054: Create and upload deb packages to R2
 - 2022-05-03 TUN-6161: Set git user/email for brew core release
 - 2022-05-03 TUN-6166: Fix mocked QUIC transport for UDP proxy manager to return expected error
 - 2022-04-27 TUN-6016: Push local managed tunnels configuration to the edge
 2022.5.0
 - 2022-05-02 TUN-6158: Update golang.org/x/crypto
 - 2022-04-20 VULN-8383 Bump yaml.v2 to yaml.v3
 - 2022-04-21 TUN-6123: For a given connection with edge, close all datagram sessions through this connection when it's closed
 - 2022-04-20 TUN-6015: Add RPC method for pushing local config
 - 2022-04-21 TUN-6130: Fix vendoring due to case sensitive typo in package
 - 2022-04-27 TUN-6142: Add tunnel details support to RPC
 - 2022-04-28 TUN-6014: Add remote config flag as default feature
 - 2022-04-12 TUN-6000: Another fix for publishing to brew core
 - 2022-04-11 TUN-5990: Add otlp span export to response header
 - 2022-04-19 TUN-6070: First connection retries other edge IPs if the error is quic timeout(likely due to firewall blocking UDP)
 - 2022-04-11 TUN-6030: Add ttfb span for origin http request
 2022.4.1
 - 2022-04-11 TUN-6035: Reduce buffer size when proxying data
 - 2022-04-11 TUN-6038: Reduce buffer size used for proxying data
 - 2022-04-11 TUN-6043: Allow UI-managed Tunnels to fallback from QUIC but warn about that
 - 2022-04-07 TUN-6000 add version argument to bump-formula-pr
 - 2022-04-06 TUN-5989: Add in-memory otlp exporter
 2022.4.0
 - 2022-04-01 TUN-5973: Add backoff for non-recoverable errors as well
 - 2022-04-05 TUN-5992: Use QUIC protocol for remotely managed tunnels when protocol is unspecified
 - 2022-04-06 Update Makefile
 - 2022-04-06 TUN-5995: Update prometheus to 1.12.1 to avoid vulnerabilities
 - 2022-04-07 TUN-5995: Force prometheus v1.12.1 usage
 - 2022-04-07 TUN-4130: cloudflared docker images now have a latest tag
 - 2022-03-30 TUN-5842: Fix flaky TestConcurrentUpdateAndRead by making sure resources are released
 - 2022-03-30 carrier: fix dropped errors
 - 2022-03-25 TUN-5959: tidy go.mod
 - 2022-03-25 TUN-5958: Fix release to homebrew core
 - 2022-03-28 TUN-5960: Do not log the tunnel token or json credentials
 - 2022-03-28 TUN-5956: Add timeout to session manager APIs
 2022.3.4
 - 2022-03-22 TUN-5918: Clean up text in cloudflared tunnel --help
 - 2022-03-22 TUN-5895 run brew bump-formula-pr on release
 - 2022-03-22 TUN-5915: New cloudflared command to allow to retrieve the token credentials for a Tunnel
 - 2022-03-24 TUN-5933: Better messaging to help user when installing service if it is already installed
 - 2022-03-25 TUN-5954: Start cloudflared service in Linux too similarly to other OSs
 - 2022-03-14 TUN-5869: Add configuration endpoint in metrics server
 2022.3.3
 - 2022-03-17 TUN-5893: Start windows service on install, stop on uninstall. Previously user had to manually start the service after running 'cloudflared tunnel install' and stop the service before running uninstall command.
 - 2022-03-17 Revert "CC-796: Remove dependency on unsupported version of go-oidc"
 - 2022-03-18 TUN-5881: Clarify success (or lack thereof) of (un)installing cloudflared service
 - 2022-03-18 CC-796: Remove dependency on unsupported version of go-oidc
 - 2022-03-18 TUN-5907: Change notes for 2022.3.3
 2022.3.2
 - 2022-03-10 TUN-5833: Create constant for allow-remote-config
 - 2022-03-15 TUN-5867: Return error if service was already installed
 - 2022-03-16 TUN-5833: Send feature `allow_remote_config` if Tunnel is run with --token
 - 2022-03-08 TUN-5849: Remove configuration debug log
 - 2022-03-08 TUN-5850: Update CHANGES.md with latest releases
 - 2022-03-08 TUN-5851: Update all references to point to Apache License 2.0
 - 2022-03-07 TUN-5853 Add "install" make target and build package manager info into executable
 - 2022-03-08 TUN-5801: Add custom wrapper for OriginConfig for JSON serde
 - 2022-03-09 TUN-5703: Add prometheus metric for current configuration version
 - 2022-02-05 CC-796: Remove dependency on unsupported version of go-oidc
 2022.3.1
 - 2022-03-04 TUN-5837: Log panic recovery in http2 logic with debug level log
 - 2022-03-04  TUN-5696: HTTP/2 Configuration Update
 - 2022-03-04 TUN-5836: Avoid websocket#Stream function from crashing cloudflared with unexpected memory access
 - 2022-03-05 TUN-5836: QUIC transport no longer sets body to nil in any condition
 2022.3.0
 - 2022-03-02 TUN-5680: Adapt component tests for new service install based on token
 - 2022-02-21 TUN-5682: Remove name field from credentials
 - 2022-02-21 TUN-5681: Add support for running tunnel using Token
 - 2022-02-28 TUN-5824: Update updater no-update-in-shell link
 - 2022-02-28 TUN-5823: Warn about legacy flags that are ignored when ingress rules are used
 - 2022-02-28 TUN-5737: Support https protocol over unix socket origin
 - 2022-02-23 TUN-5679: Add support for service install using Tunnel Token
 2022.2.2
 - 2022-02-22 TUN-5754: Allow ingress validate to take plaintext option
 - 2022-02-17 TUN-5678: Cloudflared uses typed tunnel API
 2022.2.1
 - 2022-02-10 TUN-5184: Handle errors in bidrectional streaming (websocket#Stream) gracefully when 1 side has ended
 - 2022-02-14 Update issue templates
 - 2022-02-14 Update issue templates
 - 2022-02-11 TUN-5768: Update cloudflared license file
 - 2022-02-11 TUN-5698: Make ingress rules and warp routing dynamically configurable
 - 2022-02-14 TUN-5678: Adapt cloudflared to use new typed APIs
 - 2022-02-17 Revert "TUN-5678: Adapt cloudflared to use new typed APIs"
 - 2022-02-11 TUN-5697: Listen for UpdateConfiguration RPC in quic transport
 - 2022-02-04 TUN-5744: Add a test to make sure cloudflared uses scheme defined in ingress rule, not X-Forwarded-Proto header
 - 2022-02-07 TUN-5749: Refactor cloudflared to pave way for reconfigurable ingress - Split origin into supervisor and proxy packages - Create configManager to handle dynamic config
 - 2021-10-19 TUN-5184: Make sure outstanding websocket write is finished, and no more writes after shutdown
 2022.2.0
 - 2022-02-02 TUN-4947: Use http when talking to Unix sockets origins
 - 2022-02-02 TUN-5695: Define RPC method to update configuration
 - 2022-01-27 TUN-5621: Correctly manage QUIC stream closing
 - 2022-01-28 TUN-5702: Allow to deserialize config from JSON
 2022.1.3
 - 2022-01-21 TUN-5477: Unhide vnet commands
 - 2022-01-24 TUN-5669: Change network command to vnet
 - 2022-01-25 TUN-5675: Remove github.com/dgrijalva/jwt-go dependency by upgrading coredns version
 - 2022-01-27 TUN-5719: Re-attempt connection to edge with QUIC despite network error when there is no fallback
 - 2022-01-28 TUN-5724: Fix SSE streaming by guaranteeing we write everything we read
 - 2022-01-17 TUN-5547: Bump golang x/net package to fix http2 transport bugs
 - 2022-01-19 TUN-5659: Proxy UDP with zero-byte payload
 - 2021-10-22 Add X-Forwarded-Host for http proxy
 2022.1.2
 - 2022-01-13 TUN-5650: Fix pynacl version to 1.4.0 and pygithub version to 1.55 so release doesn't break unexpectedly
 2022.1.1
 - 2022-01-10 TUN-5631: Build everything with go 1.17.5
 - 2022-01-06 TUN-5623: Configure quic max datagram frame size to 1350 bytes for none Windows platforms
 2022.1.0
 - 2022-01-03 TUN-5612: Add support for specifying TLS min/max version
 - 2022-01-03 TUN-5612: Make tls min/max version public visible
 - 2022-01-03 TUN-5551: Internally published debian artifacts are now named just cloudflared even though they are FIPS compliant
 - 2022-01-04 TUN-5600: Close QUIC transports as soon as possible while respecting graceful shutdown
 - 2022-01-05 TUN-5616: Never fallback transport if user chooses it on purpose
 - 2022-01-05 TUN-5204: Unregister QUIC transports on disconnect
 - 2022-01-04 TUN-5600: Add coverage to component tests for various transports
 2021.12.4
 - 2021-12-27 TUN-5482: Refactor tunnelstore client related packages for more coherent package
 - 2021-12-27 TUN-5551: Change internally published debian package to be FIPS compliant
 - 2021-12-27 TUN-5551: Show whether the binary was built for FIPS compliance
 2021.12.3
 - 2021-12-22 TUN-5584: Changes for release 2021.12.2
 - 2021-12-22 TUN-5590: QUIC datagram max user payload is 1217 bytes
 - 2021-12-22 TUN-5593: Read full packet from UDP connection, even if it exceeds MTU of the transport. When packet length is greater than the MTU of the transport, we will silently drop packets (for now).
 - 2021-12-23 TUN-5597: Log session ID when session is terminated by edge
 2021.12.2
 - 2021-12-20 TUN-5571: Remove redundant session manager log, it's already logged in origin/tunnel.ServeQUIC
 - 2021-12-20 TUN-5570: Only log RPC server events at error level to reduce noise
 - 2021-12-14 TUN-5494: Send a RPC with terminate reason to edge if the session is closed locally
 - 2021-11-09 TUN-5551: Reintroduce FIPS compliance for linux amd64 now as separate binaries
 2021.12.1
 - 2021-12-16 TUN-5549: Revert "TUN-5277: Ensure cloudflared binary is FIPS compliant on linux amd64"
 2021.12.0
 - 2021-12-13 TUN-5530: Get current time from ticker
 - 2021-12-15 TUN-5544: Update CHANGES.md for next release
 - 2021-12-07 TUN-5519: Adjust URL for virtual_networks endpoint to match what we will publish
 - 2021-12-02 TUN-5488: Close session after it's idle for a period defined by registerUdpSession RPC
 - 2021-12-09 TUN-5504: Fix upload of packages to public repo
 - 2021-11-30 TUN-5481: Create abstraction for Origin UDP Connection
 - 2021-11-30 TUN-5422: Define RPC to unregister session
 - 2021-11-26 TUN-5361: Commands for managing virtual networks
 - 2021-11-29 TUN-5362: Adjust route ip commands to be aware of virtual networks
 - 2021-11-23 TUN-5301: Separate datagram multiplex and session management logic from quic connection logic
 - 2021-11-10 TUN-5405: Update net package to v0.0.0-20211109214657-ef0fda0de508
 - 2021-11-10 TUN-5408: Update quic package to v0.24.0
 - 2021-11-12 Fix typos
 - 2021-11-13 Fix for Issue #501: Unexpected User-agent insertion when tunneling http request
 - 2021-11-16 TUN-5129: Remove `-dev` suffix when computing version and Git has uncommitted changes
 - 2021-11-18 TUN-5441: Fix message about available protocols
 - 2021-11-12 TUN-5300: Define RPC to register UDP sessions
 - 2021-11-14 TUN-5299: Send/receive QUIC datagram from edge and proxy to origin as UDP
 - 2021-11-04 TUN-5387: Updated CHANGES.md for 2021.11.0
 - 2021-11-08 TUN-5368: Log connection issues with LogLevel that depends on tunnel state
 - 2021-11-09 TUN-5397: Log cloudflared output when it fails to connect tunnel
 - 2021-11-09 TUN-5277: Ensure cloudflared binary is FIPS compliant on linux amd64
 - 2021-11-08 TUN-5393: Content-length is no longer a control header for non-h2mux transports
 2021.11.0
 - 2021-11-03 TUN-5285: Fallback to HTTP2 immediately if connection times out with no network activity
 - 2021-09-29 Add flag to 'tunnel create' subcommand to specify a base64-encoded secret
 2021.10.5
 - 2021-10-25 Update change log for release 2021.10.4
 - 2021-10-25 Revert "TUN-5184: Make sure outstanding websocket write is finished, and no more writes after shutdown"
 2021.10.4
 - 2021-10-21 TUN-5287: Fix misuse of wait group in TestQUICServer that caused the test to exit immediately
 - 2021-10-21 TUN-5286: Upgrade crypto/ssh package to fix CVE-2020-29652
 - 2021-10-18 TUN-5262: Allow to configure max fetch size for listing queries
 - 2021-10-19 TUN-5262: Improvements to `max-fetch-size` that allow to deal with large number of tunnels in account
 - 2021-10-15 TUN-5261: Collect QUIC metrics about RTT, packets and bytes transfered and log events at tracing level
 - 2021-10-19 TUN-5184: Make sure outstanding websocket write is finished, and no more writes after shutdown
 2021.10.3
 - 2021-10-14 TUN-5255: Fix potential panic if Cloudflare API fails to respond to GetTunnel(id) during delete command
 - 2021-10-14 TUN-5257: Fix more cfsetup targets that were broken by recent package changes
 2021.10.2
 - 2021-10-11 TUN-5138: Switch to QUIC on auto protocol based on threshold
 - 2021-10-14 TUN-5250: Add missing packages for cfsetup to succeed in github release pkgs target
--- a/build-packages.sh
+++ b/build-packages.sh
@ -0,0 +1,40 @@
 VERSION=$(git describe --tags --always --dirty="-dev" --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
 export CGO_ENABLED=0
 # This controls the directory the built artifacts go into
 export ARTIFACT_DIR=built_artifacts/
 mkdir -p $ARTIFACT_DIR
 windowsArchs=("amd64" "386")
 export TARGET_OS=windows
 for arch in ${windowsArchs[@]}; do 
    export TARGET_ARCH=$arch
    make cloudflared-msi
    mv ./cloudflared.exe $ARTIFACT_DIR/cloudflared-windows-$arch.exe
    mv cloudflared-$VERSION-$arch.msi $ARTIFACT_DIR/cloudflared-windows-$arch.msi
 done
 export FIPS=true
 linuxArchs=("amd64" "386" "arm" "arm64")
 export TARGET_OS=linux
 for arch in ${linuxArchs[@]}; do 
    export TARGET_ARCH=$arch
    make cloudflared-deb
    mv cloudflared\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-linux-$arch.deb
    # rpm packages invert the - and _ and use x86_64 instead of amd64. 
    RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
    RPMARCH=$arch
    if [ $arch == "amd64" ];then
        RPMARCH="x86_64"
    fi
    if [ $arch == "arm64" ]; then
        RPMARCH="aarch64"
    fi
    make cloudflared-rpm
    mv cloudflared-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-linux-$RPMARCH.rpm
    # finally move the linux binary as well.
    mv ./cloudflared $ARTIFACT_DIR/cloudflared-linux-$arch
 done
--- a/carrier/carrier.go
+++ b/carrier/carrier.go
@ -1,6 +1,6 @@
-// Package carrier provides a WebSocket proxy to carry or proxy a connection
+//Package carrier provides a WebSocket proxy to carry or proxy a connection
-// from the local client to the edge. See it as a wrapper around any protocol
+//from the local client to the edge. See it as a wrapper around any protocol
-// that it packages up in a WebSocket connection to the edge.
+//that it packages up in a WebSocket connection to the edge.
 package carrier
 import (
@ -26,13 +26,11 @@ const (
 )
 type StartOptions struct {
-	AppInfo               *token.AppInfo
+	AppInfo         *token.AppInfo
-	OriginURL             string
+	OriginURL       string
-	Headers               http.Header
+	Headers         http.Header
-	Host                  string
+	Host            string
-	TLSClientConfig       *tls.Config
+	TLSClientConfig *tls.Config
 	AutoCloseInterstitial bool
 	IsFedramp             bool
 }
 // Connection wraps up all the needed functions to forward over the tunnel
@ -48,6 +46,7 @@ type StdinoutStream struct{}
 // Read will read from Stdin
 func (c *StdinoutStream) Read(p []byte) (int, error) {
 	return os.Stdin.Read(p)
 }
 // Write will write to Stdout
@ -55,7 +54,7 @@ func (c *StdinoutStream) Write(p []byte) (int, error) {
 	return os.Stdout.Write(p)
 }
-// Helper to allow deferring the response close with a check that the resp is not nil
+// Helper to allow defering the response close with a check that the resp is not nil
 func closeRespBody(resp *http.Response) {
 	if resp != nil {
 		_ = resp.Body.Close()
@ -140,7 +139,7 @@ func BuildAccessRequest(options *StartOptions, log *zerolog.Logger) (*http.Reque
 		return nil, err
 	}
-	token, err := token.FetchTokenWithRedirect(req.URL, options.AppInfo, options.AutoCloseInterstitial, options.IsFedramp, log)
+	token, err := token.FetchTokenWithRedirect(req.URL, options.AppInfo, log)
 	if err != nil {
 		return nil, err
 	}
--- a/carrier/websocket.go
+++ b/carrier/websocket.go
@ -9,7 +9,6 @@ import (
 	"github.com/gorilla/websocket"
 	"github.com/rs/zerolog"
 	"github.com/cloudflare/cloudflared/stream"
 	"github.com/cloudflare/cloudflared/token"
 	cfwebsocket "github.com/cloudflare/cloudflared/websocket"
 )
@ -38,7 +37,7 @@ func (ws *Websocket) ServeStream(options *StartOptions, conn io.ReadWriter) erro
 	}
 	defer wsConn.Close()
-	stream.Pipe(wsConn, conn, ws.log)
+	cfwebsocket.Stream(wsConn, conn, ws.log)
 	return nil
 }
@ -56,9 +55,6 @@ func createWebsocketStream(options *StartOptions, log *zerolog.Logger) (*cfwebso
 	}
 	dump, err := httputil.DumpRequest(req, false)
 	if err != nil {
 		return nil, err
 	}
 	log.Debug().Msgf("Websocket request: %s", string(dump))
 	dialer := &websocket.Dialer{
@ -186,9 +182,6 @@ func createAccessWebSocketStream(options *StartOptions, log *zerolog.Logger) (*w
 	}
 	dump, err := httputil.DumpRequest(req, false)
 	if err != nil {
 		return nil, nil, err
 	}
 	log.Debug().Msgf("Access Websocket request: %s", string(dump))
 	conn, resp, err := clientConnect(req, nil)
--- a/catalog-info.yaml
+++ b/catalog-info.yaml
@ -1,20 +0,0 @@
 apiVersion: backstage.io/v1alpha1
 kind: Component
 metadata:
  name: cloudflared
  description: Client for Cloudflare Tunnels
  annotations:
    cloudflare.com/software-excellence-opt-in: "true"
    cloudflare.com/jira-project-key: "TUN"
    cloudflare.com/jira-project-component: "Cloudflare Tunnel"
  tags:
    - internal
 spec:
  type: "service"
  lifecycle: "Active"
  owner: "teams/tunnel-teams-routing"
  cf:
    compliance:
      fedramp-high: "pending"
      fedramp-moderate: "yes"
    FIPS: "required"
--- a/certutil/certutil.go
+++ b/certutil/certutil.go
@ -0,0 +1,94 @@
 package certutil
 import (
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
 	"fmt"
 	"strings"
 )
 type namedTunnelToken struct {
 	ZoneID     string `json:"zoneID"`
 	AccountID  string `json:"accountID"`
 	ServiceKey string `json:"serviceKey"`
 }
 type OriginCert struct {
 	PrivateKey interface{}
 	Cert       *x509.Certificate
 	ZoneID     string
 	ServiceKey string
 	AccountID  string
 }
 func DecodeOriginCert(blocks []byte) (*OriginCert, error) {
 	if len(blocks) == 0 {
 		return nil, fmt.Errorf("Cannot decode empty certificate")
 	}
 	originCert := OriginCert{}
 	block, rest := pem.Decode(blocks)
 	for {
 		if block == nil {
 			break
 		}
 		switch block.Type {
 		case "PRIVATE KEY":
 			if originCert.PrivateKey != nil {
 				return nil, fmt.Errorf("Found multiple private key in the certificate")
 			}
 			// RSA private key
 			privateKey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
 			if err != nil {
 				return nil, fmt.Errorf("Cannot parse private key")
 			}
 			originCert.PrivateKey = privateKey
 		case "CERTIFICATE":
 			if originCert.Cert != nil {
 				return nil, fmt.Errorf("Found multiple certificates in the certificate")
 			}
 			cert, err := x509.ParseCertificates(block.Bytes)
 			if err != nil {
 				return nil, fmt.Errorf("Cannot parse certificate")
 			} else if len(cert) > 1 {
 				return nil, fmt.Errorf("Found multiple certificates in the certificate")
 			}
 			originCert.Cert = cert[0]
 		case "WARP TOKEN", "ARGO TUNNEL TOKEN":
 			if originCert.ZoneID != "" || originCert.ServiceKey != "" {
 				return nil, fmt.Errorf("Found multiple tokens in the certificate")
 			}
 			// The token is a string,
 			// Try the newer JSON format
 			ntt := namedTunnelToken{}
 			if err := json.Unmarshal(block.Bytes, &ntt); err == nil {
 				originCert.ZoneID = ntt.ZoneID
 				originCert.ServiceKey = ntt.ServiceKey
 				originCert.AccountID = ntt.AccountID
 			} else {
 				// Try the older format, where the zoneID and service key are seperated by
 				// a new line character
 				token := string(block.Bytes)
 				s := strings.Split(token, "\n")
 				if len(s) != 2 {
 					return nil, fmt.Errorf("Cannot parse token")
 				}
 				originCert.ZoneID = s[0]
 				originCert.ServiceKey = s[1]
 			}
 		default:
 			return nil, fmt.Errorf("Unknown block %s in the certificate", block.Type)
 		}
 		block, rest = pem.Decode(rest)
 	}
 	if originCert.PrivateKey == nil {
 		return nil, fmt.Errorf("Missing private key in the certificate")
 	} else if originCert.Cert == nil {
 		return nil, fmt.Errorf("Missing certificate in the certificate")
 	} else if originCert.ZoneID == "" || originCert.ServiceKey == "" {
 		return nil, fmt.Errorf("Missing token in the certificate")
 	}
 	return &originCert, nil
 }
--- a/certutil/certutil_test.go
+++ b/certutil/certutil_test.go
@ -0,0 +1,67 @@
 package certutil
 import (
 	"fmt"
 	"io/ioutil"
 	"testing"
 	"github.com/stretchr/testify/assert"
 )
 func TestLoadOriginCert(t *testing.T) {
 	cert, err := DecodeOriginCert([]byte{})
 	assert.Equal(t, fmt.Errorf("Cannot decode empty certificate"), err)
 	assert.Nil(t, cert)
 	blocks, err := ioutil.ReadFile("test-cert-no-key.pem")
 	assert.Nil(t, err)
 	cert, err = DecodeOriginCert(blocks)
 	assert.Equal(t, fmt.Errorf("Missing private key in the certificate"), err)
 	assert.Nil(t, cert)
 	blocks, err = ioutil.ReadFile("test-cert-two-certificates.pem")
 	assert.Nil(t, err)
 	cert, err = DecodeOriginCert(blocks)
 	assert.Equal(t, fmt.Errorf("Found multiple certificates in the certificate"), err)
 	assert.Nil(t, cert)
 	blocks, err = ioutil.ReadFile("test-cert-unknown-block.pem")
 	assert.Nil(t, err)
 	cert, err = DecodeOriginCert(blocks)
 	assert.Equal(t, fmt.Errorf("Unknown block RSA PRIVATE KEY in the certificate"), err)
 	assert.Nil(t, cert)
 	blocks, err = ioutil.ReadFile("test-cert.pem")
 	assert.Nil(t, err)
 	cert, err = DecodeOriginCert(blocks)
 	assert.Nil(t, err)
 	assert.NotNil(t, cert)
 	assert.Equal(t, "7b0a4d77dfb881c1a3b7d61ea9443e19", cert.ZoneID)
 	key := "v1.0-58bd4f9e28f7b3c28e05a35ff3e80ab4fd9644ef3fece537eb0d12e2e9258217-183442fbb0bbdb3e571558fec9b5589ebd77aafc87498ee3f09f64a4ad79ffe8791edbae08b36c1d8f1d70a8670de56922dff92b15d214a524f4ebfa1958859e-7ce80f79921312a6022c5d25e2d380f82ceaefe3fbdc43dd13b080e3ef1e26f7"
 	assert.Equal(t, key, cert.ServiceKey)
 }
 func TestNewlineArgoTunnelToken(t *testing.T) {
 	ArgoTunnelTokenTest(t, "test-argo-tunnel-cert.pem")
 }
 func TestJSONArgoTunnelToken(t *testing.T) {
 	// The given cert's Argo Tunnel Token was generated by base64 encoding this JSON:
 	// {
 	// "zoneID": "7b0a4d77dfb881c1a3b7d61ea9443e19",
 	// "serviceKey": "test-service-key",
 	// "accountID": "abcdabcdabcdabcd1234567890abcdef"
 	// }
 	ArgoTunnelTokenTest(t, "test-argo-tunnel-cert-json.pem")
 }
 func ArgoTunnelTokenTest(t *testing.T, path string) {
 	blocks, err := ioutil.ReadFile(path)
 	assert.Nil(t, err)
 	cert, err := DecodeOriginCert(blocks)
 	assert.Nil(t, err)
 	assert.NotNil(t, cert)
 	assert.Equal(t, "7b0a4d77dfb881c1a3b7d61ea9443e19", cert.ZoneID)
 	key := "test-service-key"
 	assert.Equal(t, key, cert.ServiceKey)
 }
--- a/certutil/test-argo-tunnel-cert-json.pem
+++ b/certutil/test-argo-tunnel-cert-json.pem
@ -0,0 +1,57 @@
 -----BEGIN PRIVATE KEY-----
 MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCfGswL16Fz9Ei3
 sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng6yHR1H5oX1Lg
 1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bxtG0uyrXYh7Mt
 z0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyXPE6SuDvMHIeX
 6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZAzNOxVKrUsyS
 x7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOglHJ2n0sMcZ+Ja
 1Y649mPVAgMBAAECggEAEbPF0ah9fH0IzTU/CPbIeh3flyY8GDuMpR1HvwUurSWB
 IFI9bLyVAXKb8vYP1TMaTnXi5qmFof+/JShgyZc3+1tZtWTfoaiC8Y1bRfE2yk+D
 xmwddhDmijYGG7i8uEaeddSdFEh2GKAqkbV/QgBvN2Nl4EVmIOAJXXNe9l5LFyjy
 sR10aNVJRYV1FahrCTwZ3SovHP4d4AUvHh/3FFZDukHc37CFA0+CcR4uehp5yedi
 2UdqaszXqunFo/3h+Tn9dW2C7gTTZx4+mfyaws3p3YOmdYArXvpejxHIc0FGwLBm
 sb9K7wGVUiF0Bt0ch+C1mdYrCaFNHnPuDswjmm3FwQKBgQDYtxOwwSLA6ZyppozX
 Doyx9a7PhiMHCFKSdVB4l8rpK545a+AmpG6LRScTtBsMTHBhT3IQ3QPWlVm1AhjF
 AvXMa1rOeaGbCbDn1xqEoEVPtj4tys8eTfyWmtU73jWTFauOt4/xpf/urEpg91xj
 m+Gl/8qgBrpm5rQxV5Y4MysRlQKBgQC78jzzlhocXGNvw0wT/K2NsknyeoZXqpIE
 QYL60FMl4geZn6w9hwxaL1r+g/tUjTnpBPQtS1r2Ed2gXby5zspN1g/PW8U3t3to
 P7zHIJ/sLBXrCh5RJko3hUgGhDNOOCIQj4IaKUfvHYvEIbIxlyI0vdsXsgXgMuQ8
 pb9Yifn5QQKBgQCmGu0EtYQlyOlDP10EGSrN3Dm45l9CrKZdi326cN4eCkikSoLs
 G2x/YumouItiydP5QiNzuXOPrbmse4bwumwb2s0nJSMw6iSmDsFMlmuJxW2zO5e0
 6qGH7fUyhgcaTanJIfk6hrm7/mKkH/S4hGpYCc8NCRsmc/35M+D4AoAoYQKBgQC0
 LWpZaxDlF30MbAHHN3l6We2iU+vup0sMYXGb2ZOcwa/fir+ozIr++l8VmJmdWTan
 OWSM96zgMghx8Os4hhJTxF+rvqK242OfcVsc2x31X94zUaP2z+peh5uhA6Pb3Nxr
 W+iyA9k+Vujiwhr+h5D3VvtvH++aG6/KpGtoCf5nAQKBgQDXX2+d7bd5CLNLLFNd
 M2i4QoOFcSKIG+v4SuvgEJHgG8vGvxh2qlSxnMWuPV+7/1P5ATLqDj1PlKms+BNR
 y7sc5AT9PclkL3Y9MNzOu0LXyBkGYcl8M0EQfLv9VPbWT+NXiMg/O2CHiT02pAAz
 uQicoQq3yzeQh20wtrtaXzTNmA==
 -----END PRIVATE KEY-----
 -----BEGIN CERTIFICATE-----
 MIID+jCCA6CgAwIBAgIUJhFxUKEGvTRc3CjCok6dbPGH/P4wCgYIKoZIzj0EAwIw
 gagxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYD
 VQQLEy9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhv
 cml0eTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZvcm5p
 YTEXMBUGA1UEAxMOKGRldiB1c2Ugb25seSkwHhcNMTcxMDEzMTM1OTAwWhcNMzIx
 MDA5MTM1OTAwWjBiMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMR0wGwYDVQQL
 ExRDbG91ZEZsYXJlIE9yaWdpbiBDQTEmMCQGA1UEAxMdQ2xvdWRGbGFyZSBPcmln
 aW4gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCf
 GswL16Fz9Ei3sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng
 6yHR1H5oX1Lg1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bx
 tG0uyrXYh7Mtz0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyX
 PE6SuDvMHIeX6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZ
 AzNOxVKrUsySx7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOgl
 HJ2n0sMcZ+Ja1Y649mPVAgMBAAGjggEgMIIBHDAOBgNVHQ8BAf8EBAMCBaAwEwYD
 VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUzA6f2Ajq
 zhX67c6piY2a1uTiUkwwHwYDVR0jBBgwFoAU2qfBlqxKMZnf0QeTeYiMelfqJfgw
 RAYIKwYBBQUHAQEEODA2MDQGCCsGAQUFBzABhihodHRwOi8vb2NzcC5jbG91ZGZs
 YXJlLmNvbS9vcmlnaW5fZWNjX2NhMCMGA1UdEQQcMBqCDCouYXJub2xkLmNvbYIK
 YXJub2xkLmNvbTA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmNsb3VkZmxh
 cmUuY29tL29yaWdpbl9lY2NfY2EuY3JsMAoGCCqGSM49BAMCA0gAMEUCIDV7HoMj
 K5rShE/l+90YAOzHC89OH/wUz3I5KYOFuehoAiEA8e92aIf9XBkr0K6EvFCiSsD+
 x+Yo/cL8fGfVpPt4UM8=
 -----END CERTIFICATE-----
 -----BEGIN ARGO TUNNEL TOKEN-----
 eyJ6b25lSUQiOiAiN2IwYTRkNzdkZmI4ODFjMWEzYjdkNjFlYTk0NDNlMTkiLCAi
 c2VydmljZUtleSI6ICJ0ZXN0LXNlcnZpY2Uta2V5IiwgImFjY291bnRJRCI6ICJh
 YmNkYWJjZGFiY2RhYmNkMTIzNDU2Nzg5MGFiY2RlZiJ9
 -----END ARGO TUNNEL TOKEN-----
--- a/certutil/test-argo-tunnel-cert.pem
+++ b/certutil/test-argo-tunnel-cert.pem
@ -0,0 +1,56 @@
 -----BEGIN PRIVATE KEY-----
 MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCfGswL16Fz9Ei3
 sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng6yHR1H5oX1Lg
 1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bxtG0uyrXYh7Mt
 z0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyXPE6SuDvMHIeX
 6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZAzNOxVKrUsyS
 x7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOglHJ2n0sMcZ+Ja
 1Y649mPVAgMBAAECggEAEbPF0ah9fH0IzTU/CPbIeh3flyY8GDuMpR1HvwUurSWB
 IFI9bLyVAXKb8vYP1TMaTnXi5qmFof+/JShgyZc3+1tZtWTfoaiC8Y1bRfE2yk+D
 xmwddhDmijYGG7i8uEaeddSdFEh2GKAqkbV/QgBvN2Nl4EVmIOAJXXNe9l5LFyjy
 sR10aNVJRYV1FahrCTwZ3SovHP4d4AUvHh/3FFZDukHc37CFA0+CcR4uehp5yedi
 2UdqaszXqunFo/3h+Tn9dW2C7gTTZx4+mfyaws3p3YOmdYArXvpejxHIc0FGwLBm
 sb9K7wGVUiF0Bt0ch+C1mdYrCaFNHnPuDswjmm3FwQKBgQDYtxOwwSLA6ZyppozX
 Doyx9a7PhiMHCFKSdVB4l8rpK545a+AmpG6LRScTtBsMTHBhT3IQ3QPWlVm1AhjF
 AvXMa1rOeaGbCbDn1xqEoEVPtj4tys8eTfyWmtU73jWTFauOt4/xpf/urEpg91xj
 m+Gl/8qgBrpm5rQxV5Y4MysRlQKBgQC78jzzlhocXGNvw0wT/K2NsknyeoZXqpIE
 QYL60FMl4geZn6w9hwxaL1r+g/tUjTnpBPQtS1r2Ed2gXby5zspN1g/PW8U3t3to
 P7zHIJ/sLBXrCh5RJko3hUgGhDNOOCIQj4IaKUfvHYvEIbIxlyI0vdsXsgXgMuQ8
 pb9Yifn5QQKBgQCmGu0EtYQlyOlDP10EGSrN3Dm45l9CrKZdi326cN4eCkikSoLs
 G2x/YumouItiydP5QiNzuXOPrbmse4bwumwb2s0nJSMw6iSmDsFMlmuJxW2zO5e0
 6qGH7fUyhgcaTanJIfk6hrm7/mKkH/S4hGpYCc8NCRsmc/35M+D4AoAoYQKBgQC0
 LWpZaxDlF30MbAHHN3l6We2iU+vup0sMYXGb2ZOcwa/fir+ozIr++l8VmJmdWTan
 OWSM96zgMghx8Os4hhJTxF+rvqK242OfcVsc2x31X94zUaP2z+peh5uhA6Pb3Nxr
 W+iyA9k+Vujiwhr+h5D3VvtvH++aG6/KpGtoCf5nAQKBgQDXX2+d7bd5CLNLLFNd
 M2i4QoOFcSKIG+v4SuvgEJHgG8vGvxh2qlSxnMWuPV+7/1P5ATLqDj1PlKms+BNR
 y7sc5AT9PclkL3Y9MNzOu0LXyBkGYcl8M0EQfLv9VPbWT+NXiMg/O2CHiT02pAAz
 uQicoQq3yzeQh20wtrtaXzTNmA==
 -----END PRIVATE KEY-----
 -----BEGIN CERTIFICATE-----
 MIID+jCCA6CgAwIBAgIUJhFxUKEGvTRc3CjCok6dbPGH/P4wCgYIKoZIzj0EAwIw
 gagxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYD
 VQQLEy9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhv
 cml0eTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZvcm5p
 YTEXMBUGA1UEAxMOKGRldiB1c2Ugb25seSkwHhcNMTcxMDEzMTM1OTAwWhcNMzIx
 MDA5MTM1OTAwWjBiMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMR0wGwYDVQQL
 ExRDbG91ZEZsYXJlIE9yaWdpbiBDQTEmMCQGA1UEAxMdQ2xvdWRGbGFyZSBPcmln
 aW4gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCf
 GswL16Fz9Ei3sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng
 6yHR1H5oX1Lg1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bx
 tG0uyrXYh7Mtz0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyX
 PE6SuDvMHIeX6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZ
 AzNOxVKrUsySx7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOgl
 HJ2n0sMcZ+Ja1Y649mPVAgMBAAGjggEgMIIBHDAOBgNVHQ8BAf8EBAMCBaAwEwYD
 VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUzA6f2Ajq
 zhX67c6piY2a1uTiUkwwHwYDVR0jBBgwFoAU2qfBlqxKMZnf0QeTeYiMelfqJfgw
 RAYIKwYBBQUHAQEEODA2MDQGCCsGAQUFBzABhihodHRwOi8vb2NzcC5jbG91ZGZs
 YXJlLmNvbS9vcmlnaW5fZWNjX2NhMCMGA1UdEQQcMBqCDCouYXJub2xkLmNvbYIK
 YXJub2xkLmNvbTA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmNsb3VkZmxh
 cmUuY29tL29yaWdpbl9lY2NfY2EuY3JsMAoGCCqGSM49BAMCA0gAMEUCIDV7HoMj
 K5rShE/l+90YAOzHC89OH/wUz3I5KYOFuehoAiEA8e92aIf9XBkr0K6EvFCiSsD+
 x+Yo/cL8fGfVpPt4UM8=
 -----END CERTIFICATE-----
 -----BEGIN ARGO TUNNEL TOKEN-----
 N2IwYTRkNzdkZmI4ODFjMWEzYjdkNjFlYTk0NDNlMTkKdGVzdC1zZXJ2aWNlLWtl
 eQ==
 -----END ARGO TUNNEL TOKEN-----
--- a/certutil/test-cert-no-key.pem
+++ b/certutil/test-cert-no-key.pem
@ -0,0 +1,33 @@
 -----BEGIN CERTIFICATE-----
 MIID+jCCA6CgAwIBAgIUJhFxUKEGvTRc3CjCok6dbPGH/P4wCgYIKoZIzj0EAwIw
 gagxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYD
 VQQLEy9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhv
 cml0eTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZvcm5p
 YTEXMBUGA1UEAxMOKGRldiB1c2Ugb25seSkwHhcNMTcxMDEzMTM1OTAwWhcNMzIx
 MDA5MTM1OTAwWjBiMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMR0wGwYDVQQL
 ExRDbG91ZEZsYXJlIE9yaWdpbiBDQTEmMCQGA1UEAxMdQ2xvdWRGbGFyZSBPcmln
 aW4gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCf
 GswL16Fz9Ei3sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng
 6yHR1H5oX1Lg1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bx
 tG0uyrXYh7Mtz0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyX
 PE6SuDvMHIeX6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZ
 AzNOxVKrUsySx7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOgl
 HJ2n0sMcZ+Ja1Y649mPVAgMBAAGjggEgMIIBHDAOBgNVHQ8BAf8EBAMCBaAwEwYD
 VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUzA6f2Ajq
 zhX67c6piY2a1uTiUkwwHwYDVR0jBBgwFoAU2qfBlqxKMZnf0QeTeYiMelfqJfgw
 RAYIKwYBBQUHAQEEODA2MDQGCCsGAQUFBzABhihodHRwOi8vb2NzcC5jbG91ZGZs
 YXJlLmNvbS9vcmlnaW5fZWNjX2NhMCMGA1UdEQQcMBqCDCouYXJub2xkLmNvbYIK
 YXJub2xkLmNvbTA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmNsb3VkZmxh
 cmUuY29tL29yaWdpbl9lY2NfY2EuY3JsMAoGCCqGSM49BAMCA0gAMEUCIDV7HoMj
 K5rShE/l+90YAOzHC89OH/wUz3I5KYOFuehoAiEA8e92aIf9XBkr0K6EvFCiSsD+
 x+Yo/cL8fGfVpPt4UM8=
 -----END CERTIFICATE-----
 -----BEGIN WARP TOKEN-----
 N2IwYTRkNzdkZmI4ODFjMWEzYjdkNjFlYTk0NDNlMTkKdjEuMC01OGJkNGY5ZTI4
 ZjdiM2MyOGUwNWEzNWZmM2U4MGFiNGZkOTY0NGVmM2ZlY2U1MzdlYjBkMTJlMmU5
 MjU4MjE3LTE4MzQ0MmZiYjBiYmRiM2U1NzE1NThmZWM5YjU1ODllYmQ3N2FhZmM4
 NzQ5OGVlM2YwOWY2NGE0YWQ3OWZmZTg3OTFlZGJhZTA4YjM2YzFkOGYxZDcwYTg2
 NzBkZTU2OTIyZGZmOTJiMTVkMjE0YTUyNGY0ZWJmYTE5NTg4NTllLTdjZTgwZjc5
 OTIxMzEyYTYwMjJjNWQyNWUyZDM4MGY4MmNlYWVmZTNmYmRjNDNkZDEzYjA4MGUz
 ZWYxZTI2Zjc=
 -----END WARP TOKEN-----
--- a/certutil/test-cert-two-certificates.pem
+++ b/certutil/test-cert-two-certificates.pem
@ -0,0 +1,85 @@
 -----BEGIN PRIVATE KEY-----
 MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCfGswL16Fz9Ei3
 sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng6yHR1H5oX1Lg
 1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bxtG0uyrXYh7Mt
 z0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyXPE6SuDvMHIeX
 6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZAzNOxVKrUsyS
 x7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOglHJ2n0sMcZ+Ja
 1Y649mPVAgMBAAECggEAEbPF0ah9fH0IzTU/CPbIeh3flyY8GDuMpR1HvwUurSWB
 IFI9bLyVAXKb8vYP1TMaTnXi5qmFof+/JShgyZc3+1tZtWTfoaiC8Y1bRfE2yk+D
 xmwddhDmijYGG7i8uEaeddSdFEh2GKAqkbV/QgBvN2Nl4EVmIOAJXXNe9l5LFyjy
 sR10aNVJRYV1FahrCTwZ3SovHP4d4AUvHh/3FFZDukHc37CFA0+CcR4uehp5yedi
 2UdqaszXqunFo/3h+Tn9dW2C7gTTZx4+mfyaws3p3YOmdYArXvpejxHIc0FGwLBm
 sb9K7wGVUiF0Bt0ch+C1mdYrCaFNHnPuDswjmm3FwQKBgQDYtxOwwSLA6ZyppozX
 Doyx9a7PhiMHCFKSdVB4l8rpK545a+AmpG6LRScTtBsMTHBhT3IQ3QPWlVm1AhjF
 AvXMa1rOeaGbCbDn1xqEoEVPtj4tys8eTfyWmtU73jWTFauOt4/xpf/urEpg91xj
 m+Gl/8qgBrpm5rQxV5Y4MysRlQKBgQC78jzzlhocXGNvw0wT/K2NsknyeoZXqpIE
 QYL60FMl4geZn6w9hwxaL1r+g/tUjTnpBPQtS1r2Ed2gXby5zspN1g/PW8U3t3to
 P7zHIJ/sLBXrCh5RJko3hUgGhDNOOCIQj4IaKUfvHYvEIbIxlyI0vdsXsgXgMuQ8
 pb9Yifn5QQKBgQCmGu0EtYQlyOlDP10EGSrN3Dm45l9CrKZdi326cN4eCkikSoLs
 G2x/YumouItiydP5QiNzuXOPrbmse4bwumwb2s0nJSMw6iSmDsFMlmuJxW2zO5e0
 6qGH7fUyhgcaTanJIfk6hrm7/mKkH/S4hGpYCc8NCRsmc/35M+D4AoAoYQKBgQC0
 LWpZaxDlF30MbAHHN3l6We2iU+vup0sMYXGb2ZOcwa/fir+ozIr++l8VmJmdWTan
 OWSM96zgMghx8Os4hhJTxF+rvqK242OfcVsc2x31X94zUaP2z+peh5uhA6Pb3Nxr
 W+iyA9k+Vujiwhr+h5D3VvtvH++aG6/KpGtoCf5nAQKBgQDXX2+d7bd5CLNLLFNd
 M2i4QoOFcSKIG+v4SuvgEJHgG8vGvxh2qlSxnMWuPV+7/1P5ATLqDj1PlKms+BNR
 y7sc5AT9PclkL3Y9MNzOu0LXyBkGYcl8M0EQfLv9VPbWT+NXiMg/O2CHiT02pAAz
 uQicoQq3yzeQh20wtrtaXzTNmA==
 -----END PRIVATE KEY-----
 -----BEGIN CERTIFICATE-----
 MIID+jCCA6CgAwIBAgIUJhFxUKEGvTRc3CjCok6dbPGH/P4wCgYIKoZIzj0EAwIw
 gagxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYD
 VQQLEy9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhv
 cml0eTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZvcm5p
 YTEXMBUGA1UEAxMOKGRldiB1c2Ugb25seSkwHhcNMTcxMDEzMTM1OTAwWhcNMzIx
 MDA5MTM1OTAwWjBiMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMR0wGwYDVQQL
 ExRDbG91ZEZsYXJlIE9yaWdpbiBDQTEmMCQGA1UEAxMdQ2xvdWRGbGFyZSBPcmln
 aW4gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCf
 GswL16Fz9Ei3sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng
 6yHR1H5oX1Lg1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bx
 tG0uyrXYh7Mtz0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyX
 PE6SuDvMHIeX6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZ
 AzNOxVKrUsySx7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOgl
 HJ2n0sMcZ+Ja1Y649mPVAgMBAAGjggEgMIIBHDAOBgNVHQ8BAf8EBAMCBaAwEwYD
 VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUzA6f2Ajq
 zhX67c6piY2a1uTiUkwwHwYDVR0jBBgwFoAU2qfBlqxKMZnf0QeTeYiMelfqJfgw
 RAYIKwYBBQUHAQEEODA2MDQGCCsGAQUFBzABhihodHRwOi8vb2NzcC5jbG91ZGZs
 YXJlLmNvbS9vcmlnaW5fZWNjX2NhMCMGA1UdEQQcMBqCDCouYXJub2xkLmNvbYIK
 YXJub2xkLmNvbTA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmNsb3VkZmxh
 cmUuY29tL29yaWdpbl9lY2NfY2EuY3JsMAoGCCqGSM49BAMCA0gAMEUCIDV7HoMj
 K5rShE/l+90YAOzHC89OH/wUz3I5KYOFuehoAiEA8e92aIf9XBkr0K6EvFCiSsD+
 x+Yo/cL8fGfVpPt4UM8=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIID+jCCA6CgAwIBAgIUJhFxUKEGvTRc3CjCok6dbPGH/P4wCgYIKoZIzj0EAwIw
 gagxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYD
 VQQLEy9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhv
 cml0eTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZvcm5p
 YTEXMBUGA1UEAxMOKGRldiB1c2Ugb25seSkwHhcNMTcxMDEzMTM1OTAwWhcNMzIx
 MDA5MTM1OTAwWjBiMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMR0wGwYDVQQL
 ExRDbG91ZEZsYXJlIE9yaWdpbiBDQTEmMCQGA1UEAxMdQ2xvdWRGbGFyZSBPcmln
 aW4gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCf
 GswL16Fz9Ei3sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng
 6yHR1H5oX1Lg1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bx
 tG0uyrXYh7Mtz0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyX
 PE6SuDvMHIeX6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZ
 AzNOxVKrUsySx7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOgl
 HJ2n0sMcZ+Ja1Y649mPVAgMBAAGjggEgMIIBHDAOBgNVHQ8BAf8EBAMCBaAwEwYD
 VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUzA6f2Ajq
 zhX67c6piY2a1uTiUkwwHwYDVR0jBBgwFoAU2qfBlqxKMZnf0QeTeYiMelfqJfgw
 RAYIKwYBBQUHAQEEODA2MDQGCCsGAQUFBzABhihodHRwOi8vb2NzcC5jbG91ZGZs
 YXJlLmNvbS9vcmlnaW5fZWNjX2NhMCMGA1UdEQQcMBqCDCouYXJub2xkLmNvbYIK
 YXJub2xkLmNvbTA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmNsb3VkZmxh
 cmUuY29tL29yaWdpbl9lY2NfY2EuY3JsMAoGCCqGSM49BAMCA0gAMEUCIDV7HoMj
 K5rShE/l+90YAOzHC89OH/wUz3I5KYOFuehoAiEA8e92aIf9XBkr0K6EvFCiSsD+
 x+Yo/cL8fGfVpPt4UM8=
 -----END CERTIFICATE-----
 -----BEGIN WARP TOKEN-----
 N2IwYTRkNzdkZmI4ODFjMWEzYjdkNjFlYTk0NDNlMTkKdjEuMC01OGJkNGY5ZTI4
 ZjdiM2MyOGUwNWEzNWZmM2U4MGFiNGZkOTY0NGVmM2ZlY2U1MzdlYjBkMTJlMmU5
 MjU4MjE3LTE4MzQ0MmZiYjBiYmRiM2U1NzE1NThmZWM5YjU1ODllYmQ3N2FhZmM4
 NzQ5OGVlM2YwOWY2NGE0YWQ3OWZmZTg3OTFlZGJhZTA4YjM2YzFkOGYxZDcwYTg2
 NzBkZTU2OTIyZGZmOTJiMTVkMjE0YTUyNGY0ZWJmYTE5NTg4NTllLTdjZTgwZjc5
 OTIxMzEyYTYwMjJjNWQyNWUyZDM4MGY4MmNlYWVmZTNmYmRjNDNkZDEzYjA4MGUz
 ZWYxZTI2Zjc=
 -----END WARP TOKEN-----
--- a/credentials/test-cert-unknown-block.pem
+++ b/credentials/test-cert-unknown-block.pem
@ -50,7 +50,7 @@ cmUuY29tL29yaWdpbl9lY2NfY2EuY3JsMAoGCCqGSM49BAMCA0gAMEUCIDV7HoMj
 K5rShE/l+90YAOzHC89OH/wUz3I5KYOFuehoAiEA8e92aIf9XBkr0K6EvFCiSsD+
 x+Yo/cL8fGfVpPt4UM8=
 -----END CERTIFICATE-----
-----BEGIN ARGO TUNNEL TOKEN-----
+-----BEGIN WARP TOKEN-----
 N2IwYTRkNzdkZmI4ODFjMWEzYjdkNjFlYTk0NDNlMTkKdjEuMC01OGJkNGY5ZTI4
 ZjdiM2MyOGUwNWEzNWZmM2U4MGFiNGZkOTY0NGVmM2ZlY2U1MzdlYjBkMTJlMmU5
 MjU4MjE3LTE4MzQ0MmZiYjBiYmRiM2U1NzE1NThmZWM5YjU1ODllYmQ3N2FhZmM4
@ -58,7 +58,7 @@ NzQ5OGVlM2YwOWY2NGE0YWQ3OWZmZTg3OTFlZGJhZTA4YjM2YzFkOGYxZDcwYTg2
 NzBkZTU2OTIyZGZmOTJiMTVkMjE0YTUyNGY0ZWJmYTE5NTg4NTllLTdjZTgwZjc5
 OTIxMzEyYTYwMjJjNWQyNWUyZDM4MGY4MmNlYWVmZTNmYmRjNDNkZDEzYjA4MGUz
 ZWYxZTI2Zjc=
-----END ARGO TUNNEL TOKEN-----
+-----END WARP TOKEN-----
 -----BEGIN RSA PRIVATE KEY-----
 MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCfGswL16Fz9Ei3
 sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng6yHR1H5oX1Lg
@ -87,4 +87,3 @@ M2i4QoOFcSKIG+v4SuvgEJHgG8vGvxh2qlSxnMWuPV+7/1P5ATLqDj1PlKms+BNR
 y7sc5AT9PclkL3Y9MNzOu0LXyBkGYcl8M0EQfLv9VPbWT+NXiMg/O2CHiT02pAAz
 uQicoQq3yzeQh20wtrtaXzTNmA==
 -----END RSA PRIVATE KEY-----
--- a/certutil/test-cert.pem
+++ b/certutil/test-cert.pem
@ -0,0 +1,61 @@
 -----BEGIN PRIVATE KEY-----
 MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCfGswL16Fz9Ei3
 sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng6yHR1H5oX1Lg
 1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bxtG0uyrXYh7Mt
 z0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyXPE6SuDvMHIeX
 6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZAzNOxVKrUsyS
 x7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOglHJ2n0sMcZ+Ja
 1Y649mPVAgMBAAECggEAEbPF0ah9fH0IzTU/CPbIeh3flyY8GDuMpR1HvwUurSWB
 IFI9bLyVAXKb8vYP1TMaTnXi5qmFof+/JShgyZc3+1tZtWTfoaiC8Y1bRfE2yk+D
 xmwddhDmijYGG7i8uEaeddSdFEh2GKAqkbV/QgBvN2Nl4EVmIOAJXXNe9l5LFyjy
 sR10aNVJRYV1FahrCTwZ3SovHP4d4AUvHh/3FFZDukHc37CFA0+CcR4uehp5yedi
 2UdqaszXqunFo/3h+Tn9dW2C7gTTZx4+mfyaws3p3YOmdYArXvpejxHIc0FGwLBm
 sb9K7wGVUiF0Bt0ch+C1mdYrCaFNHnPuDswjmm3FwQKBgQDYtxOwwSLA6ZyppozX
 Doyx9a7PhiMHCFKSdVB4l8rpK545a+AmpG6LRScTtBsMTHBhT3IQ3QPWlVm1AhjF
 AvXMa1rOeaGbCbDn1xqEoEVPtj4tys8eTfyWmtU73jWTFauOt4/xpf/urEpg91xj
 m+Gl/8qgBrpm5rQxV5Y4MysRlQKBgQC78jzzlhocXGNvw0wT/K2NsknyeoZXqpIE
 QYL60FMl4geZn6w9hwxaL1r+g/tUjTnpBPQtS1r2Ed2gXby5zspN1g/PW8U3t3to
 P7zHIJ/sLBXrCh5RJko3hUgGhDNOOCIQj4IaKUfvHYvEIbIxlyI0vdsXsgXgMuQ8
 pb9Yifn5QQKBgQCmGu0EtYQlyOlDP10EGSrN3Dm45l9CrKZdi326cN4eCkikSoLs
 G2x/YumouItiydP5QiNzuXOPrbmse4bwumwb2s0nJSMw6iSmDsFMlmuJxW2zO5e0
 6qGH7fUyhgcaTanJIfk6hrm7/mKkH/S4hGpYCc8NCRsmc/35M+D4AoAoYQKBgQC0
 LWpZaxDlF30MbAHHN3l6We2iU+vup0sMYXGb2ZOcwa/fir+ozIr++l8VmJmdWTan
 OWSM96zgMghx8Os4hhJTxF+rvqK242OfcVsc2x31X94zUaP2z+peh5uhA6Pb3Nxr
 W+iyA9k+Vujiwhr+h5D3VvtvH++aG6/KpGtoCf5nAQKBgQDXX2+d7bd5CLNLLFNd
 M2i4QoOFcSKIG+v4SuvgEJHgG8vGvxh2qlSxnMWuPV+7/1P5ATLqDj1PlKms+BNR
 y7sc5AT9PclkL3Y9MNzOu0LXyBkGYcl8M0EQfLv9VPbWT+NXiMg/O2CHiT02pAAz
 uQicoQq3yzeQh20wtrtaXzTNmA==
 -----END PRIVATE KEY-----
 -----BEGIN CERTIFICATE-----
 MIID+jCCA6CgAwIBAgIUJhFxUKEGvTRc3CjCok6dbPGH/P4wCgYIKoZIzj0EAwIw
 gagxCzAJBgNVBAYTAlVTMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMTgwNgYD
 VQQLEy9DbG91ZEZsYXJlIE9yaWdpbiBTU0wgRUNDIENlcnRpZmljYXRlIEF1dGhv
 cml0eTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UECBMKQ2FsaWZvcm5p
 YTEXMBUGA1UEAxMOKGRldiB1c2Ugb25seSkwHhcNMTcxMDEzMTM1OTAwWhcNMzIx
 MDA5MTM1OTAwWjBiMRkwFwYDVQQKExBDbG91ZEZsYXJlLCBJbmMuMR0wGwYDVQQL
 ExRDbG91ZEZsYXJlIE9yaWdpbiBDQTEmMCQGA1UEAxMdQ2xvdWRGbGFyZSBPcmln
 aW4gQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCf
 GswL16Fz9Ei3sAg5AmBizoN2nZdyXHP8T57UxUMcrlJXEEXCVS5RR4m9l+EmK0ng
 6yHR1H5oX1Lg1WKyXgWwr0whwmdTD+qWFJW2M8HyefyBKLrsGPuxw4CVYT0h72bx
 tG0uyrXYh7Mtz0lHjGV90qrFpq5o0jx0sLbDlDvpFPbIO58uYzKG4Sn2VTC4rOyX
 PE6SuDvMHIeX6Ekw4wSVQ9eTbksLQqTyxSqM3zp2ygc56SjGjy1nGQT8ZBGFzSbZ
 AzNOxVKrUsySx7LzZVl+zCGCPlQwaYLKObKXadZJmrqSFmErC5jcbVgBz7oJQOgl
 HJ2n0sMcZ+Ja1Y649mPVAgMBAAGjggEgMIIBHDAOBgNVHQ8BAf8EBAMCBaAwEwYD
 VR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUzA6f2Ajq
 zhX67c6piY2a1uTiUkwwHwYDVR0jBBgwFoAU2qfBlqxKMZnf0QeTeYiMelfqJfgw
 RAYIKwYBBQUHAQEEODA2MDQGCCsGAQUFBzABhihodHRwOi8vb2NzcC5jbG91ZGZs
 YXJlLmNvbS9vcmlnaW5fZWNjX2NhMCMGA1UdEQQcMBqCDCouYXJub2xkLmNvbYIK
 YXJub2xkLmNvbTA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmNsb3VkZmxh
 cmUuY29tL29yaWdpbl9lY2NfY2EuY3JsMAoGCCqGSM49BAMCA0gAMEUCIDV7HoMj
 K5rShE/l+90YAOzHC89OH/wUz3I5KYOFuehoAiEA8e92aIf9XBkr0K6EvFCiSsD+
 x+Yo/cL8fGfVpPt4UM8=
 -----END CERTIFICATE-----
 -----BEGIN WARP TOKEN-----
 N2IwYTRkNzdkZmI4ODFjMWEzYjdkNjFlYTk0NDNlMTkKdjEuMC01OGJkNGY5ZTI4
 ZjdiM2MyOGUwNWEzNWZmM2U4MGFiNGZkOTY0NGVmM2ZlY2U1MzdlYjBkMTJlMmU5
 MjU4MjE3LTE4MzQ0MmZiYjBiYmRiM2U1NzE1NThmZWM5YjU1ODllYmQ3N2FhZmM4
 NzQ5OGVlM2YwOWY2NGE0YWQ3OWZmZTg3OTFlZGJhZTA4YjM2YzFkOGYxZDcwYTg2
 NzBkZTU2OTIyZGZmOTJiMTVkMjE0YTUyNGY0ZWJmYTE5NTg4NTllLTdjZTgwZjc5
 OTIxMzEyYTYwMjJjNWQyNWUyZDM4MGY4MmNlYWVmZTNmYmRjNDNkZDEzYjA4MGUz
 ZWYxZTI2Zjc=
 -----END WARP TOKEN-----
--- a/cfapi/base_client.go
+++ b/cfapi/base_client.go
@ -1,247 +0,0 @@
 package cfapi
 import (
 	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"strings"
 	"time"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
 	"golang.org/x/net/http2"
 )
 const (
 	defaultTimeout  = 15 * time.Second
 	jsonContentType = "application/json"
 )
 var (
 	ErrUnauthorized = errors.New("unauthorized")
 	ErrBadRequest   = errors.New("incorrect request parameters")
 	ErrNotFound     = errors.New("not found")
 	ErrAPINoSuccess = errors.New("API call failed")
 )
 type RESTClient struct {
 	baseEndpoints *baseEndpoints
 	authToken     string
 	userAgent     string
 	client        http.Client
 	log           *zerolog.Logger
 }
 type baseEndpoints struct {
 	accountLevel  url.URL
 	zoneLevel     url.URL
 	accountRoutes url.URL
 	accountVnets  url.URL
 }
 var _ Client = (*RESTClient)(nil)
 func NewRESTClient(baseURL, accountTag, zoneTag, authToken, userAgent string, log *zerolog.Logger) (*RESTClient, error) {
 	if strings.HasSuffix(baseURL, "/") {
 		baseURL = baseURL[:len(baseURL)-1]
 	}
 	accountLevelEndpoint, err := url.Parse(fmt.Sprintf("%s/accounts/%s/cfd_tunnel", baseURL, accountTag))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create account level endpoint")
 	}
 	accountRoutesEndpoint, err := url.Parse(fmt.Sprintf("%s/accounts/%s/teamnet/routes", baseURL, accountTag))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create route account-level endpoint")
 	}
 	accountVnetsEndpoint, err := url.Parse(fmt.Sprintf("%s/accounts/%s/teamnet/virtual_networks", baseURL, accountTag))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create virtual network account-level endpoint")
 	}
 	zoneLevelEndpoint, err := url.Parse(fmt.Sprintf("%s/zones/%s/tunnels", baseURL, zoneTag))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create account level endpoint")
 	}
 	httpTransport := http.Transport{
 		TLSHandshakeTimeout:   defaultTimeout,
 		ResponseHeaderTimeout: defaultTimeout,
 	}
 	http2.ConfigureTransport(&httpTransport)
 	return &RESTClient{
 		baseEndpoints: &baseEndpoints{
 			accountLevel:  *accountLevelEndpoint,
 			zoneLevel:     *zoneLevelEndpoint,
 			accountRoutes: *accountRoutesEndpoint,
 			accountVnets:  *accountVnetsEndpoint,
 		},
 		authToken: authToken,
 		userAgent: userAgent,
 		client: http.Client{
 			Transport: &httpTransport,
 			Timeout:   defaultTimeout,
 		},
 		log: log,
 	}, nil
 }
 func (r *RESTClient) sendRequest(method string, url url.URL, body interface{}) (*http.Response, error) {
 	var bodyReader io.Reader
 	if body != nil {
 		if bodyBytes, err := json.Marshal(body); err != nil {
 			return nil, errors.Wrap(err, "failed to serialize json body")
 		} else {
 			bodyReader = bytes.NewBuffer(bodyBytes)
 		}
 	}
 	req, err := http.NewRequest(method, url.String(), bodyReader)
 	if err != nil {
 		return nil, errors.Wrapf(err, "can't create %s request", method)
 	}
 	req.Header.Set("User-Agent", r.userAgent)
 	if bodyReader != nil {
 		req.Header.Set("Content-Type", jsonContentType)
 	}
 	req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", r.authToken))
 	req.Header.Add("Accept", "application/json;version=1")
 	return r.client.Do(req)
 }
 func parseResponseEnvelope(reader io.Reader) (*response, error) {
 	// Schema for Tunnelstore responses in the v1 API.
 	// Roughly, it's a wrapper around a particular result that adds failures/errors/etc
 	var result response
 	// First, parse the wrapper and check the API call succeeded
 	if err := json.NewDecoder(reader).Decode(&result); err != nil {
 		return nil, errors.Wrap(err, "failed to decode response")
 	}
 	if err := result.checkErrors(); err != nil {
 		return nil, err
 	}
 	if !result.Success {
 		return nil, ErrAPINoSuccess
 	}
 	return &result, nil
 }
 func parseResponse(reader io.Reader, data interface{}) error {
 	result, err := parseResponseEnvelope(reader)
 	if err != nil {
 		return err
 	}
 	return parseResponseBody(result, data)
 }
 func parseResponseBody(result *response, data interface{}) error {
 	// At this point we know the API call succeeded, so, parse out the inner
 	// result into the datatype provided as a parameter.
 	if err := json.Unmarshal(result.Result, &data); err != nil {
 		return errors.Wrap(err, "the Cloudflare API response was an unexpected type")
 	}
 	return nil
 }
 func fetchExhaustively[T any](requestFn func(int) (*http.Response, error)) ([]*T, error) {
 	page := 0
 	var fullResponse []*T
 	for {
 		page += 1
 		envelope, parsedBody, err := fetchPage[T](requestFn, page)
 		if err != nil {
 			return nil, errors.Wrap(err, fmt.Sprintf("Error Parsing page %d", page))
 		}
 		fullResponse = append(fullResponse, parsedBody...)
 		if envelope.Pagination.Count < envelope.Pagination.PerPage || len(fullResponse) >= envelope.Pagination.TotalCount {
 			break
 		}
 	}
 	return fullResponse, nil
 }
 func fetchPage[T any](requestFn func(int) (*http.Response, error), page int) (*response, []*T, error) {
 	pageResp, err := requestFn(page)
 	if err != nil {
 		return nil, nil, errors.Wrap(err, "REST request failed")
 	}
 	defer pageResp.Body.Close()
 	if pageResp.StatusCode == http.StatusOK {
 		envelope, err := parseResponseEnvelope(pageResp.Body)
 		if err != nil {
 			return nil, nil, err
 		}
 		var parsedRspBody []*T
 		return envelope, parsedRspBody, parseResponseBody(envelope, &parsedRspBody)
 	}
 	return nil, nil, errors.New(fmt.Sprintf("Failed to fetch page. Server returned: %d", pageResp.StatusCode))
 }
 type response struct {
 	Success    bool            `json:"success,omitempty"`
 	Errors     []apiErr        `json:"errors,omitempty"`
 	Messages   []string        `json:"messages,omitempty"`
 	Result     json.RawMessage `json:"result,omitempty"`
 	Pagination Pagination      `json:"result_info,omitempty"`
 }
 type Pagination struct {
 	Count      int `json:"count,omitempty"`
 	Page       int `json:"page,omitempty"`
 	PerPage    int `json:"per_page,omitempty"`
 	TotalCount int `json:"total_count,omitempty"`
 }
 func (r *response) checkErrors() error {
 	if len(r.Errors) == 0 {
 		return nil
 	}
 	if len(r.Errors) == 1 {
 		return r.Errors[0]
 	}
 	var messages string
 	for _, e := range r.Errors {
 		messages += fmt.Sprintf("%s; ", e)
 	}
 	return fmt.Errorf("API errors: %s", messages)
 }
 type apiErr struct {
 	Code    json.Number `json:"code,omitempty"`
 	Message string      `json:"message,omitempty"`
 }
 func (e apiErr) Error() string {
 	return fmt.Sprintf("code: %v, reason: %s", e.Code, e.Message)
 }
 func (r *RESTClient) statusCodeToError(op string, resp *http.Response) error {
 	if resp.Header.Get("Content-Type") == "application/json" {
 		var errorsResp response
 		if json.NewDecoder(resp.Body).Decode(&errorsResp) == nil {
 			if err := errorsResp.checkErrors(); err != nil {
 				return errors.Errorf("Failed to %s: %s", op, err)
 			}
 		}
 	}
 	switch resp.StatusCode {
 	case http.StatusOK:
 		return nil
 	case http.StatusBadRequest:
 		return ErrBadRequest
 	case http.StatusUnauthorized, http.StatusForbidden:
 		return ErrUnauthorized
 	case http.StatusNotFound:
 		return ErrNotFound
 	}
 	return errors.Errorf("API call to %s failed with status %d: %s", op,
 		resp.StatusCode, http.StatusText(resp.StatusCode))
 }
--- a/cfapi/client.go
+++ b/cfapi/client.go
@ -1,41 +0,0 @@
 package cfapi
 import (
 	"github.com/google/uuid"
 )
 type TunnelClient interface {
 	CreateTunnel(name string, tunnelSecret []byte) (*TunnelWithToken, error)
 	GetTunnel(tunnelID uuid.UUID) (*Tunnel, error)
 	GetTunnelToken(tunnelID uuid.UUID) (string, error)
 	GetManagementToken(tunnelID uuid.UUID) (string, error)
 	DeleteTunnel(tunnelID uuid.UUID, cascade bool) error
 	ListTunnels(filter *TunnelFilter) ([]*Tunnel, error)
 	ListActiveClients(tunnelID uuid.UUID) ([]*ActiveClient, error)
 	CleanupConnections(tunnelID uuid.UUID, params *CleanupParams) error
 }
 type HostnameClient interface {
 	RouteTunnel(tunnelID uuid.UUID, route HostnameRoute) (HostnameRouteResult, error)
 }
 type IPRouteClient interface {
 	ListRoutes(filter *IpRouteFilter) ([]*DetailedRoute, error)
 	AddRoute(newRoute NewRoute) (Route, error)
 	DeleteRoute(id uuid.UUID) error
 	GetByIP(params GetRouteByIpParams) (DetailedRoute, error)
 }
 type VnetClient interface {
 	CreateVirtualNetwork(newVnet NewVirtualNetwork) (VirtualNetwork, error)
 	ListVirtualNetworks(filter *VnetFilter) ([]*VirtualNetwork, error)
 	DeleteVirtualNetwork(id uuid.UUID, force bool) error
 	UpdateVirtualNetwork(id uuid.UUID, updates UpdateVirtualNetwork) error
 }
 type Client interface {
 	TunnelClient
 	HostnameClient
 	IPRouteClient
 	VnetClient
 }
--- a/cfapi/hostname.go
+++ b/cfapi/hostname.go
@ -1,192 +0,0 @@
 package cfapi
 import (
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"path"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 )
 type Change = string
 const (
 	ChangeNew       = "new"
 	ChangeUpdated   = "updated"
 	ChangeUnchanged = "unchanged"
 )
 // HostnameRoute represents a record type that can route to a tunnel
 type HostnameRoute interface {
 	json.Marshaler
 	RecordType() string
 	UnmarshalResult(body io.Reader) (HostnameRouteResult, error)
 	String() string
 }
 type HostnameRouteResult interface {
 	// SuccessSummary explains what will route to this tunnel when it's provisioned successfully
 	SuccessSummary() string
 }
 type DNSRoute struct {
 	userHostname      string
 	overwriteExisting bool
 }
 type DNSRouteResult struct {
 	route *DNSRoute
 	CName Change `json:"cname"`
 	Name  string `json:"name"`
 }
 func NewDNSRoute(userHostname string, overwriteExisting bool) HostnameRoute {
 	return &DNSRoute{
 		userHostname:      userHostname,
 		overwriteExisting: overwriteExisting,
 	}
 }
 func (dr *DNSRoute) MarshalJSON() ([]byte, error) {
 	s := struct {
 		Type              string `json:"type"`
 		UserHostname      string `json:"user_hostname"`
 		OverwriteExisting bool   `json:"overwrite_existing"`
 	}{
 		Type:              dr.RecordType(),
 		UserHostname:      dr.userHostname,
 		OverwriteExisting: dr.overwriteExisting,
 	}
 	return json.Marshal(&s)
 }
 func (dr *DNSRoute) UnmarshalResult(body io.Reader) (HostnameRouteResult, error) {
 	var result DNSRouteResult
 	err := parseResponse(body, &result)
 	result.route = dr
 	return &result, err
 }
 func (dr *DNSRoute) RecordType() string {
 	return "dns"
 }
 func (dr *DNSRoute) String() string {
 	return fmt.Sprintf("%s %s", dr.RecordType(), dr.userHostname)
 }
 func (res *DNSRouteResult) SuccessSummary() string {
 	var msgFmt string
 	switch res.CName {
 	case ChangeNew:
 		msgFmt = "Added CNAME %s which will route to this tunnel"
 	case ChangeUpdated: // this is not currently returned by tunnelsore
 		msgFmt = "%s updated to route to your tunnel"
 	case ChangeUnchanged:
 		msgFmt = "%s is already configured to route to your tunnel"
 	}
 	return fmt.Sprintf(msgFmt, res.hostname())
 }
 // hostname yields the resulting name for the DNS route; if that is not available from Cloudflare API, then the
 // requested name is returned instead (should not be the common path, it is just a fall-back).
 func (res *DNSRouteResult) hostname() string {
 	if res.Name != "" {
 		return res.Name
 	}
 	return res.route.userHostname
 }
 type LBRoute struct {
 	lbName string
 	lbPool string
 }
 type LBRouteResult struct {
 	route        *LBRoute
 	LoadBalancer Change `json:"load_balancer"`
 	Pool         Change `json:"pool"`
 }
 func NewLBRoute(lbName, lbPool string) HostnameRoute {
 	return &LBRoute{
 		lbName: lbName,
 		lbPool: lbPool,
 	}
 }
 func (lr *LBRoute) MarshalJSON() ([]byte, error) {
 	s := struct {
 		Type   string `json:"type"`
 		LBName string `json:"lb_name"`
 		LBPool string `json:"lb_pool"`
 	}{
 		Type:   lr.RecordType(),
 		LBName: lr.lbName,
 		LBPool: lr.lbPool,
 	}
 	return json.Marshal(&s)
 }
 func (lr *LBRoute) RecordType() string {
 	return "lb"
 }
 func (lb *LBRoute) String() string {
 	return fmt.Sprintf("%s %s %s", lb.RecordType(), lb.lbName, lb.lbPool)
 }
 func (lr *LBRoute) UnmarshalResult(body io.Reader) (HostnameRouteResult, error) {
 	var result LBRouteResult
 	err := parseResponse(body, &result)
 	result.route = lr
 	return &result, err
 }
 func (res *LBRouteResult) SuccessSummary() string {
 	var msg string
 	switch res.LoadBalancer + "," + res.Pool {
 	case "new,new":
 		msg = "Created load balancer %s and added a new pool %s with this tunnel as an origin"
 	case "new,updated":
 		msg = "Created load balancer %s with an existing pool %s which was updated to use this tunnel as an origin"
 	case "new,unchanged":
 		msg = "Created load balancer %s with an existing pool %s which already has this tunnel as an origin"
 	case "updated,new":
 		msg = "Added new pool %[2]s with this tunnel as an origin to load balancer %[1]s"
 	case "updated,updated":
 		msg = "Updated pool %[2]s to use this tunnel as an origin and added it to load balancer %[1]s"
 	case "updated,unchanged":
 		msg = "Added pool %[2]s, which already has this tunnel as an origin, to load balancer %[1]s"
 	case "unchanged,updated":
 		msg = "Added this tunnel as an origin in pool %[2]s which is already used by load balancer %[1]s"
 	case "unchanged,unchanged":
 		msg = "Load balancer %s already uses pool %s which has this tunnel as an origin"
 	case "unchanged,new":
 		// this state is not possible
 		fallthrough
 	default:
 		msg = "Something went wrong: failed to modify load balancer %s with pool %s; please check traffic manager configuration in the dashboard"
 	}
 	return fmt.Sprintf(msg, res.route.lbName, res.route.lbPool)
 }
 func (r *RESTClient) RouteTunnel(tunnelID uuid.UUID, route HostnameRoute) (HostnameRouteResult, error) {
 	endpoint := r.baseEndpoints.zoneLevel
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v/routes", tunnelID))
 	resp, err := r.sendRequest("PUT", endpoint, route)
 	if err != nil {
 		return nil, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		return route.UnmarshalResult(resp.Body)
 	}
 	return nil, r.statusCodeToError("add route", resp)
 }
--- a/cfapi/hostname_test.go
+++ b/cfapi/hostname_test.go
@ -1,99 +0,0 @@
 package cfapi
 import (
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 )
 func TestDNSRouteUnmarshalResult(t *testing.T) {
 	route := &DNSRoute{
 		userHostname: "example.com",
 	}
 	result, err := route.UnmarshalResult(strings.NewReader(`{"success": true, "result": {"cname": "new"}}`))
 	assert.NoError(t, err)
 	assert.Equal(t, &DNSRouteResult{
 		route: route,
 		CName: ChangeNew,
 	}, result)
 	badJSON := []string{
 		`abc`,
 		`{"success": false, "result": {"cname": "new"}}`,
 		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"cname": "new"}}`,
 		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}, {"code": 1004, "message":"Cannot use tunnel as origin for non-proxied load balancer"}], "result": {"cname": "new"}}`,
 		`{"result": {"cname": "new"}}`,
 		`{"result": {"cname": "new"}}`,
 	}
 	for _, j := range badJSON {
 		_, err = route.UnmarshalResult(strings.NewReader(j))
 		assert.NotNil(t, err)
 	}
 }
 func TestLBRouteUnmarshalResult(t *testing.T) {
 	route := &LBRoute{
 		lbName: "lb.example.com",
 		lbPool: "pool",
 	}
 	result, err := route.UnmarshalResult(strings.NewReader(`{"success": true, "result": {"pool": "unchanged", "load_balancer": "updated"}}`))
 	assert.NoError(t, err)
 	assert.Equal(t, &LBRouteResult{
 		route:        route,
 		LoadBalancer: ChangeUpdated,
 		Pool:         ChangeUnchanged,
 	}, result)
 	badJSON := []string{
 		`abc`,
 		`{"success": false, "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}, {"code": 1004, "message":"Cannot use tunnel as origin for non-proxied load balancer"}], "result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 		`{"result": {"pool": "unchanged", "load_balancer": "updated"}}`,
 	}
 	for _, j := range badJSON {
 		_, err = route.UnmarshalResult(strings.NewReader(j))
 		assert.NotNil(t, err)
 	}
 }
 func TestLBRouteResultSuccessSummary(t *testing.T) {
 	route := &LBRoute{
 		lbName: "lb.example.com",
 		lbPool: "POOL",
 	}
 	tests := []struct {
 		lb       Change
 		pool     Change
 		expected string
 	}{
 		{ChangeNew, ChangeNew, "Created load balancer lb.example.com and added a new pool POOL with this tunnel as an origin"},
 		{ChangeNew, ChangeUpdated, "Created load balancer lb.example.com with an existing pool POOL which was updated to use this tunnel as an origin"},
 		{ChangeNew, ChangeUnchanged, "Created load balancer lb.example.com with an existing pool POOL which already has this tunnel as an origin"},
 		{ChangeUpdated, ChangeNew, "Added new pool POOL with this tunnel as an origin to load balancer lb.example.com"},
 		{ChangeUpdated, ChangeUpdated, "Updated pool POOL to use this tunnel as an origin and added it to load balancer lb.example.com"},
 		{ChangeUpdated, ChangeUnchanged, "Added pool POOL, which already has this tunnel as an origin, to load balancer lb.example.com"},
 		{ChangeUnchanged, ChangeNew, "Something went wrong: failed to modify load balancer lb.example.com with pool POOL; please check traffic manager configuration in the dashboard"},
 		{ChangeUnchanged, ChangeUpdated, "Added this tunnel as an origin in pool POOL which is already used by load balancer lb.example.com"},
 		{ChangeUnchanged, ChangeUnchanged, "Load balancer lb.example.com already uses pool POOL which has this tunnel as an origin"},
 		{"", "", "Something went wrong: failed to modify load balancer lb.example.com with pool POOL; please check traffic manager configuration in the dashboard"},
 		{"a", "b", "Something went wrong: failed to modify load balancer lb.example.com with pool POOL; please check traffic manager configuration in the dashboard"},
 	}
 	for i, tt := range tests {
 		res := &LBRouteResult{
 			route:        route,
 			LoadBalancer: tt.lb,
 			Pool:         tt.pool,
 		}
 		actual := res.SuccessSummary()
 		assert.Equal(t, tt.expected, actual, "case %d", i+1)
 	}
 }
--- a/cfapi/ip_route.go
+++ b/cfapi/ip_route.go
@ -1,235 +0,0 @@
 package cfapi
 import (
 	"encoding/json"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/url"
 	"path"
 	"time"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 )
 // Route is a mapping from customer's IP space to a tunnel.
 // Each route allows the customer to route eyeballs in their corporate network
 // to certain private IP ranges. Each Route represents an IP range in their
 // network, and says that eyeballs can reach that route using the corresponding
 // tunnel.
 type Route struct {
 	Network  CIDR      `json:"network"`
 	TunnelID uuid.UUID `json:"tunnel_id"`
 	// Optional field. When unset, it means the Route belongs to the default virtual network.
 	VNetID    *uuid.UUID `json:"virtual_network_id,omitempty"`
 	Comment   string     `json:"comment"`
 	CreatedAt time.Time  `json:"created_at"`
 	DeletedAt time.Time  `json:"deleted_at"`
 }
 // CIDR is just a newtype wrapper around net.IPNet. It adds JSON unmarshalling.
 type CIDR net.IPNet
 func (c CIDR) String() string {
 	n := net.IPNet(c)
 	return n.String()
 }
 func (c CIDR) MarshalJSON() ([]byte, error) {
 	str := c.String()
 	json, err := json.Marshal(str)
 	if err != nil {
 		return nil, errors.Wrap(err, "error serializing CIDR into JSON")
 	}
 	return json, nil
 }
 // UnmarshalJSON parses a JSON string into net.IPNet
 func (c *CIDR) UnmarshalJSON(data []byte) error {
 	var s string
 	if err := json.Unmarshal(data, &s); err != nil {
 		return errors.Wrap(err, "error parsing cidr string")
 	}
 	_, network, err := net.ParseCIDR(s)
 	if err != nil {
 		return errors.Wrap(err, "error parsing invalid network from backend")
 	}
 	if network == nil {
 		return fmt.Errorf("backend returned invalid network %s", s)
 	}
 	*c = CIDR(*network)
 	return nil
 }
 // NewRoute has all the parameters necessary to add a new route to the table.
 type NewRoute struct {
 	Network  net.IPNet
 	TunnelID uuid.UUID
 	Comment  string
 	// Optional field. If unset, backend will assume the default vnet for the account.
 	VNetID *uuid.UUID
 }
 // MarshalJSON handles fields with non-JSON types (e.g. net.IPNet).
 func (r NewRoute) MarshalJSON() ([]byte, error) {
 	return json.Marshal(&struct {
 		Network  string     `json:"network"`
 		TunnelID uuid.UUID  `json:"tunnel_id"`
 		Comment  string     `json:"comment"`
 		VNetID   *uuid.UUID `json:"virtual_network_id,omitempty"`
 	}{
 		Network:  r.Network.String(),
 		TunnelID: r.TunnelID,
 		Comment:  r.Comment,
 		VNetID:   r.VNetID,
 	})
 }
 // DetailedRoute is just a Route with some extra fields, e.g. TunnelName.
 type DetailedRoute struct {
 	ID       uuid.UUID `json:"id"`
 	Network  CIDR      `json:"network"`
 	TunnelID uuid.UUID `json:"tunnel_id"`
 	// Optional field. When unset, it means the DetailedRoute belongs to the default virtual network.
 	VNetID     *uuid.UUID `json:"virtual_network_id,omitempty"`
 	Comment    string     `json:"comment"`
 	CreatedAt  time.Time  `json:"created_at"`
 	DeletedAt  time.Time  `json:"deleted_at"`
 	TunnelName string     `json:"tunnel_name"`
 }
 // IsZero checks if DetailedRoute is the zero value.
 func (r *DetailedRoute) IsZero() bool {
 	return r.TunnelID == uuid.Nil
 }
 // TableString outputs a table row summarizing the route, to be used
 // when showing the user their routing table.
 func (r DetailedRoute) TableString() string {
 	deletedColumn := "-"
 	if !r.DeletedAt.IsZero() {
 		deletedColumn = r.DeletedAt.Format(time.RFC3339)
 	}
 	vnetColumn := "default"
 	if r.VNetID != nil {
 		vnetColumn = r.VNetID.String()
 	}
 	return fmt.Sprintf(
 		"%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t",
 		r.ID,
 		r.Network.String(),
 		vnetColumn,
 		r.Comment,
 		r.TunnelID,
 		r.TunnelName,
 		r.CreatedAt.Format(time.RFC3339),
 		deletedColumn,
 	)
 }
 type GetRouteByIpParams struct {
 	Ip net.IP
 	// Optional field. If unset, backend will assume the default vnet for the account.
 	VNetID *uuid.UUID
 }
 // ListRoutes calls the Tunnelstore GET endpoint for all routes under an account.
 // Due to pagination on the server side it will call the endpoint multiple times if needed.
 func (r *RESTClient) ListRoutes(filter *IpRouteFilter) ([]*DetailedRoute, error) {
 	fetchFn := func(page int) (*http.Response, error) {
 		endpoint := r.baseEndpoints.accountRoutes
 		filter.Page(page)
 		endpoint.RawQuery = filter.Encode()
 		rsp, err := r.sendRequest("GET", endpoint, nil)
 		if err != nil {
 			return nil, errors.Wrap(err, "REST request failed")
 		}
 		if rsp.StatusCode != http.StatusOK {
 			rsp.Body.Close()
 			return nil, r.statusCodeToError("list routes", rsp)
 		}
 		return rsp, nil
 	}
 	return fetchExhaustively[DetailedRoute](fetchFn)
 }
 // AddRoute calls the Tunnelstore POST endpoint for a given route.
 func (r *RESTClient) AddRoute(newRoute NewRoute) (Route, error) {
 	endpoint := r.baseEndpoints.accountRoutes
 	endpoint.Path = path.Join(endpoint.Path)
 	resp, err := r.sendRequest("POST", endpoint, newRoute)
 	if err != nil {
 		return Route{}, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		return parseRoute(resp.Body)
 	}
 	return Route{}, r.statusCodeToError("add route", resp)
 }
 // DeleteRoute calls the Tunnelstore DELETE endpoint for a given route.
 func (r *RESTClient) DeleteRoute(id uuid.UUID) error {
 	endpoint := r.baseEndpoints.accountRoutes
 	endpoint.Path = path.Join(endpoint.Path, url.PathEscape(id.String()))
 	resp, err := r.sendRequest("DELETE", endpoint, nil)
 	if err != nil {
 		return errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		_, err := parseRoute(resp.Body)
 		return err
 	}
 	return r.statusCodeToError("delete route", resp)
 }
 // GetByIP checks which route will proxy a given IP.
 func (r *RESTClient) GetByIP(params GetRouteByIpParams) (DetailedRoute, error) {
 	endpoint := r.baseEndpoints.accountRoutes
 	endpoint.Path = path.Join(endpoint.Path, "ip", url.PathEscape(params.Ip.String()))
 	setVnetParam(&endpoint, params.VNetID)
 	resp, err := r.sendRequest("GET", endpoint, nil)
 	if err != nil {
 		return DetailedRoute{}, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		return parseDetailedRoute(resp.Body)
 	}
 	return DetailedRoute{}, r.statusCodeToError("get route by IP", resp)
 }
 func parseRoute(body io.ReadCloser) (Route, error) {
 	var route Route
 	err := parseResponse(body, &route)
 	return route, err
 }
 func parseDetailedRoute(body io.ReadCloser) (DetailedRoute, error) {
 	var route DetailedRoute
 	err := parseResponse(body, &route)
 	return route, err
 }
 // setVnetParam overwrites the URL's query parameters with a query param to scope the HostnameRoute action to a certain
 // virtual network (if one is provided).
 func setVnetParam(endpoint *url.URL, vnetID *uuid.UUID) {
 	queryParams := url.Values{}
 	if vnetID != nil {
 		queryParams.Set("virtual_network_id", vnetID.String())
 	}
 	endpoint.RawQuery = queryParams.Encode()
 }
--- a/cfapi/ip_route_filter.go
+++ b/cfapi/ip_route_filter.go
@ -1,176 +0,0 @@
 package cfapi
 import (
 	"fmt"
 	"net"
 	"net/url"
 	"strconv"
 	"time"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
 )
 var (
 	filterIpRouteDeleted = cli.BoolFlag{
 		Name:  "filter-is-deleted",
 		Usage: "If false (default), only show non-deleted routes. If true, only show deleted routes.",
 	}
 	filterIpRouteTunnelID = cli.StringFlag{
 		Name:  "filter-tunnel-id",
 		Usage: "Show only routes with the given tunnel ID.",
 	}
 	filterSubsetIpRoute = cli.StringFlag{
 		Name:    "filter-network-is-subset-of",
 		Aliases: []string{"nsub"},
 		Usage:   "Show only routes whose network is a subset of the given network.",
 	}
 	filterSupersetIpRoute = cli.StringFlag{
 		Name:    "filter-network-is-superset-of",
 		Aliases: []string{"nsup"},
 		Usage:   "Show only routes whose network is a superset of the given network.",
 	}
 	filterIpRouteComment = cli.StringFlag{
 		Name:  "filter-comment-is",
 		Usage: "Show only routes with this comment.",
 	}
 	filterIpRouteByVnet = cli.StringFlag{
 		Name:  "filter-vnet-id",
 		Usage: "Show only routes that are attached to the given virtual network ID.",
 	}
 	// Flags contains all filter flags.
 	IpRouteFilterFlags = []cli.Flag{
 		&filterIpRouteDeleted,
 		&filterIpRouteTunnelID,
 		&filterSubsetIpRoute,
 		&filterSupersetIpRoute,
 		&filterIpRouteComment,
 		&filterIpRouteByVnet,
 	}
 )
 // IpRouteFilter which routes get queried.
 type IpRouteFilter struct {
 	queryParams url.Values
 }
 // NewIpRouteFilterFromCLI parses CLI flags to discover which filters should get applied.
 func NewIpRouteFilterFromCLI(c *cli.Context) (*IpRouteFilter, error) {
 	f := NewIPRouteFilter()
 	// Set deletion filter
 	if flag := filterIpRouteDeleted.Name; c.IsSet(flag) && c.Bool(flag) {
 		f.Deleted()
 	} else {
 		f.NotDeleted()
 	}
 	if subset, err := cidrFromFlag(c, filterSubsetIpRoute); err != nil {
 		return nil, err
 	} else if subset != nil {
 		f.NetworkIsSupersetOf(*subset)
 	}
 	if superset, err := cidrFromFlag(c, filterSupersetIpRoute); err != nil {
 		return nil, err
 	} else if superset != nil {
 		f.NetworkIsSupersetOf(*superset)
 	}
 	if comment := c.String(filterIpRouteComment.Name); comment != "" {
 		f.CommentIs(comment)
 	}
 	if tunnelID := c.String(filterIpRouteTunnelID.Name); tunnelID != "" {
 		u, err := uuid.Parse(tunnelID)
 		if err != nil {
 			return nil, errors.Wrapf(err, "Couldn't parse UUID from %s", filterIpRouteTunnelID.Name)
 		}
 		f.TunnelID(u)
 	}
 	if vnetId := c.String(filterIpRouteByVnet.Name); vnetId != "" {
 		u, err := uuid.Parse(vnetId)
 		if err != nil {
 			return nil, errors.Wrapf(err, "Couldn't parse UUID from %s", filterIpRouteByVnet.Name)
 		}
 		f.VNetID(u)
 	}
 	if maxFetch := c.Int("max-fetch-size"); maxFetch > 0 {
 		f.MaxFetchSize(uint(maxFetch))
 	}
 	return f, nil
 }
 // Parses a CIDR from the flag. If the flag was unset, returns (nil, nil).
 func cidrFromFlag(c *cli.Context, flag cli.StringFlag) (*net.IPNet, error) {
 	if !c.IsSet(flag.Name) {
 		return nil, nil
 	}
 	_, subset, err := net.ParseCIDR(c.String(flag.Name))
 	if err != nil {
 		return nil, err
 	} else if subset == nil {
 		return nil, fmt.Errorf("Invalid CIDR supplied for %s", flag.Name)
 	}
 	return subset, nil
 }
 func NewIPRouteFilter() *IpRouteFilter {
 	values := &IpRouteFilter{queryParams: url.Values{}}
 	// always list cfd_tunnel routes only
 	values.queryParams.Set("tun_types", "cfd_tunnel")
 	return values
 }
 func (f *IpRouteFilter) CommentIs(comment string) {
 	f.queryParams.Set("comment", comment)
 }
 func (f *IpRouteFilter) NotDeleted() {
 	f.queryParams.Set("is_deleted", "false")
 }
 func (f *IpRouteFilter) Deleted() {
 	f.queryParams.Set("is_deleted", "true")
 }
 func (f *IpRouteFilter) NetworkIsSubsetOf(superset net.IPNet) {
 	f.queryParams.Set("network_subset", superset.String())
 }
 func (f *IpRouteFilter) NetworkIsSupersetOf(subset net.IPNet) {
 	f.queryParams.Set("network_superset", subset.String())
 }
 func (f *IpRouteFilter) ExistedAt(existedAt time.Time) {
 	f.queryParams.Set("existed_at", existedAt.Format(time.RFC3339))
 }
 func (f *IpRouteFilter) TunnelID(id uuid.UUID) {
 	f.queryParams.Set("tunnel_id", id.String())
 }
 func (f *IpRouteFilter) VNetID(id uuid.UUID) {
 	f.queryParams.Set("virtual_network_id", id.String())
 }
 func (f *IpRouteFilter) MaxFetchSize(max uint) {
 	f.queryParams.Set("per_page", strconv.Itoa(int(max)))
 }
 func (f *IpRouteFilter) Page(page int) {
 	f.queryParams.Set("page", strconv.Itoa(page))
 }
 func (f IpRouteFilter) Encode() string {
 	return f.queryParams.Encode()
 }
--- a/cfapi/ip_route_test.go
+++ b/cfapi/ip_route_test.go
@ -1,178 +0,0 @@
 package cfapi
 import (
 	"encoding/json"
 	"fmt"
 	"net"
 	"strings"
 	"testing"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 )
 func TestUnmarshalRoute(t *testing.T) {
 	testCases := []struct {
 		Json    string
 		HasVnet bool
 	}{
 		{
 			`{
 				"network":"10.1.2.40/29",
 				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
 				"comment":"test",
 				"created_at":"2020-12-22T02:00:15.587008Z",
 				"deleted_at":null
 			}`,
 			false,
 		},
 		{
 			`{
 				"network":"10.1.2.40/29",
 				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
 				"comment":"test",
 				"created_at":"2020-12-22T02:00:15.587008Z",
 				"deleted_at":null,
 				"virtual_network_id":"38c95083-8191-4110-8339-3f438d44fdb9"
 			}`,
 			true,
 		},
 	}
 	for _, testCase := range testCases {
 		data := testCase.Json
 		var r Route
 		err := json.Unmarshal([]byte(data), &r)
 		// Check everything worked
 		require.NoError(t, err)
 		require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
 		require.Equal(t, "test", r.Comment)
 		_, cidr, err := net.ParseCIDR("10.1.2.40/29")
 		require.NoError(t, err)
 		require.Equal(t, CIDR(*cidr), r.Network)
 		require.Equal(t, "test", r.Comment)
 		if testCase.HasVnet {
 			require.Equal(t, uuid.MustParse("38c95083-8191-4110-8339-3f438d44fdb9"), *r.VNetID)
 		} else {
 			require.Nil(t, r.VNetID)
 		}
 	}
 }
 func TestDetailedRouteJsonRoundtrip(t *testing.T) {
 	testCases := []struct {
 		Json    string
 		HasVnet bool
 	}{
 		{
 			`{
 				"id":"91ebc578-cc99-4641-9937-0fb630505fa0",
 				"network":"10.1.2.40/29",
 				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
 				"comment":"test",
 				"created_at":"2020-12-22T02:00:15.587008Z",
 				"deleted_at":"2021-01-14T05:01:42.183002Z",
 				"tunnel_name":"Mr. Tun"
 			}`,
 			false,
 		},
 		{
 			`{
 				"id":"91ebc578-cc99-4641-9937-0fb630505fa0",
 				"network":"10.1.2.40/29",
 				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
 				"virtual_network_id":"38c95083-8191-4110-8339-3f438d44fdb9",
 				"comment":"test",
 				"created_at":"2020-12-22T02:00:15.587008Z",
 				"deleted_at":"2021-01-14T05:01:42.183002Z",
 				"tunnel_name":"Mr. Tun"
 			}`,
 			true,
 		},
 	}
 	for _, testCase := range testCases {
 		data := testCase.Json
 		var r DetailedRoute
 		err := json.Unmarshal([]byte(data), &r)
 		// Check everything worked
 		require.NoError(t, err)
 		require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
 		require.Equal(t, "test", r.Comment)
 		_, cidr, err := net.ParseCIDR("10.1.2.40/29")
 		require.NoError(t, err)
 		require.Equal(t, CIDR(*cidr), r.Network)
 		require.Equal(t, "test", r.Comment)
 		require.Equal(t, "Mr. Tun", r.TunnelName)
 		if testCase.HasVnet {
 			require.Equal(t, uuid.MustParse("38c95083-8191-4110-8339-3f438d44fdb9"), *r.VNetID)
 		} else {
 			require.Nil(t, r.VNetID)
 		}
 		bytes, err := json.Marshal(r)
 		require.NoError(t, err)
 		obtainedJson := string(bytes)
 		data = strings.Replace(data, "\t", "", -1)
 		data = strings.Replace(data, "\n", "", -1)
 		require.Equal(t, data, obtainedJson)
 	}
 }
 func TestMarshalNewRoute(t *testing.T) {
 	_, network, err := net.ParseCIDR("1.2.3.4/32")
 	require.NoError(t, err)
 	require.NotNil(t, network)
 	vnetId := uuid.New()
 	newRoutes := []NewRoute{
 		{
 			Network:  *network,
 			TunnelID: uuid.New(),
 			Comment:  "hi",
 		},
 		{
 			Network:  *network,
 			TunnelID: uuid.New(),
 			Comment:  "hi",
 			VNetID:   &vnetId,
 		},
 	}
 	for _, newRoute := range newRoutes {
 		// Test where receiver is struct
 		serialized, err := json.Marshal(newRoute)
 		require.NoError(t, err)
 		require.True(t, strings.Contains(string(serialized), "tunnel_id"))
 		// Test where receiver is pointer to struct
 		serialized, err = json.Marshal(&newRoute)
 		require.NoError(t, err)
 		require.True(t, strings.Contains(string(serialized), "tunnel_id"))
 		if newRoute.VNetID == nil {
 			require.False(t, strings.Contains(string(serialized), "virtual_network_id"))
 		} else {
 			require.True(t, strings.Contains(string(serialized), "virtual_network_id"))
 		}
 	}
 }
 func TestRouteTableString(t *testing.T) {
 	_, network, err := net.ParseCIDR("1.2.3.4/32")
 	require.NoError(t, err)
 	require.NotNil(t, network)
 	r := DetailedRoute{
 		ID:      uuid.Nil,
 		Network: CIDR(*network),
 	}
 	row := r.TableString()
 	fmt.Println(row)
 	require.True(t, strings.HasPrefix(row, "00000000-0000-0000-0000-000000000000\t1.2.3.4/32"))
 }
--- a/cfapi/tunnel.go
+++ b/cfapi/tunnel.go
@ -1,237 +0,0 @@
 package cfapi
 import (
 	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/url"
 	"path"
 	"time"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 )
 var ErrTunnelNameConflict = errors.New("tunnel with name already exists")
 type Tunnel struct {
 	ID          uuid.UUID    `json:"id"`
 	Name        string       `json:"name"`
 	CreatedAt   time.Time    `json:"created_at"`
 	DeletedAt   time.Time    `json:"deleted_at"`
 	Connections []Connection `json:"connections"`
 }
 type TunnelWithToken struct {
 	Tunnel
 	Token string `json:"token"`
 }
 type Connection struct {
 	ColoName           string    `json:"colo_name"`
 	ID                 uuid.UUID `json:"id"`
 	IsPendingReconnect bool      `json:"is_pending_reconnect"`
 	OriginIP           net.IP    `json:"origin_ip"`
 	OpenedAt           time.Time `json:"opened_at"`
 }
 type ActiveClient struct {
 	ID          uuid.UUID    `json:"id"`
 	Features    []string     `json:"features"`
 	Version     string       `json:"version"`
 	Arch        string       `json:"arch"`
 	RunAt       time.Time    `json:"run_at"`
 	Connections []Connection `json:"conns"`
 }
 type newTunnel struct {
 	Name         string `json:"name"`
 	TunnelSecret []byte `json:"tunnel_secret"`
 }
 type managementRequest struct {
 	Resources []string `json:"resources"`
 }
 type CleanupParams struct {
 	queryParams url.Values
 }
 func NewCleanupParams() *CleanupParams {
 	return &CleanupParams{
 		queryParams: url.Values{},
 	}
 }
 func (cp *CleanupParams) ForClient(clientID uuid.UUID) {
 	cp.queryParams.Set("client_id", clientID.String())
 }
 func (cp CleanupParams) encode() string {
 	return cp.queryParams.Encode()
 }
 func (r *RESTClient) CreateTunnel(name string, tunnelSecret []byte) (*TunnelWithToken, error) {
 	if name == "" {
 		return nil, errors.New("tunnel name required")
 	}
 	if _, err := uuid.Parse(name); err == nil {
 		return nil, errors.New("you cannot use UUIDs as tunnel names")
 	}
 	body := &newTunnel{
 		Name:         name,
 		TunnelSecret: tunnelSecret,
 	}
 	resp, err := r.sendRequest("POST", r.baseEndpoints.accountLevel, body)
 	if err != nil {
 		return nil, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	switch resp.StatusCode {
 	case http.StatusOK:
 		var tunnel TunnelWithToken
 		if serdeErr := parseResponse(resp.Body, &tunnel); serdeErr != nil {
 			return nil, serdeErr
 		}
 		return &tunnel, nil
 	case http.StatusConflict:
 		return nil, ErrTunnelNameConflict
 	}
 	return nil, r.statusCodeToError("create tunnel", resp)
 }
 func (r *RESTClient) GetTunnel(tunnelID uuid.UUID) (*Tunnel, error) {
 	endpoint := r.baseEndpoints.accountLevel
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v", tunnelID))
 	resp, err := r.sendRequest("GET", endpoint, nil)
 	if err != nil {
 		return nil, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		return unmarshalTunnel(resp.Body)
 	}
 	return nil, r.statusCodeToError("get tunnel", resp)
 }
 func (r *RESTClient) GetTunnelToken(tunnelID uuid.UUID) (token string, err error) {
 	endpoint := r.baseEndpoints.accountLevel
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v/token", tunnelID))
 	resp, err := r.sendRequest("GET", endpoint, nil)
 	if err != nil {
 		return "", errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		err = parseResponse(resp.Body, &token)
 		return token, err
 	}
 	return "", r.statusCodeToError("get tunnel token", resp)
 }
 func (r *RESTClient) GetManagementToken(tunnelID uuid.UUID) (token string, err error) {
 	endpoint := r.baseEndpoints.accountLevel
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v/management", tunnelID))
 	body := &managementRequest{
 		Resources: []string{"logs"},
 	}
 	resp, err := r.sendRequest("POST", endpoint, body)
 	if err != nil {
 		return "", errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		err = parseResponse(resp.Body, &token)
 		return token, err
 	}
 	return "", r.statusCodeToError("get tunnel token", resp)
 }
 func (r *RESTClient) DeleteTunnel(tunnelID uuid.UUID, cascade bool) error {
 	endpoint := r.baseEndpoints.accountLevel
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v", tunnelID))
 	// Cascade will delete all tunnel dependencies (connections, routes, etc.) that
 	// are linked to the deleted tunnel.
 	if cascade {
 		endpoint.RawQuery = "cascade=true"
 	}
 	resp, err := r.sendRequest("DELETE", endpoint, nil)
 	if err != nil {
 		return errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	return r.statusCodeToError("delete tunnel", resp)
 }
 func (r *RESTClient) ListTunnels(filter *TunnelFilter) ([]*Tunnel, error) {
 	fetchFn := func(page int) (*http.Response, error) {
 		endpoint := r.baseEndpoints.accountLevel
 		filter.Page(page)
 		endpoint.RawQuery = filter.encode()
 		rsp, err := r.sendRequest("GET", endpoint, nil)
 		if err != nil {
 			return nil, errors.Wrap(err, "REST request failed")
 		}
 		if rsp.StatusCode != http.StatusOK {
 			rsp.Body.Close()
 			return nil, r.statusCodeToError("list tunnels", rsp)
 		}
 		return rsp, nil
 	}
 	return fetchExhaustively[Tunnel](fetchFn)
 }
 func (r *RESTClient) ListActiveClients(tunnelID uuid.UUID) ([]*ActiveClient, error) {
 	endpoint := r.baseEndpoints.accountLevel
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v/connections", tunnelID))
 	resp, err := r.sendRequest("GET", endpoint, nil)
 	if err != nil {
 		return nil, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		return parseConnectionsDetails(resp.Body)
 	}
 	return nil, r.statusCodeToError("list connection details", resp)
 }
 func parseConnectionsDetails(reader io.Reader) ([]*ActiveClient, error) {
 	var clients []*ActiveClient
 	err := parseResponse(reader, &clients)
 	return clients, err
 }
 func (r *RESTClient) CleanupConnections(tunnelID uuid.UUID, params *CleanupParams) error {
 	endpoint := r.baseEndpoints.accountLevel
 	endpoint.RawQuery = params.encode()
 	endpoint.Path = path.Join(endpoint.Path, fmt.Sprintf("%v/connections", tunnelID))
 	resp, err := r.sendRequest("DELETE", endpoint, nil)
 	if err != nil {
 		return errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	return r.statusCodeToError("cleanup connections", resp)
 }
 func unmarshalTunnel(reader io.Reader) (*Tunnel, error) {
 	var tunnel Tunnel
 	err := parseResponse(reader, &tunnel)
 	return &tunnel, err
 }
--- a/cfapi/tunnel_filter.go
+++ b/cfapi/tunnel_filter.go
@ -1,59 +0,0 @@
 package cfapi
 import (
 	"net/url"
 	"strconv"
 	"time"
 	"github.com/google/uuid"
 )
 const (
 	TimeLayout = time.RFC3339
 )
 type TunnelFilter struct {
 	queryParams url.Values
 }
 func NewTunnelFilter() *TunnelFilter {
 	return &TunnelFilter{
 		queryParams: url.Values{},
 	}
 }
 func (f *TunnelFilter) ByName(name string) {
 	f.queryParams.Set("name", name)
 }
 func (f *TunnelFilter) ByNamePrefix(namePrefix string) {
 	f.queryParams.Set("name_prefix", namePrefix)
 }
 func (f *TunnelFilter) ExcludeNameWithPrefix(excludePrefix string) {
 	f.queryParams.Set("exclude_prefix", excludePrefix)
 }
 func (f *TunnelFilter) NoDeleted() {
 	f.queryParams.Set("is_deleted", "false")
 }
 func (f *TunnelFilter) ByExistedAt(existedAt time.Time) {
 	f.queryParams.Set("existed_at", existedAt.Format(TimeLayout))
 }
 func (f *TunnelFilter) ByTunnelID(tunnelID uuid.UUID) {
 	f.queryParams.Set("uuid", tunnelID.String())
 }
 func (f *TunnelFilter) MaxFetchSize(max uint) {
 	f.queryParams.Set("per_page", strconv.Itoa(int(max)))
 }
 func (f *TunnelFilter) Page(page int) {
 	f.queryParams.Set("page", strconv.Itoa(page))
 }
 func (f TunnelFilter) encode() string {
 	return f.queryParams.Encode()
 }
--- a/cfapi/tunnel_test.go
+++ b/cfapi/tunnel_test.go
@ -1,102 +0,0 @@
 package cfapi
 import (
 	"bytes"
 	"fmt"
 	"net"
 	"reflect"
 	"strings"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 )
 var loc, _ = time.LoadLocation("UTC")
 func Test_unmarshalTunnel(t *testing.T) {
 	type args struct {
 		body string
 	}
 	tests := []struct {
 		name    string
 		args    args
 		want    *Tunnel
 		wantErr bool
 	}{
 		{
 			name: "empty list",
 			args: args{body: `{"success": true, "result": {"id":"b34cc7ce-925b-46ee-bc23-4cb5c18d8292","created_at":"2021-07-29T13:46:14.090955Z","deleted_at":"2021-07-29T14:07:27.559047Z","name":"qt-bIWWN7D662ogh61pCPfu5s2XgqFY1OyV","account_id":6946212,"account_tag":"5ab4e9dfbd435d24068829fda0077963","conns_active_at":null,"conns_inactive_at":"2021-07-29T13:47:22.548482Z","tun_type":"cfd_tunnel","metadata":{"qtid":"a6fJROgkXutNruBGaJjD"}}}`},
 			want: &Tunnel{
 				ID:          uuid.MustParse("b34cc7ce-925b-46ee-bc23-4cb5c18d8292"),
 				Name:        "qt-bIWWN7D662ogh61pCPfu5s2XgqFY1OyV",
 				CreatedAt:   time.Date(2021, 07, 29, 13, 46, 14, 90955000, loc),
 				DeletedAt:   time.Date(2021, 07, 29, 14, 7, 27, 559047000, loc),
 				Connections: nil,
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := unmarshalTunnel(strings.NewReader(tt.args.body))
 			if (err != nil) != tt.wantErr {
 				t.Errorf("unmarshalTunnel() error = %v, wantErr %v", err, tt.wantErr)
 				return
 			}
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("unmarshalTunnel() = %v, want %v", got, tt.want)
 			}
 		})
 	}
 }
 func TestUnmarshalTunnelOk(t *testing.T) {
 	jsonBody := `{"success": true, "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}`
 	expected := Tunnel{
 		ID:          uuid.Nil,
 		Name:        "test",
 		CreatedAt:   time.Time{},
 		Connections: []Connection{},
 	}
 	actual, err := unmarshalTunnel(bytes.NewReader([]byte(jsonBody)))
 	assert.NoError(t, err)
 	assert.Equal(t, &expected, actual)
 }
 func TestUnmarshalTunnelErr(t *testing.T) {
 	tests := []string{
 		`abc`,
 		`{"success": true, "result": abc}`,
 		`{"success": false, "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
 		`{"errors": [{"code": 1003, "message":"An A, AAAA or CNAME record already exists with that host"}], "result": {"id": "00000000-0000-0000-0000-000000000000","name":"test","created_at":"0001-01-01T00:00:00Z","connections":[]}}}`,
 	}
 	for i, test := range tests {
 		_, err := unmarshalTunnel(bytes.NewReader([]byte(test)))
 		assert.Error(t, err, fmt.Sprintf("Test #%v failed", i))
 	}
 }
 func TestUnmarshalConnections(t *testing.T) {
 	jsonBody := `{"success":true,"messages":[],"errors":[],"result":[{"id":"d4041254-91e3-4deb-bd94-b46e11680b1e","features":["ha-origin"],"version":"2021.2.5","arch":"darwin_amd64","conns":[{"colo_name":"LIS","id":"ac2286e5-c708-4588-a6a0-ba6b51940019","is_pending_reconnect":false,"origin_ip":"148.38.28.2","opened_at":"0001-01-01T00:00:00Z"}],"run_at":"0001-01-01T00:00:00Z"}]}`
 	expected := ActiveClient{
 		ID:       uuid.MustParse("d4041254-91e3-4deb-bd94-b46e11680b1e"),
 		Features: []string{"ha-origin"},
 		Version:  "2021.2.5",
 		Arch:     "darwin_amd64",
 		RunAt:    time.Time{},
 		Connections: []Connection{{
 			ID:                 uuid.MustParse("ac2286e5-c708-4588-a6a0-ba6b51940019"),
 			ColoName:           "LIS",
 			IsPendingReconnect: false,
 			OriginIP:           net.ParseIP("148.38.28.2"),
 			OpenedAt:           time.Time{},
 		}},
 	}
 	actual, err := parseConnectionsDetails(bytes.NewReader([]byte(jsonBody)))
 	assert.NoError(t, err)
 	assert.Equal(t, []*ActiveClient{&expected}, actual)
 }
--- a/cfapi/virtual_network.go
+++ b/cfapi/virtual_network.go
@ -1,134 +0,0 @@
 package cfapi
 import (
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"path"
 	"strconv"
 	"time"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 )
 type NewVirtualNetwork struct {
 	Name      string `json:"name"`
 	Comment   string `json:"comment"`
 	IsDefault bool   `json:"is_default_network"`
 }
 type VirtualNetwork struct {
 	ID        uuid.UUID `json:"id"`
 	Comment   string    `json:"comment"`
 	Name      string    `json:"name"`
 	IsDefault bool      `json:"is_default_network"`
 	CreatedAt time.Time `json:"created_at"`
 	DeletedAt time.Time `json:"deleted_at"`
 }
 type UpdateVirtualNetwork struct {
 	Name      *string `json:"name,omitempty"`
 	Comment   *string `json:"comment,omitempty"`
 	IsDefault *bool   `json:"is_default_network,omitempty"`
 }
 func (virtualNetwork VirtualNetwork) TableString() string {
 	deletedColumn := "-"
 	if !virtualNetwork.DeletedAt.IsZero() {
 		deletedColumn = virtualNetwork.DeletedAt.Format(time.RFC3339)
 	}
 	return fmt.Sprintf(
 		"%s\t%s\t%s\t%s\t%s\t%s\t",
 		virtualNetwork.ID,
 		virtualNetwork.Name,
 		strconv.FormatBool(virtualNetwork.IsDefault),
 		virtualNetwork.Comment,
 		virtualNetwork.CreatedAt.Format(time.RFC3339),
 		deletedColumn,
 	)
 }
 func (r *RESTClient) CreateVirtualNetwork(newVnet NewVirtualNetwork) (VirtualNetwork, error) {
 	resp, err := r.sendRequest("POST", r.baseEndpoints.accountVnets, newVnet)
 	if err != nil {
 		return VirtualNetwork{}, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		return parseVnet(resp.Body)
 	}
 	return VirtualNetwork{}, r.statusCodeToError("add virtual network", resp)
 }
 func (r *RESTClient) ListVirtualNetworks(filter *VnetFilter) ([]*VirtualNetwork, error) {
 	endpoint := r.baseEndpoints.accountVnets
 	endpoint.RawQuery = filter.Encode()
 	resp, err := r.sendRequest("GET", endpoint, nil)
 	if err != nil {
 		return nil, errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		return parseListVnets(resp.Body)
 	}
 	return nil, r.statusCodeToError("list virtual networks", resp)
 }
 func (r *RESTClient) DeleteVirtualNetwork(id uuid.UUID, force bool) error {
 	endpoint := r.baseEndpoints.accountVnets
 	endpoint.Path = path.Join(endpoint.Path, url.PathEscape(id.String()))
 	queryParams := url.Values{}
 	if force {
 		queryParams.Set("force", strconv.FormatBool(force))
 	}
 	endpoint.RawQuery = queryParams.Encode()
 	resp, err := r.sendRequest("DELETE", endpoint, nil)
 	if err != nil {
 		return errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		_, err := parseVnet(resp.Body)
 		return err
 	}
 	return r.statusCodeToError("delete virtual network", resp)
 }
 func (r *RESTClient) UpdateVirtualNetwork(id uuid.UUID, updates UpdateVirtualNetwork) error {
 	endpoint := r.baseEndpoints.accountVnets
 	endpoint.Path = path.Join(endpoint.Path, url.PathEscape(id.String()))
 	resp, err := r.sendRequest("PATCH", endpoint, updates)
 	if err != nil {
 		return errors.Wrap(err, "REST request failed")
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode == http.StatusOK {
 		_, err := parseVnet(resp.Body)
 		return err
 	}
 	return r.statusCodeToError("update virtual network", resp)
 }
 func parseListVnets(body io.ReadCloser) ([]*VirtualNetwork, error) {
 	var vnets []*VirtualNetwork
 	err := parseResponse(body, &vnets)
 	return vnets, err
 }
 func parseVnet(body io.ReadCloser) (VirtualNetwork, error) {
 	var vnet VirtualNetwork
 	err := parseResponse(body, &vnet)
 	return vnet, err
 }
--- a/cfapi/virtual_network_filter.go
+++ b/cfapi/virtual_network_filter.go
@ -1,99 +0,0 @@
 package cfapi
 import (
 	"net/url"
 	"strconv"
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
 )
 var (
 	filterVnetId = cli.StringFlag{
 		Name:  "id",
 		Usage: "List virtual networks with the given `ID`",
 	}
 	filterVnetByName = cli.StringFlag{
 		Name:  "name",
 		Usage: "List virtual networks with the given `NAME`",
 	}
 	filterDefaultVnet = cli.BoolFlag{
 		Name:  "is-default",
 		Usage: "If true, lists the virtual network that is the default one. If false, lists all non-default virtual networks for the account. If absent, all are included in the results regardless of their default status.",
 	}
 	filterDeletedVnet = cli.BoolFlag{
 		Name:  "show-deleted",
 		Usage: "If false (default), only show non-deleted virtual networks. If true, only show deleted virtual networks.",
 	}
 	VnetFilterFlags = []cli.Flag{
 		&filterVnetId,
 		&filterVnetByName,
 		&filterDefaultVnet,
 		&filterDeletedVnet,
 	}
 )
 // VnetFilter which virtual networks get queried.
 type VnetFilter struct {
 	queryParams url.Values
 }
 func NewVnetFilter() *VnetFilter {
 	return &VnetFilter{
 		queryParams: url.Values{},
 	}
 }
 func (f *VnetFilter) ById(vnetId uuid.UUID) {
 	f.queryParams.Set("id", vnetId.String())
 }
 func (f *VnetFilter) ByName(name string) {
 	f.queryParams.Set("name", name)
 }
 func (f *VnetFilter) ByDefaultStatus(isDefault bool) {
 	f.queryParams.Set("is_default", strconv.FormatBool(isDefault))
 }
 func (f *VnetFilter) WithDeleted(isDeleted bool) {
 	f.queryParams.Set("is_deleted", strconv.FormatBool(isDeleted))
 }
 func (f *VnetFilter) MaxFetchSize(max uint) {
 	f.queryParams.Set("per_page", strconv.Itoa(int(max)))
 }
 func (f VnetFilter) Encode() string {
 	return f.queryParams.Encode()
 }
 // NewFromCLI parses CLI flags to discover which filters should get applied to list virtual networks.
 func NewFromCLI(c *cli.Context) (*VnetFilter, error) {
 	f := NewVnetFilter()
 	if id := c.String("id"); id != "" {
 		vnetId, err := uuid.Parse(id)
 		if err != nil {
 			return nil, errors.Wrapf(err, "%s is not a valid virtual network ID", id)
 		}
 		f.ById(vnetId)
 	}
 	if name := c.String("name"); name != "" {
 		f.ByName(name)
 	}
 	if c.IsSet("is-default") {
 		f.ByDefaultStatus(c.Bool("is-default"))
 	}
 	f.WithDeleted(c.Bool("show-deleted"))
 	if maxFetch := c.Int("max-fetch-size"); maxFetch > 0 {
 		f.MaxFetchSize(uint(maxFetch))
 	}
 	return f, nil
 }
--- a/cfapi/virtual_network_test.go
+++ b/cfapi/virtual_network_test.go
@ -1,79 +0,0 @@
 package cfapi
 import (
 	"encoding/json"
 	"strings"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 )
 func TestVirtualNetworkJsonRoundtrip(t *testing.T) {
 	data := `{
 		"id":"74fce949-351b-4752-b261-81a56cfd3130",
 		"comment":"New York DC1",
 		"name":"us-east-1",
 		"is_default_network":true,
 		"created_at":"2021-11-26T14:40:02.600673Z",
 		"deleted_at":"2021-12-01T10:23:13.102645Z"
 	}`
 	var v VirtualNetwork
 	err := json.Unmarshal([]byte(data), &v)
 	require.NoError(t, err)
 	require.Equal(t, uuid.MustParse("74fce949-351b-4752-b261-81a56cfd3130"), v.ID)
 	require.Equal(t, "us-east-1", v.Name)
 	require.Equal(t, "New York DC1", v.Comment)
 	require.Equal(t, true, v.IsDefault)
 	bytes, err := json.Marshal(v)
 	require.NoError(t, err)
 	obtainedJson := string(bytes)
 	data = strings.Replace(data, "\t", "", -1)
 	data = strings.Replace(data, "\n", "", -1)
 	require.Equal(t, data, obtainedJson)
 }
 func TestMarshalNewVnet(t *testing.T) {
 	newVnet := NewVirtualNetwork{
 		Name:      "eu-west-1",
 		Comment:   "London office",
 		IsDefault: true,
 	}
 	serialized, err := json.Marshal(newVnet)
 	require.NoError(t, err)
 	require.True(t, strings.Contains(string(serialized), newVnet.Name))
 }
 func TestMarshalUpdateVnet(t *testing.T) {
 	newName := "bulgaria-1"
 	updates := UpdateVirtualNetwork{
 		Name: &newName,
 	}
 	// Test where receiver is struct
 	serialized, err := json.Marshal(updates)
 	require.NoError(t, err)
 	require.True(t, strings.Contains(string(serialized), newName))
 }
 func TestVnetTableString(t *testing.T) {
 	virtualNet := VirtualNetwork{
 		ID:        uuid.New(),
 		Name:      "us-east-1",
 		Comment:   "New York DC1",
 		IsDefault: true,
 		CreatedAt: time.Now(),
 		DeletedAt: time.Time{},
 	}
 	row := virtualNet.TableString()
 	require.True(t, strings.HasPrefix(row, virtualNet.ID.String()))
 	require.True(t, strings.Contains(row, virtualNet.Name))
 	require.True(t, strings.Contains(row, virtualNet.Comment))
 	require.True(t, strings.Contains(row, "true"))
 	require.True(t, strings.HasSuffix(row, "-\t"))
 }
--- a/cfio/copy.go
+++ b/cfio/copy.go
@ -1,27 +0,0 @@
 package cfio
 import (
 	"io"
 	"sync"
 )
 const defaultBufferSize = 16 * 1024
 var bufferPool = sync.Pool{
 	New: func() interface{} {
 		return make([]byte, defaultBufferSize)
 	},
 }
 func Copy(dst io.Writer, src io.Reader) (written int64, err error) {
 	_, okWriteTo := src.(io.WriterTo)
 	_, okReadFrom := dst.(io.ReaderFrom)
 	var buffer []byte = nil
 	if !(okWriteTo || okReadFrom) {
 		buffer = bufferPool.Get().([]byte)
 		defer bufferPool.Put(buffer)
 	}
 	return io.CopyBuffer(dst, src, buffer)
 }
--- a/cfsetup.yaml
+++ b/cfsetup.yaml
@ -1,2 +1,232 @@
-# A valid cfsetup.yaml is required but we dont have any real config to specify
+pinned_go: &pinned_go go=1.17-1
-dummy_key: true
+pinned_go_fips: &pinned_go_fips go-boring=1.16.6-6
 build_dir: &build_dir /cfsetup_build
 default-flavor: buster
 stretch: &stretch
  build:
    build_dir: *build_dir
    builddeps:
      - *pinned_go_fips
      - build-essential
    post-cache:
      - export GOOS=linux
      - export GOARCH=amd64
      - export FIPS=true
      - make cloudflared
  build-non-fips:  # helpful to catch problems with non-fips (only used for releasing non-linux artifacts) before releases
    build_dir: *build_dir
    builddeps:
      - *pinned_go
      - build-essential
    post-cache:
      - export GOOS=linux
      - export GOARCH=amd64
      - make cloudflared
  build-all-packages: #except osxpkg
    build_dir: *build_dir
    builddeps:
      - *pinned_go_fips
      - build-essential
      - fakeroot
      - rubygem-fpm
      - rpm
      - wget
      # libmsi and libgcab are libraries the wixl binary depends on.
      - libmsi-dev
      - libgcab-dev
    pre-cache:
      # TODO: https://jira.cfops.it/browse/TUN-4792 Replace this wixl with the official one once msitools supports
      # environment.
      - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
      - chmod a+x /usr/local/bin/wixl
    post-cache:
      - export FIPS=true
      - ./build-packages.sh
  github-release-pkgs:
    build_dir: *build_dir
    builddeps:
      - *pinned_go_fips
      - build-essential
      - fakeroot
      - rubygem-fpm
      - rpm
      - wget
      # libmsi and libgcab are libraries the wixl binary depends on.
      - libmsi-dev
      - libgcab-dev
      - python3-dev
      - libffi-dev
      - python3-setuptools
      - python3-pip
    pre-cache:
      - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
      - chmod a+x /usr/local/bin/wixl
      - pip3 install pygithub
    post-cache:
      # build all packages and move them to /cfsetup/built_artifacts
      - ./build-packages.sh
      # release the packages built and moved to /cfsetup/built_artifacts
      - make github-release-built-pkgs
  build-deb:
    build_dir: *build_dir
    builddeps: &build_deb_deps
      - *pinned_go_fips
      - build-essential
      - fakeroot
      - rubygem-fpm
    post-cache:
      - export GOOS=linux
      - export GOARCH=amd64
      - export FIPS=true
      - make cloudflared-deb
  build-deb-nightly:
    build_dir: *build_dir
    builddeps: *build_deb_deps
    post-cache:
      - export GOOS=linux
      - export GOARCH=amd64
      - export FIPS=true
      - export NIGHTLY=true
      - make cloudflared-deb
  build-deb-arm64:
    build_dir: *build_dir
    builddeps: *build_deb_deps
    post-cache:
      - export GOOS=linux
      - export GOARCH=arm64
      - make cloudflared-deb
  publish-deb:
    build_dir: *build_dir
    builddeps:
      - *pinned_go_fips
      - build-essential
      - fakeroot
      - rubygem-fpm
      - openssh-client
    post-cache:
      - export GOOS=linux
      - export GOARCH=amd64
      - export FIPS=true
      - make publish-deb
  github-release-macos-amd64:
    build_dir: *build_dir
    builddeps:
      - *pinned_go
      - python3-setuptools
      - python3-pip
    pre-cache: &install_pygithub
      - pip3 install pygithub
    post-cache:
      - make github-mac-upload
  test:
    build_dir: *build_dir
    builddeps:
      - *pinned_go_fips
      - build-essential
      - gotest-to-teamcity
    pre-cache:
      - go get golang.org/x/tools/cmd/goimports
      - go get github.com/sudarshan-reddy/go-sumtype@v0.0.0-20210827105221-82eca7e5abb1
    post-cache:
      - export GOOS=linux
      - export GOARCH=amd64
      - export FIPS=true
      - export PATH="$HOME/go/bin:$PATH"
      - ./fmt-check.sh
      - make test | gotest-to-teamcity
  component-test:
    build_dir: *build_dir
    builddeps:
      - *pinned_go_fips
      - python3.7
      - python3-pip
      - python3-setuptools
      # procps installs the ps command which is needed in test_sysv_service because the init script
      # uses ps pid to determine if the agent is running
      - procps
    pre-cache-copy-paths:
      - component-tests/requirements.txt
    pre-cache:
      - sudo pip3 install --upgrade -r component-tests/requirements.txt
    post-cache:
      # Creates and routes a Named Tunnel for this build. Also constructs config file from env vars.
      - python3 component-tests/setup.py --type create
      - pytest component-tests
      # The Named Tunnel is deleted and its route unprovisioned here.
      - python3 component-tests/setup.py --type cleanup
  update-homebrew:
    builddeps:
      - openssh-client
      - s3cmd
    post-cache:
      - .teamcity/update-homebrew.sh
  github-message-release:
    build_dir: *build_dir
    builddeps:
      - *pinned_go
      - python3-setuptools
      - python3-pip
    pre-cache: *install_pygithub
    post-cache:
      - make github-message
  build-junos:
    build_dir: *build_dir
    builddeps:
      - *pinned_go
      - build-essential
      - python3
      - genisoimage
      - jetez
    pre-cache:
      - ln -s /usr/bin/genisoimage /usr/bin/mkisofs
    post-cache:
      - export GOOS=freebsd
      - export GOARCH=amd64
      - make cloudflared-junos
  publish-junos:
    build_dir: *build_dir
    builddeps:
      - *pinned_go
      - build-essential
      - python3
      - genisoimage
      - jetez
      - s4cmd
    pre-cache:
      - ln -s /usr/bin/genisoimage /usr/bin/mkisofs
    post-cache:
      - export GOOS=freebsd
      - export GOARCH=amd64
      - make publish-cloudflared-junos
 buster: *stretch
 bullseye: *stretch
 centos-7:
  publish-rpm:
    build_dir: *build_dir
    builddeps: &el7_builddeps
      - https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
    pre-cache:
      - yum install -y fakeroot
      - yum upgrade -y binutils-2.27-44.base.el7.x86_64
      - wget https://golang.org/dl/go1.16.3.linux-amd64.tar.gz -P /tmp/
      - tar -C /usr/local -xzf /tmp/go1.16.3.linux-amd64.tar.gz
    post-cache:
      - export PATH=$PATH:/usr/local/go/bin
      - export GOOS=linux
      - export GOARCH=amd64
      - make publish-rpm
  build-rpm:
    build_dir: *build_dir
    builddeps: *el7_builddeps
    pre-cache:
      - yum install -y fakeroot
      - yum upgrade -y binutils-2.27-44.base.el7.x86_64
      - wget https://golang.org/dl/go1.16.3.linux-amd64.tar.gz -P /tmp/
      - tar -C /usr/local -xzf /tmp/go1.16.3.linux-amd64.tar.gz
    post-cache:
      - export PATH=$PATH:/usr/local/go/bin
      - export GOOS=linux
      - export GOARCH=amd64
      - make cloudflared-rpm
--- a/check-fips.sh
+++ b/check-fips.sh
@ -1,15 +0,0 @@
 # Pass the path to the executable to check for FIPS compliance
 exe=$1
 if [ "$(go tool nm "${exe}" | grep -c '_Cfunc__goboringcrypto_')" -eq 0 ]; then
    # Asserts that executable is using FIPS-compliant boringcrypto
    echo "${exe}: missing goboring symbols" >&2
    exit 1
 fi
 if [ "$(go tool nm "${exe}" | grep -c 'crypto/internal/boring/sig.FIPSOnly')" -eq 0 ]; then
    # Asserts that executable is using FIPS-only schemes
    echo "${exe}: missing fipsonly symbols" >&2
    exit 1
 fi
 echo "${exe} is FIPS-compliant"
--- a/client/config.go
+++ b/client/config.go
@ -1,74 +0,0 @@
 package client
 import (
 	"fmt"
 	"net"
 	"github.com/google/uuid"
 	"github.com/rs/zerolog"
 	"github.com/cloudflare/cloudflared/features"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 // Config captures the local client runtime configuration.
 type Config struct {
 	ConnectorID uuid.UUID
 	Version     string
 	Arch        string
 	featureSelector features.FeatureSelector
 }
 func NewConfig(version string, arch string, featureSelector features.FeatureSelector) (*Config, error) {
 	connectorID, err := uuid.NewRandom()
 	if err != nil {
 		return nil, fmt.Errorf("unable to generate a connector UUID: %w", err)
 	}
 	return &Config{
 		ConnectorID:     connectorID,
 		Version:         version,
 		Arch:            arch,
 		featureSelector: featureSelector,
 	}, nil
 }
 // ConnectionOptionsSnapshot is a snapshot of the current client information used to initialize a connection.
 //
 // The FeatureSnapshot is the features that are available for this connection. At the client level they may
 // change, but they will not change within the scope of this struct.
 type ConnectionOptionsSnapshot struct {
 	client              pogs.ClientInfo
 	originLocalIP       net.IP
 	numPreviousAttempts uint8
 	FeatureSnapshot     features.FeatureSnapshot
 }
 func (c *Config) ConnectionOptionsSnapshot(originIP net.IP, previousAttempts uint8) *ConnectionOptionsSnapshot {
 	snapshot := c.featureSelector.Snapshot()
 	return &ConnectionOptionsSnapshot{
 		client: pogs.ClientInfo{
 			ClientID: c.ConnectorID[:],
 			Version:  c.Version,
 			Arch:     c.Arch,
 			Features: snapshot.FeaturesList,
 		},
 		originLocalIP:       originIP,
 		numPreviousAttempts: previousAttempts,
 		FeatureSnapshot:     snapshot,
 	}
 }
 func (c ConnectionOptionsSnapshot) ConnectionOptions() *pogs.ConnectionOptions {
 	return &pogs.ConnectionOptions{
 		Client:              c.client,
 		OriginLocalIP:       c.originLocalIP,
 		ReplaceExisting:     false,
 		CompressionQuality:  0,
 		NumPreviousAttempts: c.numPreviousAttempts,
 	}
 }
 func (c ConnectionOptionsSnapshot) LogFields(event *zerolog.Event) *zerolog.Event {
 	return event.Strs("features", c.client.Features)
 }
--- a/client/config_test.go
+++ b/client/config_test.go
@ -1,50 +0,0 @@
 package client
 import (
 	"net"
 	"testing"
 	"github.com/stretchr/testify/require"
 	"github.com/cloudflare/cloudflared/features"
 )
 func TestGenerateConnectionOptions(t *testing.T) {
 	version := "1234"
 	arch := "linux_amd64"
 	originIP := net.ParseIP("192.168.1.1")
 	var previousAttempts uint8 = 4
 	config, err := NewConfig(version, arch, &mockFeatureSelector{})
 	require.NoError(t, err)
 	require.Equal(t, version, config.Version)
 	require.Equal(t, arch, config.Arch)
 	// Validate ConnectionOptionsSnapshot fields
 	connOptions := config.ConnectionOptionsSnapshot(originIP, previousAttempts)
 	require.Equal(t, version, connOptions.client.Version)
 	require.Equal(t, arch, connOptions.client.Arch)
 	require.Equal(t, config.ConnectorID[:], connOptions.client.ClientID)
 	// Vaidate snapshot feature fields against the connOptions generated
 	snapshot := config.featureSelector.Snapshot()
 	require.Equal(t, features.DatagramV3, snapshot.DatagramVersion)
 	require.Equal(t, features.DatagramV3, connOptions.FeatureSnapshot.DatagramVersion)
 	pogsConnOptions := connOptions.ConnectionOptions()
 	require.Equal(t, connOptions.client, pogsConnOptions.Client)
 	require.Equal(t, originIP, pogsConnOptions.OriginLocalIP)
 	require.False(t, pogsConnOptions.ReplaceExisting)
 	require.Equal(t, uint8(0), pogsConnOptions.CompressionQuality)
 	require.Equal(t, previousAttempts, pogsConnOptions.NumPreviousAttempts)
 }
 type mockFeatureSelector struct{}
 func (m *mockFeatureSelector) Snapshot() features.FeatureSnapshot {
 	return features.FeatureSnapshot{
 		PostQuantum:     features.PostQuantumPrefer,
 		DatagramVersion: features.DatagramV3,
 		FeaturesList:    []string{features.FeaturePostQuantum, features.FeatureDatagramV3_2},
 	}
 }
--- a/cloudflared.wxs
+++ b/cloudflared.wxs
@ -1,64 +1,62 @@
 <?xml version="1.0"?>
-<?if $(var.Platform)="x64" ?>
+<?if $(var.Platform)="x86"?>
    <?define Program_Files="ProgramFiles64Folder"?>
 <?else ?>
    <?define Program_Files="ProgramFilesFolder"?>
-<?endif ?>
+<?else?>
    <?define Program_Files="ProgramFiles64Folder"?>
 <?endif?>
 <?ifndef var.Version?>
    <?error Undefined Version variable?>
-<?endif ?>
+<?endif?>
 <?ifndef var.Path?>
    <?error Undefined Path variable?>
-<?endif ?>
+<?endif?>
 <Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
-    <Product Id="*"
+    <Product Id="35e5e858-9372-4449-bf73-1cd6f7267128" 
        UpgradeCode="23f90fdd-9328-47ea-ab52-5380855a4b12"
        Name="cloudflared"
        Version="$(var.Version)"
        Manufacturer="cloudflare"
        Language="1033">
-        <Package InstallerVersion="200" Compressed="yes" Comments="Windows Installer Package" InstallScope="perMachine" />
+      <Package InstallerVersion="200" Compressed="yes" Comments="Windows Installer Package" InstallScope="perMachine"/>
-        <Media Id="1" Cabinet="product.cab" EmbedCab="yes" />
+      <Media Id="1" Cabinet="product.cab" EmbedCab="yes"/>
-        <MajorUpgrade DowngradeErrorMessage="A later version of [ProductName] is already installed. Setup will now exit." />
+      <Upgrade Id="23f90fdd-9328-47ea-ab52-5380855a4b12">
         <UpgradeVersion Minimum="$(var.Version)" OnlyDetect="yes" Property="NEWERVERSIONDETECTED"/>
         <UpgradeVersion Minimum="2020.8.0" Maximum="$(var.Version)" IncludeMinimum="yes" IncludeMaximum="no"
                         Property="OLDERVERSIONBEINGUPGRADED"/>
      </Upgrade>
      <Condition Message="A newer version of this software is already installed.">NOT NEWERVERSIONDETECTED</Condition>
-        <Upgrade Id="23f90fdd-9328-47ea-ab52-5380855a4b12">
+    <Directory Id="TARGETDIR" Name="SourceDir">
-            <UpgradeVersion Minimum="$(var.Version)" OnlyDetect="yes" Property="NEWERVERSIONDETECTED" />
+        <!--This specifies where the cloudflared.exe is moved to in the windows Operation System-->
-            <UpgradeVersion Minimum="2020.8.0" Maximum="$(var.Version)" IncludeMinimum="yes" IncludeMaximum="no"
+        <Directory Id="$(var.Program_Files)">
-                Property="OLDERVERSIONBEINGUPGRADED" />
+            <Directory Id="INSTALLDIR" Name="cloudflared">
-        </Upgrade>
+                <Component Id="ApplicationFiles" Guid="35e5e858-9372-4449-bf73-1cd6f7267128">
-        <Condition Message="A newer version of this software is already installed.">NOT NEWERVERSIONDETECTED</Condition>
+                    <File Id="ApplicationFile0" Source="$(var.Path)"/>
-
+                </Component>
        <Directory Id="TARGETDIR" Name="SourceDir">
            <!--This specifies where the cloudflared.exe is moved to in the windows Operation System-->
            <Directory Id="$(var.Program_Files)">
                <Directory Id="INSTALLDIR" Name="cloudflared">
                    <Component Id="ApplicationFiles" Guid="35e5e858-9372-4449-bf73-1cd6f7267128">
                        <File Id="ApplicationFile0" Source="$(var.Path)" />
                    </Component>
                </Directory>
            </Directory>
            <Component Id="ENVS" Guid="6bb74449-d10d-4f4a-933e-6fc9fa006eae">
                <!--Set the cloudflared bin location to the Path Environment Variable-->
                <Environment Id="ENV0"
                    Name="PATH"
                    Value="[INSTALLDIR]"
                    Permanent="no"
                    Part="last"
                    Action="create"
                    System="yes" />
            </Component>
        </Directory>
        <Component Id="ENVS" Guid="6bb74449-d10d-4f4a-933e-6fc9fa006eae">
        <!--Set the cloudflared bin location to the Path Environment Variable-->
         <Environment Id="ENV0"
           Name="PATH"
           Value="[INSTALLDIR]."
           Permanent="no"
           Part="last"
           Action="create"
           System="yes" />
        </Component>
    </Directory>
-        <Feature Id='Complete' Level='1'>
+    <Feature Id='Complete' Level='1'>
-            <ComponentRef Id="ENVS" />
+      <ComponentRef Id="ENVS"/>
-            <ComponentRef Id='ApplicationFiles' />
+      <ComponentRef Id='ApplicationFiles' />
-        </Feature>
+    </Feature>
    </Product>
 </Wix>
--- a/cmd/cloudflared/access/carrier.go
+++ b/cmd/cloudflared/access/carrier.go
@ -3,7 +3,6 @@ package access
 import (
 	"crypto/tls"
 	"fmt"
 	"io"
 	"net/http"
 	"strings"
@ -14,7 +13,6 @@ import (
 	"github.com/cloudflare/cloudflared/carrier"
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/stream"
 	"github.com/cloudflare/cloudflared/validation"
 )
@ -40,14 +38,12 @@ func StartForwarder(forwarder config.Forwarder, shutdown <-chan struct{}, log *z
 	if forwarder.TokenSecret != "" {
 		headers.Set(cfAccessClientSecretHeader, forwarder.TokenSecret)
 	}
 	headers.Set("User-Agent", userAgent)
 	carrier.SetBastionDest(headers, forwarder.Destination)
 	options := &carrier.StartOptions{
 		OriginURL: forwarder.URL,
 		Headers:   headers, //TODO: TUN-2688 support custom headers from config file
 		IsFedramp: forwarder.IsFedramp,
 	}
 	// we could add a cmd line variable for this bool if we want the SOCK5 server to be on the client side
@ -62,38 +58,31 @@ func StartForwarder(forwarder config.Forwarder, shutdown <-chan struct{}, log *z
 // useful for proxying other protocols (like ssh) over websockets
 // (which you can put Access in front of)
 func ssh(c *cli.Context) error {
-	// If not running as a forwarder, disable terminal logs as it collides with the stdin/stdout of the parent process
+	log := logger.CreateSSHLoggerFromContext(c, logger.EnableTerminalLog)
 	outputTerminal := logger.DisableTerminalLog
 	if c.IsSet(sshURLFlag) {
 		outputTerminal = logger.EnableTerminalLog
 	}
 	log := logger.CreateSSHLoggerFromContext(c, outputTerminal)
 	// get the hostname from the cmdline and error out if its not provided
 	rawHostName := c.String(sshHostnameFlag)
-	url, err := parseURL(rawHostName)
+	hostname, err := validation.ValidateHostname(rawHostName)
-	if err != nil {
+	if err != nil || rawHostName == "" {
 		log.Err(err).Send()
 		return cli.ShowCommandHelp(c, "ssh")
 	}
 	originURL := ensureURLScheme(hostname)
 	// get the headers from the cmdline and add them
-	headers := parseRequestHeaders(c.StringSlice(sshHeaderFlag))
+	headers := buildRequestHeaders(c.StringSlice(sshHeaderFlag))
 	if c.IsSet(sshTokenIDFlag) {
 		headers.Set(cfAccessClientIDHeader, c.String(sshTokenIDFlag))
 	}
 	if c.IsSet(sshTokenSecretFlag) {
 		headers.Set(cfAccessClientSecretHeader, c.String(sshTokenSecretFlag))
 	}
 	headers.Set("User-Agent", userAgent)
 	carrier.SetBastionDest(headers, c.String(sshDestinationFlag))
 	options := &carrier.StartOptions{
-		OriginURL: url.String(),
+		OriginURL: originURL,
 		Headers:   headers,
-		Host:      url.Host,
+		Host:      hostname,
 		IsFedramp: c.Bool(fedrampFlag),
 	}
 	if connectTo := c.String(sshConnectTo); connectTo != "" {
@ -106,7 +95,7 @@ func ssh(c *cli.Context) error {
 		case 3:
 			options.OriginURL = fmt.Sprintf("https://%s:%s", parts[2], parts[1])
 			options.TLSClientConfig = &tls.Config{
-				InsecureSkipVerify: true, // #nosec G402
+				InsecureSkipVerify: true,
 				ServerName:         parts[0],
 			}
 			log.Warn().Msgf("Using insecure SSL connection because SNI overridden to %s", parts[0])
@ -132,16 +121,16 @@ func ssh(c *cli.Context) error {
 		return err
 	}
-	var s io.ReadWriter
+	return carrier.StartClient(wsConn, &carrier.StdinoutStream{}, options)
-	s = &carrier.StdinoutStream{}
+}
-	if c.IsSet(sshDebugStream) {
+
-		maxMessages := c.Uint64(sshDebugStream)
+func buildRequestHeaders(values []string) http.Header {
-		if maxMessages == 0 {
+	headers := make(http.Header)
-			// default to 10 if provided but unset
+	for _, valuePair := range values {
-			maxMessages = 10
+		split := strings.Split(valuePair, ":")
-		}
+		if len(split) > 1 {
-		logger := log.With().Str("host", url.Host).Logger()
+			headers.Add(strings.TrimSpace(split[0]), strings.TrimSpace(split[1]))
-		s = stream.NewDebugStream(s, &logger, maxMessages)
+		}
-	}
+	}
-	return carrier.StartClient(wsConn, s, options)
+	return headers
 }
--- a/cmd/cloudflared/access/carrier_test.go
+++ b/cmd/cloudflared/access/carrier_test.go
@ -0,0 +1,18 @@
 package access
 import (
 	"net/http"
 	"testing"
 	"github.com/stretchr/testify/assert"
 )
 func TestBuildRequestHeaders(t *testing.T) {
 	headers := make(http.Header)
 	headers.Add("client", "value")
 	headers.Add("secret", "safe-value")
 	values := buildRequestHeaders([]string{"client: value", "secret: safe-value", "trash"})
 	assert.Equal(t, headers.Get("client"), values.Get("client"))
 	assert.Equal(t, headers.Get("secret"), values.Get("secret"))
 }
--- a/cmd/cloudflared/access/cmd.go
+++ b/cmd/cloudflared/access/cmd.go
@ -11,7 +11,7 @@ import (
 	"text/template"
 	"time"
-	"github.com/getsentry/sentry-go"
+	"github.com/getsentry/raven-go"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
 	"github.com/urfave/cli/v2"
@ -19,7 +19,6 @@ import (
 	"github.com/cloudflare/cloudflared/carrier"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	cfdflags "github.com/cloudflare/cloudflared/cmd/cloudflared/flags"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/sshgen"
 	"github.com/cloudflare/cloudflared/token"
@ -27,8 +26,6 @@ import (
 )
 const (
 	appURLFlag         = "app"
 	loginQuietFlag     = "quiet"
 	sshHostnameFlag    = "hostname"
 	sshDestinationFlag = "destination"
 	sshURLFlag         = "url"
@ -37,34 +34,33 @@ const (
 	sshTokenSecretFlag = "service-token-secret"
 	sshGenCertFlag     = "short-lived-cert"
 	sshConnectTo       = "connect-to"
 	sshDebugStream     = "debug-stream"
 	sshConfigTemplate  = `
 Add to your {{.Home}}/.ssh/config:
 {{- if .ShortLivedCerts}}
 Match host {{.Hostname}} exec "{{.Cloudflared}} access ssh-gen --hostname %h"
  ProxyCommand {{.Cloudflared}} access ssh --hostname %h
  IdentityFile ~/.cloudflared/%h-cf_key
  CertificateFile ~/.cloudflared/%h-cf_key-cert.pub
 {{- else}}
 Host {{.Hostname}}
 {{- if .ShortLivedCerts}}
  ProxyCommand bash -c '{{.Cloudflared}} access ssh-gen --hostname %h; ssh -tt %r@cfpipe-{{.Hostname}} >&2 <&1'
 Host cfpipe-{{.Hostname}}
  HostName {{.Hostname}}
  ProxyCommand {{.Cloudflared}} access ssh --hostname %h
  IdentityFile ~/.cloudflared/{{.Hostname}}-cf_key
  CertificateFile ~/.cloudflared/{{.Hostname}}-cf_key-cert.pub
 {{- else}}
  ProxyCommand {{.Cloudflared}} access ssh --hostname %h
 {{end}}
 `
 	fedrampFlag = "fedramp"
 )
 const sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b@sentry.io/189878"
 var (
 	shutdownC chan struct{}
 	userAgent = "DEV"
 )
 // Init will initialize and store vars from the main program
-func Init(shutdown chan struct{}, version string) {
+func Init(shutdown chan struct{}) {
 	shutdownC = shutdown
 	userAgent = fmt.Sprintf("cloudflared/%s", version)
 }
 // Flags return the global flags for Access related commands (hopefully none)
@ -80,43 +76,20 @@ func Commands() []*cli.Command {
 			Aliases:  []string{"forward"},
 			Category: "Access",
 			Usage:    "access <subcommand>",
 			Flags: []cli.Flag{&cli.BoolFlag{
 				Name:  fedrampFlag,
 				Usage: "use when performing operations in fedramp account",
 			}},
 			Description: `Cloudflare Access protects internal resources by securing, authenticating and monitoring access
 			per-user and by application. With Cloudflare Access, only authenticated users with the required permissions are
 			able to reach sensitive resources. The commands provided here allow you to interact with Access protected
 			applications from the command line.`,
 			Subcommands: []*cli.Command{
 				{
-					Name:      "login",
+					Name:   "login",
-					Action:    cliutil.Action(login),
+					Action: cliutil.Action(login),
-					Usage:     "login <url of access application>",
+					Usage:  "login <url of access application>",
 					ArgsUsage: "url of Access application",
 					Description: `The login subcommand initiates an authentication flow with your identity provider.
 					The subcommand will launch a browser. For headless systems, a url is provided.
 					Once authenticated with your identity provider, the login command will generate a JSON Web Token (JWT)
 					scoped to your identity, the application you intend to reach, and valid for a session duration set by your
 					administrator. cloudflared stores the token in local storage.`,
 					Flags: []cli.Flag{
 						&cli.BoolFlag{
 							Name:    loginQuietFlag,
 							Aliases: []string{"q"},
 							Usage:   "do not print the jwt to the command line",
 						},
 						&cli.BoolFlag{
 							Name:  "no-verbose",
 							Usage: "print only the jwt to stdout",
 						},
 						&cli.BoolFlag{
 							Name:  "auto-close",
 							Usage: "automatically close the auth interstitial after action",
 						},
 						&cli.StringFlag{
 							Name: appURLFlag,
 						},
 					},
 				},
 				{
 					Name:   "curl",
@ -130,12 +103,12 @@ func Commands() []*cli.Command {
 				{
 					Name:        "token",
 					Action:      cliutil.Action(generateToken),
-					Usage:       "token <url of access application>",
+					Usage:       "token -app=<url of access application>",
 					ArgsUsage:   "url of Access application",
 					Description: `The token subcommand produces a JWT which can be used to authenticate requests.`,
 					Flags: []cli.Flag{
 						&cli.StringFlag{
-							Name: appURLFlag,
+							Name: "app",
 						},
 					},
 				},
@ -151,18 +124,15 @@ func Commands() []*cli.Command {
 							Name:    sshHostnameFlag,
 							Aliases: []string{"tunnel-host", "T"},
 							Usage:   "specify the hostname of your application.",
 							EnvVars: []string{"TUNNEL_SERVICE_HOSTNAME"},
 						},
 						&cli.StringFlag{
-							Name:    sshDestinationFlag,
+							Name:  sshDestinationFlag,
-							Usage:   "specify the destination address of your SSH server.",
+							Usage: "specify the destination address of your SSH server.",
 							EnvVars: []string{"TUNNEL_SERVICE_DESTINATION"},
 						},
 						&cli.StringFlag{
 							Name:    sshURLFlag,
 							Aliases: []string{"listener", "L"},
 							Usage:   "specify the host:port to forward data to Cloudflare edge.",
 							EnvVars: []string{"TUNNEL_SERVICE_URL"},
 						},
 						&cli.StringSliceFlag{
 							Name:    sshHeaderFlag,
@ -182,15 +152,12 @@ func Commands() []*cli.Command {
 							EnvVars: []string{"TUNNEL_SERVICE_TOKEN_SECRET"},
 						},
 						&cli.StringFlag{
-							Name:  cfdflags.LogFile,
+							Name:    logger.LogSSHDirectoryFlag,
-							Usage: "Save application log to this file for reporting issues.",
+							Aliases: []string{"logfile"}, //added to match the tunnel side
 							Usage:   "Save application log to this directory for reporting issues.",
 						},
 						&cli.StringFlag{
-							Name:  cfdflags.LogDirectory,
+							Name:    logger.LogSSHLevelFlag,
 							Usage: "Save application log to this directory for reporting issues.",
 						},
 						&cli.StringFlag{
 							Name:    cfdflags.LogLevelSSH,
 							Aliases: []string{"loglevel"}, //added to match the tunnel side
 							Usage:   "Application logging level {debug, info, warn, error, fatal}. ",
 						},
@ -199,11 +166,6 @@ func Commands() []*cli.Command {
 							Hidden: true,
 							Usage:  "Connect to alternate location for testing, value is host, host:port, or sni:port:host",
 						},
 						&cli.Uint64Flag{
 							Name:   sshDebugStream,
 							Hidden: true,
 							Usage:  "Writes up-to the max provided stream payloads to the logger as debug statements.",
 						},
 					},
 				},
 				{
@ -241,18 +203,16 @@ func Commands() []*cli.Command {
 // login pops up the browser window to do the actual login and JWT generation
 func login(c *cli.Context) error {
-	err := sentry.Init(sentry.ClientOptions{
+	if err := raven.SetDSN(sentryDSN); err != nil {
 		Dsn:     sentryDSN,
 		Release: c.App.Version,
 	})
 	if err != nil {
 		return err
 	}
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
-	appURL, err := getAppURLFromArgs(c)
+	args := c.Args()
-	if err != nil {
+	rawURL := ensureURLScheme(args.First())
 	appURL, err := url.Parse(rawURL)
 	if args.Len() < 1 || err != nil {
 		log.Error().Msg("Please provide the url of the Access application")
 		return err
 	}
@ -275,29 +235,24 @@ func login(c *cli.Context) error {
 		fmt.Fprintln(os.Stderr, "token for provided application was empty.")
 		return errors.New("empty application token")
 	}
-
+	fmt.Fprintf(os.Stdout, "Successfully fetched your token:\n\n%s\n\n", cfdToken)
 	if c.Bool(loginQuietFlag) {
 		return nil
 	}
 	// Chatty by default for backward compat. The new --app flag
 	// is an implicit opt-out of the backwards-compatible chatty output.
 	if c.Bool("no-verbose") || c.IsSet(appURLFlag) {
 		fmt.Fprint(os.Stdout, cfdToken)
 	} else {
 		fmt.Fprintf(os.Stdout, "Successfully fetched your token:\n\n%s\n\n", cfdToken)
 	}
 	return nil
 }
 // ensureURLScheme prepends a URL with https:// if it doesnt have a scheme. http:// URLs will not be converted.
 func ensureURLScheme(url string) string {
 	url = strings.Replace(strings.ToLower(url), "http://", "https://", 1)
 	if !strings.HasPrefix(url, "https://") {
 		url = fmt.Sprintf("https://%s", url)
 	}
 	return url
 }
 // curl provides a wrapper around curl, passing Access JWT along in request
 func curl(c *cli.Context) error {
-	err := sentry.Init(sentry.ClientOptions{
+	if err := raven.SetDSN(sentryDSN); err != nil {
 		Dsn:     sentryDSN,
 		Release: c.App.Version,
 	})
 	if err != nil {
 		return err
 	}
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
@ -318,20 +273,13 @@ func curl(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
 	// Verify that the existing token is still good; if not fetch a new one
 	if err := verifyTokenAtEdge(appURL, appInfo, c, log); err != nil {
 		log.Err(err).Msg("Could not verify token")
 		return err
 	}
 	tok, err := token.GetAppTokenIfExists(appInfo)
 	if err != nil || tok == "" {
 		if allowRequest {
 			log.Info().Msg("You don't have an Access token set. Please run access token <access application> to fetch one.")
 			return run("curl", cmdArgs...)
 		}
-		tok, err = token.FetchToken(appURL, appInfo, c.Bool(cfdflags.AutoCloseInterstitial), c.Bool(fedrampFlag), log)
+		tok, err = token.FetchToken(appURL, appInfo, log)
 		if err != nil {
 			log.Err(err).Msg("Failed to refresh token")
 			return err
@ -346,13 +294,12 @@ func curl(c *cli.Context) error {
 // run kicks off a shell task and pipe the results to the respective std pipes
 func run(cmd string, args ...string) error {
 	c := exec.Command(cmd, args...)
 	c.Stdin = os.Stdin
 	stderr, err := c.StderrPipe()
 	if err != nil {
 		return err
 	}
 	go func() {
-		_, _ = io.Copy(os.Stderr, stderr)
+		io.Copy(os.Stderr, stderr)
 	}()
 	stdout, err := c.StdoutPipe()
@ -360,33 +307,18 @@ func run(cmd string, args ...string) error {
 		return err
 	}
 	go func() {
-		_, _ = io.Copy(os.Stdout, stdout)
+		io.Copy(os.Stdout, stdout)
 	}()
 	return c.Run()
 }
 func getAppURLFromArgs(c *cli.Context) (*url.URL, error) {
 	var appURLStr string
 	args := c.Args()
 	if args.Len() < 1 {
 		appURLStr = c.String(appURLFlag)
 	} else {
 		appURLStr = args.First()
 	}
 	return parseURL(appURLStr)
 }
 // token dumps provided token to stdout
 func generateToken(c *cli.Context) error {
-	err := sentry.Init(sentry.ClientOptions{
+	if err := raven.SetDSN(sentryDSN); err != nil {
 		Dsn:     sentryDSN,
 		Release: c.App.Version,
 	})
 	if err != nil {
 		return err
 	}
-	appURL, err := getAppURLFromArgs(c)
+	appURL, err := url.Parse(ensureURLScheme(c.String("app")))
-	if err != nil {
+	if err != nil || c.NumFlags() < 1 {
 		fmt.Fprintln(os.Stderr, "Please provide a url.")
 		return err
 	}
@ -438,7 +370,7 @@ func sshGen(c *cli.Context) error {
 		return cli.ShowCommandHelp(c, "ssh-gen")
 	}
-	originURL, err := parseURL(hostname)
+	originURL, err := url.Parse(ensureURLScheme(hostname))
 	if err != nil {
 		return err
 	}
@ -451,7 +383,7 @@ func sshGen(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	cfdToken, err := token.FetchTokenWithRedirect(fetchTokenURL, appInfo, c.Bool(cfdflags.AutoCloseInterstitial), c.Bool(fedrampFlag), log)
+	cfdToken, err := token.FetchTokenWithRedirect(fetchTokenURL, appInfo, log)
 	if err != nil {
 		return err
 	}
@ -517,11 +449,6 @@ func processURL(s string) (*url.URL, error) {
 // cloudflaredPath pulls the full path of cloudflared on disk
 func cloudflaredPath() string {
 	path, err := os.Executable()
 	if err == nil && isFileThere(path) {
 		return path
 	}
 	for _, p := range strings.Split(os.Getenv("PATH"), ":") {
 		path := fmt.Sprintf("%s/%s", p, "cloudflared")
 		if isFileThere(path) {
@ -541,17 +468,17 @@ func isFileThere(candidate string) bool {
 }
 // verifyTokenAtEdge checks for a token on disk, or generates a new one.
-// Then makes a request to the origin with the token to ensure it is valid.
+// Then makes a request to to the origin with the token to ensure it is valid.
 // Returns nil if token is valid.
 func verifyTokenAtEdge(appUrl *url.URL, appInfo *token.AppInfo, c *cli.Context, log *zerolog.Logger) error {
-	headers := parseRequestHeaders(c.StringSlice(sshHeaderFlag))
+	headers := buildRequestHeaders(c.StringSlice(sshHeaderFlag))
 	if c.IsSet(sshTokenIDFlag) {
 		headers.Add(cfAccessClientIDHeader, c.String(sshTokenIDFlag))
 	}
 	if c.IsSet(sshTokenSecretFlag) {
 		headers.Add(cfAccessClientSecretHeader, c.String(sshTokenSecretFlag))
 	}
-	options := &carrier.StartOptions{AppInfo: appInfo, OriginURL: appUrl.String(), Headers: headers, AutoCloseInterstitial: c.Bool(cfdflags.AutoCloseInterstitial), IsFedramp: c.Bool(fedrampFlag)}
+	options := &carrier.StartOptions{AppInfo: appInfo, OriginURL: appUrl.String(), Headers: headers}
 	if valid, err := isTokenValid(options, log); err != nil {
 		return err
@ -578,11 +505,6 @@ func isTokenValid(options *carrier.StartOptions, log *zerolog.Logger) (bool, err
 	if err != nil {
 		return false, errors.Wrap(err, "Could not create access request")
 	}
 	req.Header.Set("User-Agent", userAgent)
 	query := req.URL.Query()
 	query.Set("cloudflared_token_check", "true")
 	req.URL.RawQuery = query.Encode()
 	// Do not follow redirects
 	client := &http.Client{
--- a/cmd/cloudflared/access/cmd_test.go
+++ b/cmd/cloudflared/access/cmd_test.go
@ -0,0 +1,25 @@
 package access
 import "testing"
 func Test_ensureURLScheme(t *testing.T) {
 	type args struct {
 		url string
 	}
 	tests := []struct {
 		name string
 		args args
 		want string
 	}{
 		{"no scheme", args{"localhost:123"}, "https://localhost:123"},
 		{"http scheme", args{"http://test"}, "https://test"},
 		{"https scheme", args{"https://test"}, "https://test"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			if got := ensureURLScheme(tt.args.url); got != tt.want {
 				t.Errorf("ensureURLScheme() = %v, want %v", got, tt.want)
 			}
 		})
 	}
 }
--- a/cmd/cloudflared/access/validation.go
+++ b/cmd/cloudflared/access/validation.go
@ -1,55 +0,0 @@
 package access
 import (
 	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
 	"strings"
 	"golang.org/x/net/http/httpguts"
 )
 // parseRequestHeaders will take user-provided header values as strings "Content-Type: application/json" and create
 // a http.Header object.
 func parseRequestHeaders(values []string) http.Header {
 	headers := make(http.Header)
 	for _, valuePair := range values {
 		header, value, found := strings.Cut(valuePair, ":")
 		if found {
 			headers.Add(strings.TrimSpace(header), strings.TrimSpace(value))
 		}
 	}
 	return headers
 }
 // parseHostname will attempt to convert a user provided URL string into a string with some light error checking on
 // certain expectations from the URL.
 // Will convert all HTTP URLs to HTTPS
 func parseURL(input string) (*url.URL, error) {
 	if input == "" {
 		return nil, errors.New("no input provided")
 	}
 	if !strings.HasPrefix(input, "https://") && !strings.HasPrefix(input, "http://") {
 		input = fmt.Sprintf("https://%s", input)
 	}
 	url, err := url.ParseRequestURI(input)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse as URL: %w", err)
 	}
 	if url.Scheme != "https" {
 		url.Scheme = "https"
 	}
 	if url.Host == "" {
 		return nil, errors.New("failed to parse Host")
 	}
 	host, err := httpguts.PunycodeHostPort(url.Host)
 	if err != nil || host == "" {
 		return nil, err
 	}
 	if !httpguts.ValidHostHeader(host) {
 		return nil, errors.New("invalid Host provided")
 	}
 	url.Host = host
 	return url, nil
 }
--- a/cmd/cloudflared/access/validation_test.go
+++ b/cmd/cloudflared/access/validation_test.go
@ -1,80 +0,0 @@
 package access
 import (
 	"fmt"
 	"testing"
 	"github.com/stretchr/testify/assert"
 )
 func TestParseRequestHeaders(t *testing.T) {
 	values := parseRequestHeaders([]string{"client: value", "secret: safe-value", "trash", "cf-trace-id: 000:000:0:1:asd"})
 	assert.Len(t, values, 3)
 	assert.Equal(t, "value", values.Get("client"))
 	assert.Equal(t, "safe-value", values.Get("secret"))
 	assert.Equal(t, "000:000:0:1:asd", values.Get("cf-trace-id"))
 }
 func TestParseURL(t *testing.T) {
 	schemes := []string{
 		"http://",
 		"https://",
 		"",
 	}
 	hosts := []struct {
 		input    string
 		expected string
 	}{
 		{"localhost", "localhost"},
 		{"127.0.0.1", "127.0.0.1"},
 		{"127.0.0.1:9090", "127.0.0.1:9090"},
 		{"::1", "::1"},
 		{"::1:8080", "::1:8080"},
 		{"[::1]", "[::1]"},
 		{"[::1]:8080", "[::1]:8080"},
 		{":8080", ":8080"},
 		{"example.com", "example.com"},
 		{"hello.example.com", "hello.example.com"},
 		{"bücher.example.com", "xn--bcher-kva.example.com"},
 	}
 	paths := []string{
 		"",
 		"/test",
 		"/example.com?qwe=123",
 	}
 	for i, scheme := range schemes {
 		for j, host := range hosts {
 			for k, path := range paths {
 				t.Run(fmt.Sprintf("%d_%d_%d", i, j, k), func(t *testing.T) {
 					input := fmt.Sprintf("%s%s%s", scheme, host.input, path)
 					expected := fmt.Sprintf("%s%s%s", "https://", host.expected, path)
 					url, err := parseURL(input)
 					assert.NoError(t, err, "input: %s\texpected: %s", input, expected)
 					assert.Equal(t, expected, url.String())
 					assert.Equal(t, host.expected, url.Host)
 					assert.Equal(t, "https", url.Scheme)
 				})
 			}
 		}
 	}
 	t.Run("no input", func(t *testing.T) {
 		_, err := parseURL("")
 		assert.ErrorContains(t, err, "no input provided")
 	})
 	t.Run("missing host", func(t *testing.T) {
 		_, err := parseURL("https:///host")
 		assert.ErrorContains(t, err, "failed to parse Host")
 	})
 	t.Run("invalid path only", func(t *testing.T) {
 		_, err := parseURL("/host")
 		assert.ErrorContains(t, err, "failed to parse Host")
 	})
 	t.Run("invalid parse URL", func(t *testing.T) {
 		_, err := parseURL("https://host\\host")
 		assert.ErrorContains(t, err, "failed to parse as URL")
 	})
 }
--- a/cmd/cloudflared/buildinfo/build_info.go
+++ b/cmd/cloudflared/buildinfo/build_info.go
@ -0,0 +1,33 @@
 package buildinfo
 import (
 	"fmt"
 	"runtime"
 	"github.com/rs/zerolog"
 )
 type BuildInfo struct {
 	GoOS               string `json:"go_os"`
 	GoVersion          string `json:"go_version"`
 	GoArch             string `json:"go_arch"`
 	CloudflaredVersion string `json:"cloudflared_version"`
 }
 func GetBuildInfo(cloudflaredVersion string) *BuildInfo {
 	return &BuildInfo{
 		GoOS:               runtime.GOOS,
 		GoVersion:          runtime.Version(),
 		GoArch:             runtime.GOARCH,
 		CloudflaredVersion: cloudflaredVersion,
 	}
 }
 func (bi *BuildInfo) Log(log *zerolog.Logger) {
 	log.Info().Msgf("Version %s", bi.CloudflaredVersion)
 	log.Info().Msgf("GOOS: %s, GOVersion: %s, GoArch: %s", bi.GoOS, bi.GoVersion, bi.GoArch)
 }
 func (bi *BuildInfo) OSArch() string {
 	return fmt.Sprintf("%s_%s", bi.GoOS, bi.GoArch)
 }
--- a/cmd/cloudflared/cliutil/build_info.go
+++ b/cmd/cloudflared/cliutil/build_info.go
@ -1,83 +0,0 @@
 package cliutil
 import (
 	"crypto/sha256"
 	"fmt"
 	"io"
 	"os"
 	"runtime"
 	"github.com/rs/zerolog"
 )
 type BuildInfo struct {
 	GoOS               string `json:"go_os"`
 	GoVersion          string `json:"go_version"`
 	GoArch             string `json:"go_arch"`
 	BuildType          string `json:"build_type"`
 	CloudflaredVersion string `json:"cloudflared_version"`
 	Checksum           string `json:"checksum"`
 }
 func GetBuildInfo(buildType, version string) *BuildInfo {
 	return &BuildInfo{
 		GoOS:               runtime.GOOS,
 		GoVersion:          runtime.Version(),
 		GoArch:             runtime.GOARCH,
 		BuildType:          buildType,
 		CloudflaredVersion: version,
 		Checksum:           currentBinaryChecksum(),
 	}
 }
 func (bi *BuildInfo) Log(log *zerolog.Logger) {
 	log.Info().Msgf("Version %s (Checksum %s)", bi.CloudflaredVersion, bi.Checksum)
 	if bi.BuildType != "" {
 		log.Info().Msgf("Built%s", bi.GetBuildTypeMsg())
 	}
 	log.Info().Msgf("GOOS: %s, GOVersion: %s, GoArch: %s", bi.GoOS, bi.GoVersion, bi.GoArch)
 }
 func (bi *BuildInfo) OSArch() string {
 	return fmt.Sprintf("%s_%s", bi.GoOS, bi.GoArch)
 }
 func (bi *BuildInfo) Version() string {
 	return bi.CloudflaredVersion
 }
 func (bi *BuildInfo) GetBuildTypeMsg() string {
 	if bi.BuildType == "" {
 		return ""
 	}
 	return fmt.Sprintf(" with %s", bi.BuildType)
 }
 func (bi *BuildInfo) UserAgent() string {
 	return fmt.Sprintf("cloudflared/%s", bi.CloudflaredVersion)
 }
 // FileChecksum opens a file and returns the SHA256 checksum.
 func FileChecksum(filePath string) (string, error) {
 	f, err := os.Open(filePath)
 	if err != nil {
 		return "", err
 	}
 	defer f.Close()
 	h := sha256.New()
 	if _, err := io.Copy(h, f); err != nil {
 		return "", err
 	}
 	return fmt.Sprintf("%x", h.Sum(nil)), nil
 }
 func currentBinaryChecksum() string {
 	currentPath, err := os.Executable()
 	if err != nil {
 		return ""
 	}
 	sum, _ := FileChecksum(currentPath)
 	return sum
 }
--- a/cmd/cloudflared/cliutil/logger.go
+++ b/cmd/cloudflared/cliutil/logger.go
@ -1,59 +0,0 @@
 package cliutil
 import (
 	"github.com/urfave/cli/v2"
 	"github.com/urfave/cli/v2/altsrc"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/flags"
 )
 var (
 	debugLevelWarning = "At debug level cloudflared will log request URL, method, protocol, content length, as well as, all request and response headers. " +
 		"This can expose sensitive information in your logs."
 	FlagLogOutput = &cli.StringFlag{
 		Name:    flags.LogFormatOutput,
 		Usage:   "Output format for the logs (default, json)",
 		Value:   flags.LogFormatOutputValueDefault,
 		EnvVars: []string{"TUNNEL_MANAGEMENT_OUTPUT", "TUNNEL_LOG_OUTPUT"},
 	}
 )
 func ConfigureLoggingFlags(shouldHide bool) []cli.Flag {
 	return []cli.Flag{
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    flags.LogLevel,
 			Value:   "info",
 			Usage:   "Application logging level {debug, info, warn, error, fatal}. " + debugLevelWarning,
 			EnvVars: []string{"TUNNEL_LOGLEVEL"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    flags.TransportLogLevel,
 			Aliases: []string{"proto-loglevel"}, // This flag used to be called proto-loglevel
 			Value:   "info",
 			Usage:   "Transport logging level(previously called protocol logging level) {debug, info, warn, error, fatal}",
 			EnvVars: []string{"TUNNEL_PROTO_LOGLEVEL", "TUNNEL_TRANSPORT_LOGLEVEL"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    flags.LogFile,
 			Usage:   "Save application log to this file for reporting issues.",
 			EnvVars: []string{"TUNNEL_LOGFILE"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    flags.LogDirectory,
 			Usage:   "Save application log to this directory for reporting issues.",
 			EnvVars: []string{"TUNNEL_LOGDIRECTORY"},
 			Hidden:  shouldHide,
 		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    flags.TraceOutput,
 			Usage:   "Name of trace output file, generated when cloudflared stops.",
 			EnvVars: []string{"TUNNEL_TRACE_OUTPUT"},
 			Hidden:  shouldHide,
 		}),
 		FlagLogOutput,
 	}
 }
--- a/cmd/cloudflared/common_service.go
+++ b/cmd/cloudflared/common_service.go
@ -1,30 +0,0 @@
 package main
 import (
 	"github.com/rs/zerolog"
 	"github.com/urfave/cli/v2"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/tunnel"
 )
 func buildArgsForToken(c *cli.Context, log *zerolog.Logger) ([]string, error) {
 	token := c.Args().First()
 	if _, err := tunnel.ParseToken(token); err != nil {
 		return nil, cliutil.UsageError("Provided tunnel token is not valid (%s).", err)
 	}
 	return []string{
 		"tunnel", "run", "--token", token,
 	}, nil
 }
 func getServiceExtraArgsFromCliArgs(c *cli.Context, log *zerolog.Logger) ([]string, error) {
 	if c.NArg() > 0 {
 		// currently, we only support extra args for token
 		return buildArgsForToken(c, log)
 	} else {
 		// empty extra args
 		return make([]string, 0), nil
 	}
 }
--- a/cmd/cloudflared/flags/flags.go
+++ b/cmd/cloudflared/flags/flags.go
@ -1,169 +0,0 @@
 package flags
 const (
 	// HaConnections specifies how many connections to make to the edge
 	HaConnections = "ha-connections"
 	// SshPort is the port on localhost the cloudflared ssh server will run on
 	SshPort = "local-ssh-port"
 	// SshIdleTimeout defines the duration a SSH session can remain idle before being closed
 	SshIdleTimeout = "ssh-idle-timeout"
 	// SshMaxTimeout defines the max duration a SSH session can remain open for
 	SshMaxTimeout = "ssh-max-timeout"
 	// SshLogUploaderBucketName is the bucket name to use for the SSH log uploader
 	SshLogUploaderBucketName = "bucket-name"
 	// SshLogUploaderRegionName is the AWS region name to use for the SSH log uploader
 	SshLogUploaderRegionName = "region-name"
 	// SshLogUploaderSecretID is the Secret id of SSH log uploader
 	SshLogUploaderSecretID = "secret-id"
 	// SshLogUploaderAccessKeyID is the Access key id of SSH log uploader
 	SshLogUploaderAccessKeyID = "access-key-id"
 	// SshLogUploaderSessionTokenID is the Session token of SSH log uploader
 	SshLogUploaderSessionTokenID = "session-token"
 	// SshLogUploaderS3URL is the S3 URL of SSH log uploader (e.g. don't use AWS s3 and use google storage bucket instead)
 	SshLogUploaderS3URL = "s3-url-host"
 	// HostKeyPath is the path of the dir to save SSH host keys too
 	HostKeyPath = "host-key-path"
 	// RpcTimeout is how long to wait for a Capnp RPC request to the edge
 	RpcTimeout = "rpc-timeout"
 	// WriteStreamTimeout sets if we should have a timeout when writing data to a stream towards the destination (edge/origin).
 	WriteStreamTimeout = "write-stream-timeout"
 	// QuicDisablePathMTUDiscovery sets if QUIC should not perform PTMU discovery and use a smaller (safe) packet size.
 	// Packets will then be at most 1252 (IPv4) / 1232 (IPv6) bytes in size.
 	// Note that this may result in packet drops for UDP proxying, since we expect being able to send at least 1280 bytes of inner packets.
 	QuicDisablePathMTUDiscovery = "quic-disable-pmtu-discovery"
 	// QuicConnLevelFlowControlLimit controls the max flow control limit allocated for a QUIC connection. This controls how much data is the
 	// receiver willing to buffer. Once the limit is reached, the sender will send a DATA_BLOCKED frame to indicate it has more data to write,
 	// but it's blocked by flow control
 	QuicConnLevelFlowControlLimit = "quic-connection-level-flow-control-limit"
 	// QuicStreamLevelFlowControlLimit is similar to quicConnLevelFlowControlLimit but for each QUIC stream. When the sender is blocked,
 	// it will send a STREAM_DATA_BLOCKED frame
 	QuicStreamLevelFlowControlLimit = "quic-stream-level-flow-control-limit"
 	// Ui is to enable launching cloudflared in interactive UI mode
 	Ui = "ui"
 	// ConnectorLabel is the command line flag to give a meaningful label to a specific connector
 	ConnectorLabel = "label"
 	// MaxActiveFlows is the command line flag to set the maximum number of flows that cloudflared can be processing at the same time
 	MaxActiveFlows = "max-active-flows"
 	// Tag is the command line flag to set custom tags used to identify this tunnel via added HTTP request headers to the origin
 	Tag = "tag"
 	// Protocol is the command line flag to set the protocol to use to connect to the Cloudflare Edge
 	Protocol = "protocol"
 	// PostQuantum is the command line flag to force the connection to Cloudflare Edge to use Post Quantum cryptography
 	PostQuantum = "post-quantum"
 	// Features is the command line flag to opt into various features that are still being developed or tested
 	Features = "features"
 	// EdgeIpVersion is the command line flag to set the Cloudflare Edge IP address version to connect with
 	EdgeIpVersion = "edge-ip-version"
 	// EdgeBindAddress is the command line flag to bind to IP address for outgoing connections to Cloudflare Edge
 	EdgeBindAddress = "edge-bind-address"
 	// Force is the command line flag to specify if you wish to force an action
 	Force = "force"
 	// Edge is the command line flag to set the address of the Cloudflare tunnel server. Only works in Cloudflare's internal testing environment
 	Edge = "edge"
 	// Region is the command line flag to set the Cloudflare Edge region to connect to
 	Region = "region"
 	// IsAutoUpdated is the command line flag to signal the new process that cloudflared has been autoupdated
 	IsAutoUpdated = "is-autoupdated"
 	// LBPool is the command line flag to set the name of the load balancing pool to add this origin to
 	LBPool = "lb-pool"
 	// Retries is the command line flag to set the maximum number of retries for connection/protocol errors
 	Retries = "retries"
 	// MaxEdgeAddrRetries is the command line flag to set the maximum number of times to retry on edge addrs before falling back to a lower protocol
 	MaxEdgeAddrRetries = "max-edge-addr-retries"
 	// GracePeriod is the command line flag to set the maximum amount of time that cloudflared waits to shut down if it is still serving requests
 	GracePeriod = "grace-period"
 	// ICMPV4Src is the command line flag to set the source address and the interface name to send/receive ICMPv4 messages
 	ICMPV4Src = "icmpv4-src"
 	// ICMPV6Src is the command line flag to set the source address and the interface name to send/receive ICMPv6 messages
 	ICMPV6Src = "icmpv6-src"
 	// ProxyDns is the command line flag to run DNS server over HTTPS
 	ProxyDns = "proxy-dns"
 	// Name is the command line to set the name of the tunnel
 	Name = "name"
 	// AutoUpdateFreq is the command line for setting the frequency that cloudflared checks for updates
 	AutoUpdateFreq = "autoupdate-freq"
 	// NoAutoUpdate is the command line flag to disable cloudflared from checking for updates
 	NoAutoUpdate = "no-autoupdate"
 	// LogLevel is the command line flag for the cloudflared logging level
 	LogLevel = "loglevel"
 	// LogLevelSSH is the command line flag for the cloudflared ssh logging level
 	LogLevelSSH = "log-level"
 	// TransportLogLevel is the command line flag for the transport logging level
 	TransportLogLevel = "transport-loglevel"
 	// LogFile is the command line flag to define the file where application logs will be stored
 	LogFile = "logfile"
 	// LogDirectory is the command line flag to define the directory where application logs will be stored.
 	LogDirectory = "log-directory"
 	// LogFormatOutput allows the command line logs to be output as JSON.
 	LogFormatOutput             = "output"
 	LogFormatOutputValueDefault = "default"
 	LogFormatOutputValueJSON    = "json"
 	// TraceOutput is the command line flag to set the name of trace output file
 	TraceOutput = "trace-output"
 	// OriginCert is the command line flag to define the path for the origin certificate used by cloudflared
 	OriginCert = "origincert"
 	// Metrics is the command line flag to define the address of the metrics server
 	Metrics = "metrics"
 	// MetricsUpdateFreq is the command line flag to define how frequently tunnel metrics are updated
 	MetricsUpdateFreq = "metrics-update-freq"
 	// ApiURL is the command line flag used to define the base URL of the API
 	ApiURL = "api-url"
 	// Virtual DNS resolver service resolver addresses to use instead of dynamically fetching them from the OS.
 	VirtualDNSServiceResolverAddresses = "dns-resolver-addrs"
 	// Management hostname to signify incoming management requests
 	ManagementHostname = "management-hostname"
 	// Automatically close the login interstitial browser window after the user makes a decision.
 	AutoCloseInterstitial = "auto-close"
 )
--- a/cmd/cloudflared/generic_service.go
+++ b/cmd/cloudflared/generic_service.go
@ -1,40 +1,13 @@
-//go:build !windows && !darwin && !linux
+// +build !windows,!darwin,!linux
 package main
 import (
 	"fmt"
 	"os"
 	cli "github.com/urfave/cli/v2"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 )
 func runApp(app *cli.App, graceShutdownC chan struct{}) {
 	app.Commands = append(app.Commands, &cli.Command{
 		Name:  "service",
 		Usage: "Manages the cloudflared system service (not supported on this operating system)",
 		Subcommands: []*cli.Command{
 			{
 				Name:   "install",
 				Usage:  "Install cloudflared as a system service (not supported on this operating system)",
 				Action: cliutil.ConfiguredAction(installGenericService),
 			},
 			{
 				Name:   "uninstall",
 				Usage:  "Uninstall the cloudflared service (not supported on this operating system)",
 				Action: cliutil.ConfiguredAction(uninstallGenericService),
 			},
 		},
 	})
 	app.Run(os.Args)
 }
 func installGenericService(c *cli.Context) error {
 	return fmt.Errorf("service installation is not supported on this operating system")
 }
 func uninstallGenericService(c *cli.Context) error {
 	return fmt.Errorf("service uninstallation is not supported on this operating system")
 }
--- a/cmd/cloudflared/linux_service.go
+++ b/cmd/cloudflared/linux_service.go
@ -1,11 +1,11 @@
-//go:build linux
+// +build linux
 package main
 import (
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"github.com/rs/zerolog"
 	"github.com/urfave/cli/v2"
@ -16,53 +16,52 @@ import (
 	"github.com/cloudflare/cloudflared/logger"
 )
-func runApp(app *cli.App, _ chan struct{}) {
+func runApp(app *cli.App, graceShutdownC chan struct{}) {
 	app.Commands = append(app.Commands, &cli.Command{
 		Name:  "service",
-		Usage: "Manages the cloudflared system service",
+		Usage: "Manages the Cloudflare Tunnel system service",
 		Subcommands: []*cli.Command{
 			{
 				Name:   "install",
-				Usage:  "Install cloudflared as a system service",
+				Usage:  "Install Cloudflare Tunnel as a system service",
 				Action: cliutil.ConfiguredAction(installLinuxService),
 				Flags: []cli.Flag{
-					noUpdateServiceFlag,
+					&cli.BoolFlag{
 						Name:  "legacy",
 						Usage: "Generate service file for non-named tunnels",
 					},
 				},
 			},
 			{
 				Name:   "uninstall",
-				Usage:  "Uninstall the cloudflared service",
+				Usage:  "Uninstall the Cloudflare Tunnel service",
 				Action: cliutil.ConfiguredAction(uninstallLinuxService),
 			},
 		},
 	})
-	_ = app.Run(os.Args)
+	app.Run(os.Args)
 }
 // The directory and files that are used by the service.
 // These are hard-coded in the templates below.
 const (
-	serviceConfigDir         = "/etc/cloudflared"
+	serviceConfigDir      = "/etc/cloudflared"
-	serviceConfigFile        = "config.yml"
+	serviceConfigFile     = "config.yml"
-	serviceCredentialFile    = "cert.pem"
+	serviceCredentialFile = "cert.pem"
-	serviceConfigPath        = serviceConfigDir + "/" + serviceConfigFile
+	serviceConfigPath     = serviceConfigDir + "/" + serviceConfigFile
 	cloudflaredService       = "cloudflared.service"
 	cloudflaredUpdateService = "cloudflared-update.service"
 	cloudflaredUpdateTimer   = "cloudflared-update.timer"
 )
-var systemdAllTemplates = map[string]ServiceTemplate{
+var systemdTemplates = []ServiceTemplate{
-	cloudflaredService: {
+	{
-		Path: fmt.Sprintf("/etc/systemd/system/%s", cloudflaredService),
+		Path: "/etc/systemd/system/cloudflared.service",
 		Content: `[Unit]
-Description=cloudflared
+Description=Cloudflare Tunnel
-After=network-online.target
+After=network.target
 Wants=network-online.target
 [Service]
-TimeoutStartSec=15
+TimeoutStartSec=0
 Type=notify
-ExecStart={{ .Path }} --no-autoupdate{{ range .ExtraArgs }} {{ . }}{{ end }}
+ExecStart={{ .Path }} --config /etc/cloudflared/config.yml --no-autoupdate{{ range .ExtraArgs }} {{ . }}{{ end }}
 Restart=on-failure
 RestartSec=5s
@ -70,21 +69,20 @@ RestartSec=5s
 WantedBy=multi-user.target
 `,
 	},
-	cloudflaredUpdateService: {
+	{
-		Path: fmt.Sprintf("/etc/systemd/system/%s", cloudflaredUpdateService),
+		Path: "/etc/systemd/system/cloudflared-update.service",
 		Content: `[Unit]
-Description=Update cloudflared
+Description=Update Cloudflare Tunnel
-After=network-online.target
+After=network.target
 Wants=network-online.target
 [Service]
 ExecStart=/bin/bash -c '{{ .Path }} update; code=$?; if [ $code -eq 11 ]; then systemctl restart cloudflared; exit 0; fi; exit $code'
 `,
 	},
-	cloudflaredUpdateTimer: {
+	{
-		Path: fmt.Sprintf("/etc/systemd/system/%s", cloudflaredUpdateTimer),
+		Path: "/etc/systemd/system/cloudflared-update.timer",
 		Content: `[Unit]
-Description=Update cloudflared
+Description=Update Cloudflare Tunnel
 [Timer]
 OnCalendar=daily
@ -98,11 +96,10 @@ WantedBy=timers.target
 var sysvTemplate = ServiceTemplate{
 	Path:     "/etc/init.d/cloudflared",
 	FileMode: 0755,
 	// nolint: dupword
 	Content: `#!/bin/sh
 # For RedHat and cousins:
 # chkconfig: 2345 99 01
-# description: cloudflared
+# description: Cloudflare Tunnel agent
 # processname: {{.Path}}
 ### BEGIN INIT INFO
 # Provides:          {{.Path}}
@ -110,11 +107,11 @@ var sysvTemplate = ServiceTemplate{
 # Required-Stop:
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
-# Short-Description: cloudflared
+# Short-Description: Cloudflare Tunnel
-# Description:       cloudflared agent
+# Description:       Cloudflare Tunnel agent
 ### END INIT INFO
 name=$(basename $(readlink -f $0))
-cmd="{{.Path}} --pidfile /var/run/$name.pid {{ range .ExtraArgs }} {{ . }}{{ end }}"
+cmd="{{.Path}} --config /etc/cloudflared/config.yml --pidfile /var/run/$name.pid --autoupdate-freq 24h0m0s{{ range .ExtraArgs }} {{ . }}{{ end }}"
 pid_file="/var/run/$name.pid"
 stdout_log="/var/log/$name.log"
 stderr_log="/var/log/$name.err"
@ -186,12 +183,6 @@ exit 0
 `,
 }
 var noUpdateServiceFlag = &cli.BoolFlag{
 	Name:  "no-update-service",
 	Usage: "Disable auto-update of the cloudflared linux service, which restarts the server to upgrade for new versions.",
 	Value: false,
 }
 func isSystemd() bool {
 	if _, err := os.Stat("/run/systemd/system"); err == nil {
 		return true
@ -199,6 +190,27 @@ func isSystemd() bool {
 	return false
 }
 func copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile string, log *zerolog.Logger) error {
 	srcCredentialPath := filepath.Join(userConfigDir, userCredentialFile)
 	destCredentialPath := filepath.Join(serviceConfigDir, serviceCredentialFile)
 	if srcCredentialPath != destCredentialPath {
 		if err := copyCredential(srcCredentialPath, destCredentialPath); err != nil {
 			return err
 		}
 	}
 	srcConfigPath := filepath.Join(userConfigDir, userConfigFile)
 	destConfigPath := filepath.Join(serviceConfigDir, serviceConfigFile)
 	if srcConfigPath != destConfigPath {
 		if err := copyConfig(srcConfigPath, destConfigPath); err != nil {
 			return err
 		}
 		log.Info().Msgf("Copied %s to %s", srcConfigPath, destConfigPath)
 	}
 	return nil
 }
 func installLinuxService(c *cli.Context) error {
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
@ -210,88 +222,64 @@ func installLinuxService(c *cli.Context) error {
 		Path: etPath,
 	}
-	// Check if the "no update flag" is set
+	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
 	autoUpdate := !c.IsSet(noUpdateServiceFlag.Name)
 	var extraArgsFunc func(c *cli.Context, log *zerolog.Logger) ([]string, error)
 	if c.NArg() == 0 {
 		extraArgsFunc = buildArgsForConfig
 	} else {
 		extraArgsFunc = buildArgsForToken
 	}
 	extraArgs, err := extraArgsFunc(c, log)
 	if err != nil {
 		return err
 	}
 	if c.Bool("legacy") {
 		userConfigDir := filepath.Dir(c.String("config"))
 		userConfigFile := filepath.Base(c.String("config"))
 		userCredentialFile := config.DefaultCredentialFile
 		if err = copyUserConfiguration(userConfigDir, userConfigFile, userCredentialFile, log); err != nil {
 			log.Err(err).Msgf("Failed to copy user configuration. Before running the service, ensure that %s contains two files, %s and %s",
 				serviceConfigDir, serviceCredentialFile, serviceConfigFile)
 			return err
 		}
 		templateArgs.ExtraArgs = []string{
 			"--origincert", serviceConfigDir + "/" + serviceCredentialFile,
 		}
 	} else {
 		src, _, err := config.ReadConfigFile(c, log)
 		if err != nil {
 			return err
 		}
-	templateArgs.ExtraArgs = extraArgs
+		// can't use context because this command doesn't define "credentials-file" flag
 		configPresent := func(s string) bool {
 			val, err := src.String(s)
 			return err == nil && val != ""
 		}
 		if src.TunnelID == "" || !configPresent(tunnel.CredFileFlag) {
 			return fmt.Errorf(`Configuration file %s must contain entries for the tunnel to run and its associated credentials:
 tunnel: TUNNEL-UUID
 credentials-file: CREDENTIALS-FILE
 `, src.Source())
 		}
 		if src.Source() != serviceConfigPath {
 			if exists, err := config.FileExists(serviceConfigPath); err != nil || exists {
 				return fmt.Errorf("Possible conflicting configuration in %[1]s and %[2]s. Either remove %[2]s or run `cloudflared --config %[2]s service install`", src.Source(), serviceConfigPath)
 			}
 			if err := copyFile(src.Source(), serviceConfigPath); err != nil {
 				return fmt.Errorf("failed to copy %s to %s: %w", src.Source(), serviceConfigPath, err)
 			}
 		}
 		templateArgs.ExtraArgs = []string{
 			"tunnel", "run",
 		}
 	}
 	switch {
 	case isSystemd():
 		log.Info().Msgf("Using Systemd")
-		err = installSystemd(&templateArgs, autoUpdate, log)
+		return installSystemd(&templateArgs, log)
 	default:
 		log.Info().Msgf("Using SysV")
-		err = installSysv(&templateArgs, autoUpdate, log)
+		return installSysv(&templateArgs, log)
 	}
 	if err == nil {
 		log.Info().Msg("Linux service for cloudflared installed successfully")
 	}
 	return err
 }
-func buildArgsForConfig(c *cli.Context, log *zerolog.Logger) ([]string, error) {
+func installSystemd(templateArgs *ServiceTemplateArgs, log *zerolog.Logger) error {
 	if err := ensureConfigDirExists(serviceConfigDir); err != nil {
 		return nil, err
 	}
 	src, _, err := config.ReadConfigFile(c, log)
 	if err != nil {
 		return nil, err
 	}
 	// can't use context because this command doesn't define "credentials-file" flag
 	configPresent := func(s string) bool {
 		val, err := src.String(s)
 		return err == nil && val != ""
 	}
 	if src.TunnelID == "" || !configPresent(tunnel.CredFileFlag) {
 		return nil, fmt.Errorf(`Configuration file %s must contain entries for the tunnel to run and its associated credentials:
 tunnel: TUNNEL-UUID
 credentials-file: CREDENTIALS-FILE
 `, src.Source())
 	}
 	if src.Source() != serviceConfigPath {
 		if exists, err := config.FileExists(serviceConfigPath); err != nil || exists {
 			return nil, fmt.Errorf("Possible conflicting configuration in %[1]s and %[2]s. Either remove %[2]s or run `cloudflared --config %[2]s service install`", src.Source(), serviceConfigPath)
 		}
 		if err := copyFile(src.Source(), serviceConfigPath); err != nil {
 			return nil, fmt.Errorf("failed to copy %s to %s: %w", src.Source(), serviceConfigPath, err)
 		}
 	}
 	return []string{
 		"--config", "/etc/cloudflared/config.yml", "tunnel", "run",
 	}, nil
 }
 func installSystemd(templateArgs *ServiceTemplateArgs, autoUpdate bool, log *zerolog.Logger) error {
 	var systemdTemplates []ServiceTemplate
 	if autoUpdate {
 		systemdTemplates = []ServiceTemplate{
 			systemdAllTemplates[cloudflaredService],
 			systemdAllTemplates[cloudflaredUpdateService],
 			systemdAllTemplates[cloudflaredUpdateTimer],
 		}
 	} else {
 		systemdTemplates = []ServiceTemplate{
 			systemdAllTemplates[cloudflaredService],
 		}
 	}
 	for _, serviceTemplate := range systemdTemplates {
 		err := serviceTemplate.Generate(templateArgs)
 		if err != nil {
@ -299,38 +287,24 @@ func installSystemd(templateArgs *ServiceTemplateArgs, autoUpdate bool, log *zer
 			return err
 		}
 	}
-	if err := runCommand("systemctl", "enable", cloudflaredService); err != nil {
+	if err := runCommand("systemctl", "enable", "cloudflared.service"); err != nil {
-		log.Err(err).Msgf("systemctl enable %s error", cloudflaredService)
+		log.Err(err).Msg("systemctl enable cloudflared.service error")
 		return err
 	}
-
+	if err := runCommand("systemctl", "start", "cloudflared-update.timer"); err != nil {
-	if autoUpdate {
+		log.Err(err).Msg("systemctl start cloudflared-update.timer error")
 		if err := runCommand("systemctl", "start", cloudflaredUpdateTimer); err != nil {
 			log.Err(err).Msgf("systemctl start %s error", cloudflaredUpdateTimer)
 			return err
 		}
 	}
 	if err := runCommand("systemctl", "daemon-reload"); err != nil {
 		log.Err(err).Msg("systemctl daemon-reload error")
 		return err
 	}
-	return runCommand("systemctl", "start", cloudflaredService)
+	log.Info().Msg("systemctl daemon-reload")
 	return runCommand("systemctl", "daemon-reload")
 }
-func installSysv(templateArgs *ServiceTemplateArgs, autoUpdate bool, log *zerolog.Logger) error {
+func installSysv(templateArgs *ServiceTemplateArgs, log *zerolog.Logger) error {
 	confPath, err := sysvTemplate.ResolvePath()
 	if err != nil {
 		log.Err(err).Msg("error resolving system path")
 		return err
 	}
 	if autoUpdate {
 		templateArgs.ExtraArgs = append([]string{"--autoupdate-freq 24h0m0s"}, templateArgs.ExtraArgs...)
 	} else {
 		templateArgs.ExtraArgs = append([]string{"--no-autoupdate"}, templateArgs.ExtraArgs...)
 	}
 	if err := sysvTemplate.Generate(templateArgs); err != nil {
 		log.Err(err).Msg("error generating system template")
 		return err
@ -345,75 +319,42 @@ func installSysv(templateArgs *ServiceTemplateArgs, autoUpdate bool, log *zerolo
 			continue
 		}
 	}
-	return runCommand("service", "cloudflared", "start")
+	return nil
 }
 func uninstallLinuxService(c *cli.Context) error {
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
 	var err error
 	switch {
 	case isSystemd():
 		log.Info().Msg("Using Systemd")
-		err = uninstallSystemd(log)
+		return uninstallSystemd(log)
 	default:
 		log.Info().Msg("Using SysV")
-		err = uninstallSysv(log)
+		return uninstallSysv(log)
 	}
 	if err == nil {
 		log.Info().Msg("Linux service for cloudflared uninstalled successfully")
 	}
 	return err
 }
 func uninstallSystemd(log *zerolog.Logger) error {
-	// Get only the installed services
+	if err := runCommand("systemctl", "disable", "cloudflared.service"); err != nil {
-	installedServices := make(map[string]ServiceTemplate)
+		log.Err(err).Msg("systemctl disable cloudflared.service error")
-	for serviceName, serviceTemplate := range systemdAllTemplates {
+		return err
 		if err := runCommand("systemctl", "list-units", "--all", "|", "grep", serviceName); err == nil {
 			installedServices[serviceName] = serviceTemplate
 		} else {
 			log.Info().Msgf("Service '%s' not installed, skipping its uninstall", serviceName)
 		}
 	}
-
+	if err := runCommand("systemctl", "stop", "cloudflared-update.timer"); err != nil {
-	if _, exists := installedServices[cloudflaredService]; exists {
+		log.Err(err).Msg("systemctl stop cloudflared-update.timer error")
-		if err := runCommand("systemctl", "disable", cloudflaredService); err != nil {
+		return err
 			log.Err(err).Msgf("systemctl disable %s error", cloudflaredService)
 			return err
 		}
 		if err := runCommand("systemctl", "stop", cloudflaredService); err != nil {
 			log.Err(err).Msgf("systemctl stop %s error", cloudflaredService)
 			return err
 		}
 	}
-
+	for _, serviceTemplate := range systemdTemplates {
 	if _, exists := installedServices[cloudflaredUpdateTimer]; exists {
 		if err := runCommand("systemctl", "stop", cloudflaredUpdateTimer); err != nil {
 			log.Err(err).Msgf("systemctl stop %s error", cloudflaredUpdateTimer)
 			return err
 		}
 	}
 	for _, serviceTemplate := range installedServices {
 		if err := serviceTemplate.Remove(); err != nil {
 			log.Err(err).Msg("error removing service template")
 			return err
 		}
 	}
-	if err := runCommand("systemctl", "daemon-reload"); err != nil {
+	log.Info().Msgf("Successfully uninstalled cloudflared service from systemd")
 		log.Err(err).Msg("systemctl daemon-reload error")
 		return err
 	}
 	return nil
 }
 func uninstallSysv(log *zerolog.Logger) error {
 	if err := runCommand("service", "cloudflared", "stop"); err != nil {
 		log.Err(err).Msg("service cloudflared stop error")
 		return err
 	}
 	if err := sysvTemplate.Remove(); err != nil {
 		log.Err(err).Msg("error removing service template")
 		return err
@ -428,40 +369,6 @@ func uninstallSysv(log *zerolog.Logger) error {
 			continue
 		}
 	}
-	return nil
+	log.Info().Msgf("Successfully uninstalled cloudflared service from sysv")
 }
 func ensureConfigDirExists(configDir string) error {
 	ok, err := config.FileExists(configDir)
 	if !ok && err == nil {
 		err = os.Mkdir(configDir, 0755)
 	}
 	return err
 }
 func copyFile(src, dest string) error {
 	srcFile, err := os.Open(src)
 	if err != nil {
 		return err
 	}
 	defer srcFile.Close()
 	destFile, err := os.Create(dest)
 	if err != nil {
 		return err
 	}
 	ok := false
 	defer func() {
 		destFile.Close()
 		if !ok {
 			_ = os.Remove(dest)
 		}
 	}()
 	if _, err := io.Copy(destFile, srcFile); err != nil {
 		return err
 	}
 	ok = true
 	return nil
 }
--- a/cmd/cloudflared/macos_service.go
+++ b/cmd/cloudflared/macos_service.go
@ -1,4 +1,4 @@
-//go:build darwin
+// +build darwin
 package main
@ -6,7 +6,6 @@ import (
 	"fmt"
 	"os"
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
@ -18,19 +17,19 @@ const (
 	launchdIdentifier = "com.cloudflare.cloudflared"
 )
-func runApp(app *cli.App, _ chan struct{}) {
+func runApp(app *cli.App, graceShutdownC chan struct{}) {
 	app.Commands = append(app.Commands, &cli.Command{
 		Name:  "service",
-		Usage: "Manages the cloudflared launch agent",
+		Usage: "Manages the Cloudflare Tunnel launch agent",
 		Subcommands: []*cli.Command{
 			{
 				Name:   "install",
-				Usage:  "Install cloudflared as an user launch agent",
+				Usage:  "Install Cloudflare Tunnel as an user launch agent",
 				Action: cliutil.ConfiguredAction(installLaunchd),
 			},
 			{
 				Name:   "uninstall",
-				Usage:  "Uninstall the cloudflared launch agent",
+				Usage:  "Uninstall the Cloudflare Tunnel launch agent",
 				Action: cliutil.ConfiguredAction(uninstallLaunchd),
 			},
 		},
@ -50,9 +49,6 @@ func newLaunchdTemplate(installPath, stdoutPath, stderrPath string) *ServiceTemp
 		<key>ProgramArguments</key>
 		<array>
 			<string>{{ .Path }}</string>
 			{{- range $i, $item := .ExtraArgs}}
 			<string>{{ $item }}</string>
 			{{- end}}
 		</array>
 		<key>RunAtLoad</key>
 		<true/>
@ -114,13 +110,13 @@ func installLaunchd(c *cli.Context) error {
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
 	if isRootUser() {
-		log.Info().Msg("Installing cloudflared client as a system launch daemon. " +
+		log.Info().Msg("Installing Cloudflare Tunnel client as a system launch daemon. " +
-			"cloudflared client will run at boot")
+			"Cloudflare Tunnel client will run at boot")
 	} else {
-		log.Info().Msg("Installing cloudflared client as an user launch agent. " +
+		log.Info().Msg("Installing Cloudflare Tunnel client as an user launch agent. " +
-			"Note that cloudflared client will only run when the user is logged in. " +
+			"Note that Cloudflare Tunnel client will only run when the user is logged in. " +
-			"If you want to run cloudflared client at boot, install with root permission. " +
+			"If you want to run Cloudflare Tunnel client at boot, install with root permission. " +
-			"For more information, visit https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/local-management/as-a-service/macos/")
+			"For more information, visit https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/run-as-service")
 	}
 	etPath, err := os.Executable()
 	if err != nil {
@ -132,13 +128,6 @@ func installLaunchd(c *cli.Context) error {
 		log.Err(err).Msg("Error determining install path")
 		return errors.Wrap(err, "Error determining install path")
 	}
 	extraArgs, err := getServiceExtraArgsFromCliArgs(c, log)
 	if err != nil {
 		errMsg := "Unable to determine extra arguments for launch daemon"
 		log.Err(err).Msg(errMsg)
 		return errors.Wrap(err, errMsg)
 	}
 	stdoutPath, err := stdoutPath()
 	if err != nil {
 		log.Err(err).Msg("error determining stdout path")
@ -150,7 +139,7 @@ func installLaunchd(c *cli.Context) error {
 		return errors.Wrap(err, "error determining stderr path")
 	}
 	launchdTemplate := newLaunchdTemplate(installPath, stdoutPath, stderrPath)
-	templateArgs := ServiceTemplateArgs{Path: etPath, ExtraArgs: extraArgs}
+	templateArgs := ServiceTemplateArgs{Path: etPath}
 	err = launchdTemplate.Generate(&templateArgs)
 	if err != nil {
 		log.Err(err).Msg("error generating launchd template")
@ -163,20 +152,16 @@ func installLaunchd(c *cli.Context) error {
 	}
 	log.Info().Msgf("Outputs are logged to %s and %s", stderrPath, stdoutPath)
-	err = runCommand("launchctl", "load", plistPath)
+	return runCommand("launchctl", "load", plistPath)
 	if err == nil {
 		log.Info().Msg("MacOS service for cloudflared installed successfully")
 	}
 	return err
 }
 func uninstallLaunchd(c *cli.Context) error {
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
 	if isRootUser() {
-		log.Info().Msg("Uninstalling cloudflared as a system launch daemon")
+		log.Info().Msg("Uninstalling Cloudflare Tunnel as a system launch daemon")
 	} else {
-		log.Info().Msg("Uninstalling cloudflared as a user launch agent")
+		log.Info().Msg("Uninstalling Cloudflare Tunnel as an user launch agent")
 	}
 	installPath, err := installPath()
 	if err != nil {
@ -198,25 +183,10 @@ func uninstallLaunchd(c *cli.Context) error {
 	}
 	err = runCommand("launchctl", "unload", plistPath)
 	if err != nil {
-		log.Err(err).Msg("error unloading launchd")
+		log.Err(err).Msg("error unloading")
 		return err
 	}
-	err = launchdTemplate.Remove()
+	log.Info().Msgf("Outputs are logged to %s and %s", stderrPath, stdoutPath)
-	if err == nil {
+	return launchdTemplate.Remove()
 		log.Info().Msg("Launchd for cloudflared was uninstalled successfully")
 	}
 	return err
 }
 func userHomeDir() (string, error) {
 	// This returns the home dir of the executing user using OS-specific method
 	// for discovering the home dir. It's not recommended to call this function
 	// when the user has root permission as $HOME depends on what options the user
 	// use with sudo.
 	homeDir, err := homedir.Dir()
 	if err != nil {
 		return "", errors.Wrap(err, "Cannot determine home directory for the user")
 	}
 	return homeDir, nil
 }
--- a/cmd/cloudflared/main.go
+++ b/cmd/cloudflared/main.go
@ -2,27 +2,25 @@ package main
 import (
 	"fmt"
-	"os"
+	"math/rand"
 	"strings"
 	"time"
-	"github.com/getsentry/sentry-go"
+	"github.com/getsentry/raven-go"
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	"github.com/urfave/cli/v2"
 	"go.uber.org/automaxprocs/maxprocs"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/access"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	cfdflags "github.com/cloudflare/cloudflared/cmd/cloudflared/flags"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/proxydns"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/tail"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/tunnel"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/overwatch"
 	"github.com/cloudflare/cloudflared/token"
 	"github.com/cloudflare/cloudflared/tracing"
 	"github.com/cloudflare/cloudflared/watcher"
 )
@ -33,7 +31,6 @@ const (
 var (
 	Version   = "DEV"
 	BuildTime = "unknown"
 	BuildType = ""
 	// Mostly network errors that we don't want reported back to Sentry, this is done by substring match.
 	ignoredErrors = []string{
 		"connection reset by peer",
@ -48,11 +45,10 @@ var (
 )
 func main() {
-	// FIXME: TUN-8148: Disable QUIC_GO ECN due to bugs in proper detection if supported
+	rand.Seed(time.Now().UnixNano())
-	os.Setenv("QUIC_GO_DISABLE_ECN", "1")
+	metrics.RegisterBuildInfo(BuildTime, Version)
-	metrics.RegisterBuildInfo(BuildType, BuildTime, Version)
+	raven.SetRelease(Version)
-	_, _ = maxprocs.Set()
+	maxprocs.Set()
 	bInfo := cliutil.GetBuildInfo(BuildType, Version)
 	// Graceful shutdown channel used by the app. When closed, app must terminate gracefully.
 	// Windows service manager closes this channel when it receives stop command.
@ -71,11 +67,11 @@ func main() {
 	app.Copyright = fmt.Sprintf(
 		`(c) %d Cloudflare Inc.
   Your installation of cloudflared software constitutes a symbol of your signature indicating that you accept
-   the terms of the Apache License Version 2.0 (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/license),
+   the terms of the Cloudflare License (https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/license),
   Terms (https://www.cloudflare.com/terms/) and Privacy Policy (https://www.cloudflare.com/privacypolicy/).`,
 		time.Now().Year(),
 	)
-	app.Version = fmt.Sprintf("%s (built %s%s)", Version, BuildTime, bInfo.GetBuildTypeMsg())
+	app.Version = fmt.Sprintf("%s (built %s)", Version, BuildTime)
 	app.Description = `cloudflared connects your machine or user identity to Cloudflare's global network.
 	You can use it to authenticate a session to reach an API behind Access, route web traffic to this machine,
 	and configure access control.
@ -85,12 +81,9 @@ func main() {
 	app.Action = action(graceShutdownC)
 	app.Commands = commands(cli.ShowVersion)
-	tunnel.Init(bInfo, graceShutdownC) // we need this to support the tunnel sub command...
+	tunnel.Init(Version, graceShutdownC) // we need this to support the tunnel sub command...
-	access.Init(graceShutdownC, Version)
+	access.Init(graceShutdownC)
-	updater.Init(bInfo)
+	updater.Init(Version)
 	tracing.Init(Version)
 	token.Init(Version)
 	tail.Init(bInfo)
 	runApp(app, graceShutdownC)
 }
@ -106,7 +99,7 @@ func commands(version func(c *cli.Context)) []*cli.Command {
 					Usage: "specify if you wish to update to the latest beta version",
 				},
 				&cli.BoolFlag{
-					Name:   cfdflags.Force,
+					Name:   "force",
 					Usage:  "specify if you wish to force an upgrade to the latest version regardless of the current version",
 					Hidden: true,
 				},
@ -130,28 +123,16 @@ To determine if an update happened in a script, check for error code 11.`,
 		{
 			Name: "version",
 			Action: func(c *cli.Context) (err error) {
 				if c.Bool("short") {
 					fmt.Println(strings.Split(c.App.Version, " ")[0])
 					return nil
 				}
 				version(c)
 				return nil
 			},
 			Usage:       versionText,
 			Description: versionText,
 			Flags: []cli.Flag{
 				&cli.BoolFlag{
 					Name:    "short",
 					Aliases: []string{"s"},
 					Usage:   "print just the version number",
 				},
 			},
 		},
 	}
 	cmds = append(cmds, tunnel.Commands()...)
 	cmds = append(cmds, proxydns.Command(false))
 	cmds = append(cmds, access.Commands()...)
 	cmds = append(cmds, tail.Command())
 	return cmds
 }
@ -169,10 +150,10 @@ func action(graceShutdownC chan struct{}) cli.ActionFunc {
 		if isEmptyInvocation(c) {
 			return handleServiceMode(c, graceShutdownC)
 		}
-		func() {
+		tags := make(map[string]string)
-			defer sentry.Recover()
+		tags["hostname"] = c.String("hostname")
-			err = tunnel.TunnelCommand(c)
+		raven.SetTagsContext(tags)
-		}()
+		raven.CapturePanic(func() { err = tunnel.TunnelCommand(c) }, nil)
 		if err != nil {
 			captureError(err)
 		}
@ -180,6 +161,18 @@ func action(graceShutdownC chan struct{}) cli.ActionFunc {
 	})
 }
 func userHomeDir() (string, error) {
 	// This returns the home dir of the executing user using OS-specific method
 	// for discovering the home dir. It's not recommended to call this function
 	// when the user has root permission as $HOME depends on what options the user
 	// use with sudo.
 	homeDir, err := homedir.Dir()
 	if err != nil {
 		return "", errors.Wrap(err, "Cannot determine home directory for the user")
 	}
 	return homeDir, nil
 }
 // In order to keep the amount of noise sent to Sentry low, typical network errors can be filtered out here by a substring match.
 func captureError(err error) {
 	errorMessage := err.Error()
@ -188,7 +181,7 @@ func captureError(err error) {
 			return
 		}
 	}
-	sentry.CaptureException(err)
+	raven.CaptureError(err, nil)
 }
 // cloudflared was started without any flags
--- a/cmd/cloudflared/proxydns/cmd.go
+++ b/cmd/cloudflared/proxydns/cmd.go
@ -1,7 +1,6 @@
 package proxydns
 import (
 	"context"
 	"net"
 	"os"
 	"os/signal"
@ -74,7 +73,7 @@ func Run(c *cli.Context) error {
 		log.Fatal().Err(err).Msg("Failed to open the metrics listener")
 	}
-	go metrics.ServeMetrics(metricsListener, context.Background(), metrics.Config{}, log)
+	go metrics.ServeMetrics(metricsListener, nil, nil, "", log)
 	listener, err := tunneldns.CreateListener(
 		c.String("address"),
--- a/cmd/cloudflared/service_template.go
+++ b/cmd/cloudflared/service_template.go
@ -1,16 +1,18 @@
 package main
 import (
 	"bufio"
 	"bytes"
 	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"text/template"
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/cloudflare/cloudflared/config"
 )
 type ServiceTemplate struct {
@ -41,27 +43,16 @@ func (st *ServiceTemplate) Generate(args *ServiceTemplateArgs) error {
 	if err != nil {
 		return err
 	}
 	if _, err = os.Stat(resolvedPath); err == nil {
 		return errors.New(serviceAlreadyExistsWarn(resolvedPath))
 	}
 	var buffer bytes.Buffer
 	err = tmpl.Execute(&buffer, args)
 	if err != nil {
 		return fmt.Errorf("error generating %s: %v", st.Path, err)
 	}
-	fileMode := os.FileMode(0o644)
+	fileMode := os.FileMode(0644)
 	if st.FileMode != 0 {
 		fileMode = st.FileMode
 	}
-
+	err = ioutil.WriteFile(resolvedPath, buffer.Bytes(), fileMode)
 	plistFolder := filepath.Dir(resolvedPath)
 	err = os.MkdirAll(plistFolder, 0o755)
 	if err != nil {
 		return fmt.Errorf("error creating %s: %v", plistFolder, err)
 	}
 	err = os.WriteFile(resolvedPath, buffer.Bytes(), fileMode)
 	if err != nil {
 		return fmt.Errorf("error writing %s: %v", resolvedPath, err)
 	}
@ -80,15 +71,6 @@ func (st *ServiceTemplate) Remove() error {
 	return nil
 }
 func serviceAlreadyExistsWarn(service string) string {
 	return fmt.Sprintf("cloudflared service is already installed at %s; if you are running a cloudflared tunnel, you "+
 		"can point it to multiple origins, avoiding the need to run more than one cloudflared service in the "+
 		"same machine; otherwise if you are really sure, you can do `cloudflared service uninstall` to clean "+
 		"up the existing service and then try again this command",
 		service,
 	)
 }
 func runCommand(command string, args ...string) error {
 	cmd := exec.Command(command, args...)
 	stderr, err := cmd.StderrPipe()
@ -100,10 +82,121 @@ func runCommand(command string, args ...string) error {
 		return fmt.Errorf("error starting %s: %v", command, err)
 	}
-	output, _ := io.ReadAll(stderr)
+	_, _ = ioutil.ReadAll(stderr)
 	err = cmd.Wait()
 	if err != nil {
-		return fmt.Errorf("%s %v returned with error code %v due to: %v", command, args, err, string(output))
+		return fmt.Errorf("%s returned with error: %v", command, err)
 	}
 	return nil
 }
 func ensureConfigDirExists(configDir string) error {
 	ok, err := config.FileExists(configDir)
 	if !ok && err == nil {
 		err = os.Mkdir(configDir, 0755)
 	}
 	return err
 }
 // openFile opens the file at path. If create is set and the file exists, returns nil, true, nil
 func openFile(path string, create bool) (file *os.File, exists bool, err error) {
 	expandedPath, err := homedir.Expand(path)
 	if err != nil {
 		return nil, false, err
 	}
 	if create {
 		fileInfo, err := os.Stat(expandedPath)
 		if err == nil && fileInfo.Size() > 0 {
 			return nil, true, nil
 		}
 		file, err = os.OpenFile(expandedPath, os.O_RDWR|os.O_CREATE, 0600)
 	} else {
 		file, err = os.Open(expandedPath)
 	}
 	return file, false, err
 }
 func copyCredential(srcCredentialPath, destCredentialPath string) error {
 	destFile, exists, err := openFile(destCredentialPath, true)
 	if err != nil {
 		return err
 	} else if exists {
 		// credentials already exist, do nothing
 		return nil
 	}
 	defer destFile.Close()
 	srcFile, _, err := openFile(srcCredentialPath, false)
 	if err != nil {
 		return err
 	}
 	defer srcFile.Close()
 	// Copy certificate
 	_, err = io.Copy(destFile, srcFile)
 	if err != nil {
 		return fmt.Errorf("unable to copy %s to %s: %v", srcCredentialPath, destCredentialPath, err)
 	}
 	return nil
 }
 func copyFile(src, dest string) error {
 	srcFile, err := os.Open(src)
 	if err != nil {
 		return err
 	}
 	defer srcFile.Close()
 	destFile, err := os.Create(dest)
 	if err != nil {
 		return err
 	}
 	ok := false
 	defer func() {
 		destFile.Close()
 		if !ok {
 			_ = os.Remove(dest)
 		}
 	}()
 	if _, err := io.Copy(destFile, srcFile); err != nil {
 		return err
 	}
 	ok = true
 	return nil
 }
 func copyConfig(srcConfigPath, destConfigPath string) error {
 	// Copy or create config
 	destFile, exists, err := openFile(destConfigPath, true)
 	if err != nil {
 		return fmt.Errorf("cannot open %s with error: %s", destConfigPath, err)
 	} else if exists {
 		// config already exists, do nothing
 		return nil
 	}
 	defer destFile.Close()
 	srcFile, _, err := openFile(srcConfigPath, false)
 	if err != nil {
 		fmt.Println("Your service needs a config file that at least specifies the hostname option.")
 		fmt.Println("Type in a hostname now, or leave it blank and create the config file later.")
 		fmt.Print("Hostname: ")
 		reader := bufio.NewReader(os.Stdin)
 		input, _ := reader.ReadString('\n')
 		if input == "" {
 			return err
 		}
 		fmt.Fprintf(destFile, "hostname: %s\n", input)
 	} else {
 		defer srcFile.Close()
 		_, err = io.Copy(destFile, srcFile)
 		if err != nil {
 			return fmt.Errorf("unable to copy %s to %s: %v", srcConfigPath, destConfigPath, err)
 		}
 	}
 	return nil
 }
--- a/cmd/cloudflared/tail/cmd.go
+++ b/cmd/cloudflared/tail/cmd.go
@ -1,456 +0,0 @@
 package tail
 import (
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
 	"github.com/google/uuid"
 	"github.com/mattn/go-colorable"
 	"github.com/rs/zerolog"
 	"github.com/urfave/cli/v2"
 	"nhooyr.io/websocket"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	cfdflags "github.com/cloudflare/cloudflared/cmd/cloudflared/flags"
 	"github.com/cloudflare/cloudflared/credentials"
 	"github.com/cloudflare/cloudflared/management"
 )
 var buildInfo *cliutil.BuildInfo
 func Init(bi *cliutil.BuildInfo) {
 	buildInfo = bi
 }
 func Command() *cli.Command {
 	subcommands := []*cli.Command{
 		buildTailManagementTokenSubcommand(),
 	}
 	return buildTailCommand(subcommands)
 }
 func buildTailManagementTokenSubcommand() *cli.Command {
 	return &cli.Command{
 		Name:        "token",
 		Action:      cliutil.ConfiguredAction(managementTokenCommand),
 		Usage:       "Get management access jwt",
 		UsageText:   "cloudflared tail token TUNNEL_ID",
 		Description: `Get management access jwt for a tunnel`,
 		Hidden:      true,
 	}
 }
 func managementTokenCommand(c *cli.Context) error {
 	log := createLogger(c)
 	token, err := getManagementToken(c, log)
 	if err != nil {
 		return err
 	}
 	tokenResponse := struct {
 		Token string `json:"token"`
 	}{Token: token}
 	return json.NewEncoder(os.Stdout).Encode(tokenResponse)
 }
 func buildTailCommand(subcommands []*cli.Command) *cli.Command {
 	return &cli.Command{
 		Name:      "tail",
 		Action:    Run,
 		Usage:     "Stream logs from a remote cloudflared",
 		UsageText: "cloudflared tail [tail command options] [TUNNEL-ID]",
 		Flags: []cli.Flag{
 			&cli.StringFlag{
 				Name:    "connector-id",
 				Usage:   "Access a specific cloudflared instance by connector id (for when a tunnel has multiple cloudflared's)",
 				Value:   "",
 				EnvVars: []string{"TUNNEL_MANAGEMENT_CONNECTOR"},
 			},
 			&cli.StringSliceFlag{
 				Name:    "event",
 				Usage:   "Filter by specific Events (cloudflared, http, tcp, udp) otherwise, defaults to send all events",
 				EnvVars: []string{"TUNNEL_MANAGEMENT_FILTER_EVENTS"},
 			},
 			&cli.StringFlag{
 				Name:    "level",
 				Usage:   "Filter by specific log levels (debug, info, warn, error). Filters by debug log level by default.",
 				EnvVars: []string{"TUNNEL_MANAGEMENT_FILTER_LEVEL"},
 				Value:   "debug",
 			},
 			&cli.Float64Flag{
 				Name:    "sample",
 				Usage:   "Sample log events by percentage (0.0 .. 1.0). No sampling by default.",
 				EnvVars: []string{"TUNNEL_MANAGEMENT_FILTER_SAMPLE"},
 				Value:   1.0,
 			},
 			&cli.StringFlag{
 				Name:    "token",
 				Usage:   "Access token for a specific tunnel",
 				Value:   "",
 				EnvVars: []string{"TUNNEL_MANAGEMENT_TOKEN"},
 			},
 			&cli.StringFlag{
 				Name:    cfdflags.ManagementHostname,
 				Usage:   "Management hostname to signify incoming management requests",
 				EnvVars: []string{"TUNNEL_MANAGEMENT_HOSTNAME"},
 				Hidden:  true,
 				Value:   "management.argotunnel.com",
 			},
 			&cli.StringFlag{
 				Name:   "trace",
 				Usage:  "Set a cf-trace-id for the request",
 				Hidden: true,
 				Value:  "",
 			},
 			&cli.StringFlag{
 				Name:    cfdflags.LogLevel,
 				Value:   "info",
 				Usage:   "Application logging level {debug, info, warn, error, fatal}",
 				EnvVars: []string{"TUNNEL_LOGLEVEL"},
 			},
 			&cli.StringFlag{
 				Name:    cfdflags.OriginCert,
 				Usage:   "Path to the certificate generated for your origin when you run cloudflared login.",
 				EnvVars: []string{"TUNNEL_ORIGIN_CERT"},
 				Value:   credentials.FindDefaultOriginCertPath(),
 			},
 			cliutil.FlagLogOutput,
 		},
 		Subcommands: subcommands,
 	}
 }
 // Middleware validation error struct for returning to the eyeball
 type managementError struct {
 	Code    int    `json:"code,omitempty"`
 	Message string `json:"message,omitempty"`
 }
 // Middleware validation error HTTP response JSON for returning to the eyeball
 type managementErrorResponse struct {
 	Success bool              `json:"success,omitempty"`
 	Errors  []managementError `json:"errors,omitempty"`
 }
 func handleValidationError(resp *http.Response, log *zerolog.Logger) {
 	if resp.StatusCode == 530 {
 		log.Error().Msgf("no cloudflared connector available or reachable via management request (a recent version of cloudflared is required to use streaming logs)")
 	}
 	var managementErr managementErrorResponse
 	err := json.NewDecoder(resp.Body).Decode(&managementErr)
 	if err != nil {
 		log.Error().Msgf("unable to start management log streaming session: http response code returned %d", resp.StatusCode)
 		return
 	}
 	if managementErr.Success || len(managementErr.Errors) == 0 {
 		log.Error().Msgf("management tunnel validation returned success with invalid HTTP response code to convert to a WebSocket request")
 		return
 	}
 	for _, e := range managementErr.Errors {
 		log.Error().Msgf("management request failed validation: (%d) %s", e.Code, e.Message)
 	}
 }
 // logger will be created to emit only against the os.Stderr as to not obstruct with normal output from
 // management requests
 func createLogger(c *cli.Context) *zerolog.Logger {
 	level, levelErr := zerolog.ParseLevel(c.String(cfdflags.LogLevel))
 	if levelErr != nil {
 		level = zerolog.InfoLevel
 	}
 	var writer io.Writer
 	switch c.String(cfdflags.LogFormatOutput) {
 	case cfdflags.LogFormatOutputValueJSON:
 		// zerolog by default outputs as JSON
 		writer = os.Stderr
 	case cfdflags.LogFormatOutputValueDefault:
 		// "default" and unset use the same logger output format
 		fallthrough
 	default:
 		writer = zerolog.ConsoleWriter{
 			Out:        colorable.NewColorable(os.Stderr),
 			TimeFormat: time.RFC3339,
 		}
 	}
 	log := zerolog.New(writer).With().Timestamp().Logger().Level(level)
 	return &log
 }
 // parseFilters will attempt to parse provided filters to send to with the EventStartStreaming
 func parseFilters(c *cli.Context) (*management.StreamingFilters, error) {
 	var level *management.LogLevel
 	var sample float64
 	events := make([]management.LogEventType, 0)
 	argLevel := c.String("level")
 	argEvents := c.StringSlice("event")
 	argSample := c.Float64("sample")
 	if argLevel != "" {
 		l, ok := management.ParseLogLevel(argLevel)
 		if !ok {
 			return nil, fmt.Errorf("invalid --level filter provided, please use one of the following Log Levels: debug, info, warn, error")
 		}
 		level = &l
 	}
 	for _, v := range argEvents {
 		t, ok := management.ParseLogEventType(v)
 		if !ok {
 			return nil, fmt.Errorf("invalid --event filter provided, please use one of the following EventTypes: cloudflared, http, tcp, udp")
 		}
 		events = append(events, t)
 	}
 	if argSample <= 0.0 || argSample > 1.0 {
 		return nil, fmt.Errorf("invalid --sample value provided, please make sure it is in the range (0.0 .. 1.0)")
 	}
 	sample = argSample
 	if level == nil && len(events) == 0 && argSample != 1.0 {
 		// When no filters are provided, do not return a StreamingFilters struct
 		return nil, nil
 	}
 	return &management.StreamingFilters{
 		Level:    level,
 		Events:   events,
 		Sampling: sample,
 	}, nil
 }
 // getManagementToken will make a call to the Cloudflare API to acquire a management token for the requested tunnel.
 func getManagementToken(c *cli.Context, log *zerolog.Logger) (string, error) {
 	userCreds, err := credentials.Read(c.String(cfdflags.OriginCert), log)
 	if err != nil {
 		return "", err
 	}
 	var apiURL string
 	if userCreds.IsFEDEndpoint() {
 		apiURL = credentials.FedRampBaseApiURL
 	} else {
 		apiURL = c.String(cfdflags.ApiURL)
 	}
 	client, err := userCreds.Client(apiURL, buildInfo.UserAgent(), log)
 	if err != nil {
 		return "", err
 	}
 	tunnelIDString := c.Args().First()
 	if tunnelIDString == "" {
 		return "", errors.New("no tunnel ID provided")
 	}
 	tunnelID, err := uuid.Parse(tunnelIDString)
 	if err != nil {
 		return "", errors.New("unable to parse provided tunnel id as a valid UUID")
 	}
 	token, err := client.GetManagementToken(tunnelID)
 	if err != nil {
 		return "", err
 	}
 	return token, nil
 }
 // buildURL will build the management url to contain the required query parameters to authenticate the request.
 func buildURL(c *cli.Context, log *zerolog.Logger) (url.URL, error) {
 	var err error
 	token := c.String("token")
 	if token == "" {
 		token, err = getManagementToken(c, log)
 		if err != nil {
 			return url.URL{}, fmt.Errorf("unable to acquire management token for requested tunnel id: %w", err)
 		}
 	}
 	claims, err := management.ParseToken(token)
 	if err != nil {
 		return url.URL{}, fmt.Errorf("failed to determine if token is FED: %w", err)
 	}
 	var managementHostname string
 	if claims.IsFed() {
 		managementHostname = credentials.FedRampHostname
 	} else {
 		managementHostname = c.String(cfdflags.ManagementHostname)
 	}
 	query := url.Values{}
 	query.Add("access_token", token)
 	connector := c.String("connector-id")
 	if connector != "" {
 		connectorID, err := uuid.Parse(connector)
 		if err != nil {
 			return url.URL{}, fmt.Errorf("unabled to parse 'connector-id' flag into a valid UUID: %w", err)
 		}
 		query.Add("connector_id", connectorID.String())
 	}
 	return url.URL{Scheme: "wss", Host: managementHostname, Path: "/logs", RawQuery: query.Encode()}, nil
 }
 func printLine(log *management.Log, logger *zerolog.Logger) {
 	fields, err := json.Marshal(log.Fields)
 	if err != nil {
 		fields = []byte("unable to parse fields")
 		logger.Debug().Msgf("unable to parse fields from event %+v", log)
 	}
 	fmt.Printf("%s %s %s %s %s\n", log.Time, log.Level, log.Event, log.Message, fields)
 }
 func printJSON(log *management.Log, logger *zerolog.Logger) {
 	output, err := json.Marshal(log)
 	if err != nil {
 		logger.Debug().Msgf("unable to parse event to json %+v", log)
 	} else {
 		fmt.Println(string(output))
 	}
 }
 // Run implements a foreground runner
 func Run(c *cli.Context) error {
 	log := createLogger(c)
 	signals := make(chan os.Signal, 10)
 	signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
 	defer signal.Stop(signals)
 	output := "default"
 	switch c.String("output") {
 	case "default", "":
 		output = "default"
 	case "json":
 		output = "json"
 	default:
 		log.Err(errors.New("invalid --output value provided, please make sure it is one of: default, json")).Send()
 	}
 	filters, err := parseFilters(c)
 	if err != nil {
 		log.Error().Err(err).Msgf("invalid filters provided")
 		return nil
 	}
 	u, err := buildURL(c, log)
 	if err != nil {
 		log.Err(err).Msg("unable to construct management request URL")
 		return nil
 	}
 	header := make(http.Header)
 	header.Add("User-Agent", buildInfo.UserAgent())
 	trace := c.String("trace")
 	if trace != "" {
 		header["cf-trace-id"] = []string{trace}
 	}
 	ctx := c.Context
 	// nolint: bodyclose
 	conn, resp, err := websocket.Dial(ctx, u.String(), &websocket.DialOptions{
 		HTTPHeader: header,
 	})
 	if err != nil {
 		if resp != nil && resp.StatusCode != http.StatusSwitchingProtocols {
 			handleValidationError(resp, log)
 			return nil
 		}
 		log.Error().Err(err).Msgf("unable to start management log streaming session")
 		return nil
 	}
 	defer conn.Close(websocket.StatusInternalError, "management connection was closed abruptly")
 	// Once connection is established, send start_streaming event to begin receiving logs
 	err = management.WriteEvent(conn, ctx, &management.EventStartStreaming{
 		ClientEvent: management.ClientEvent{Type: management.StartStreaming},
 		Filters:     filters,
 	})
 	if err != nil {
 		log.Error().Err(err).Msg("unable to request logs from management tunnel")
 		return nil
 	}
 	log.Debug().
 		Str("tunnel-id", c.Args().First()).
 		Str("connector-id", c.String("connector-id")).
 		Interface("filters", filters).
 		Msg("connected")
 	readerDone := make(chan struct{})
 	go func() {
 		defer close(readerDone)
 		for {
 			select {
 			case <-ctx.Done():
 				return
 			default:
 				event, err := management.ReadServerEvent(conn, ctx)
 				if err != nil {
 					if closeErr := management.AsClosed(err); closeErr != nil {
 						// If the client (or the server) already closed the connection, don't continue to
 						// attempt to read from the client.
 						if closeErr.Code == websocket.StatusNormalClosure {
 							return
 						}
 						// Only log abnormal closures
 						log.Error().Msgf("received remote closure: (%d) %s", closeErr.Code, closeErr.Reason)
 						return
 					}
 					log.Err(err).Msg("unable to read event from server")
 					return
 				}
 				switch event.Type {
 				case management.Logs:
 					logs, ok := management.IntoServerEvent(event, management.Logs)
 					if !ok {
 						log.Error().Msgf("invalid logs event")
 						continue
 					}
 					// Output all the logs received to stdout
 					for _, l := range logs.Logs {
 						if output == "json" {
 							printJSON(l, log)
 						} else {
 							printLine(l, log)
 						}
 					}
 				case management.UnknownServerEventType:
 					fallthrough
 				default:
 					log.Debug().Msgf("unexpected log event type: %s", event.Type)
 				}
 			}
 		}
 	}()
 	for {
 		select {
 		case <-ctx.Done():
 			return nil
 		case <-readerDone:
 			return nil
 		case <-signals:
 			log.Debug().Msg("closing management connection")
 			// Cleanly close the connection by sending a close message and then
 			// waiting (with timeout) for the server to close the connection.
 			conn.Close(websocket.StatusNormalClosure, "")
 			select {
 			case <-readerDone:
 			case <-time.After(time.Second):
 			}
 			return nil
 		}
 	}
 }
--- a/cmd/cloudflared/tunnel/cmd.go
+++ b/cmd/cloudflared/tunnel/cmd.go
--- a/cmd/cloudflared/tunnel/config_test.go
+++ b/cmd/cloudflared/tunnel/config_test.go
@ -0,0 +1,13 @@
 package tunnel
 import (
 	"testing"
 	"github.com/stretchr/testify/require"
 )
 func TestDedup(t *testing.T) {
 	expected := []string{"a", "b"}
 	actual := dedup([]string{"a", "b", "a"})
 	require.ElementsMatch(t, expected, actual)
 }
--- a/cmd/cloudflared/tunnel/configuration.go
+++ b/cmd/cloudflared/tunnel/configuration.go
@ -1,70 +1,69 @@
 package tunnel
 import (
 	"context"
 	"crypto/tls"
 	"fmt"
-	"net"
+	"io/ioutil"
 	"net/netip"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 	"github.com/google/uuid"
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/rs/zerolog"
 	"github.com/urfave/cli/v2"
-	"github.com/urfave/cli/v2/altsrc"
+	"golang.org/x/crypto/ssh/terminal"
 	"golang.org/x/term"
-	"github.com/cloudflare/cloudflared/client"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/buildinfo"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/flags"
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/edgediscovery"
-	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
+	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/features"
 	"github.com/cloudflare/cloudflared/ingress"
-	"github.com/cloudflare/cloudflared/ingress/origins"
+	"github.com/cloudflare/cloudflared/origin"
 	"github.com/cloudflare/cloudflared/orchestration"
 	"github.com/cloudflare/cloudflared/supervisor"
 	"github.com/cloudflare/cloudflared/tlsconfig"
-	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
+	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/validation"
 )
-const (
+const LogFieldOriginCertPath = "originCertPath"
 	secretValue       = "*****"
 	icmpFunnelTimeout = time.Second * 10
 )
 var (
-	secretFlags = [2]*altsrc.StringFlag{credentialsContentsFlag, tunnelTokenFlag}
+	developerPortal = "https://developers.cloudflare.com/argo-tunnel"
 	quickStartUrl   = developerPortal + "/quickstart/quickstart/"
 	serviceUrl      = developerPortal + "/reference/service/"
 	argumentsUrl    = developerPortal + "/reference/arguments/"
-	configFlags = []string{
+	LogFieldHostname = "hostname"
 		flags.AutoUpdateFreq,
 		flags.NoAutoUpdate,
 		flags.Retries,
 		flags.Protocol,
 		flags.LogLevel,
 		flags.TransportLogLevel,
 		flags.OriginCert,
 		flags.Metrics,
 		flags.MetricsUpdateFreq,
 		flags.EdgeIpVersion,
 		flags.EdgeBindAddress,
 		flags.MaxActiveFlows,
 	}
 )
 // returns the first path that contains a cert.pem file. If none of the DefaultConfigSearchDirectories
 // contains a cert.pem file, return empty string
 func findDefaultOriginCertPath() string {
 	for _, defaultConfigDir := range config.DefaultConfigSearchDirectories() {
 		originCertPath, _ := homedir.Expand(filepath.Join(defaultConfigDir, config.DefaultCredentialFile))
 		if ok, _ := config.FileExists(originCertPath); ok {
 			return originCertPath
 		}
 	}
 	return ""
 }
 func generateRandomClientID(log *zerolog.Logger) (string, error) {
 	u, err := uuid.NewRandom()
 	if err != nil {
 		log.Error().Msgf("couldn't create UUID for client ID %s", err)
 		return "", err
 	}
 	return u.String(), nil
 }
 func logClientOptions(c *cli.Context, log *zerolog.Logger) {
 	flags := make(map[string]interface{})
 	for _, flag := range c.FlagNames() {
-		if isSecretFlag(flag) {
+		flags[flag] = c.Generic(flag)
 			flags[flag] = secretValue
 		} else {
 			flags[flag] = c.Generic(flag)
 		}
 	}
 	if len(flags) > 0 {
@ -78,11 +77,7 @@ func logClientOptions(c *cli.Context, log *zerolog.Logger) {
 		if strings.Contains(env, "TUNNEL_") {
 			vars := strings.Split(env, "=")
 			if len(vars) == 2 {
-				if isSecretEnvVar(vars[0]) {
+				envs[vars[0]] = vars[1]
 					envs[vars[0]] = secretValue
 				} else {
 					envs[vars[0]] = vars[1]
 				}
 			}
 		}
 	}
@ -91,81 +86,161 @@ func logClientOptions(c *cli.Context, log *zerolog.Logger) {
 	}
 }
-func isSecretFlag(key string) bool {
+func dnsProxyStandAlone(c *cli.Context, namedTunnel *connection.NamedTunnelConfig) bool {
-	for _, flag := range secretFlags {
+	return c.IsSet("proxy-dns") && (!c.IsSet("hostname") && !c.IsSet("tag") && !c.IsSet("hello-world") && namedTunnel == nil)
 		if flag.Name == key {
 			return true
 		}
 	}
 	return false
 }
-func isSecretEnvVar(key string) bool {
+func findOriginCert(originCertPath string, log *zerolog.Logger) (string, error) {
-	for _, flag := range secretFlags {
+	if originCertPath == "" {
-		for _, secretEnvVar := range flag.EnvVars {
+		log.Info().Msgf("Cannot determine default origin certificate path. No file %s in %v", config.DefaultCredentialFile, config.DefaultConfigSearchDirectories())
-			if secretEnvVar == key {
+		if isRunningFromTerminal() {
-				return true
+			log.Error().Msgf("You need to specify the origin certificate path with --origincert option, or set TUNNEL_ORIGIN_CERT environment variable. See %s for more information.", argumentsUrl)
-			}
+			return "", fmt.Errorf("client didn't specify origincert path when running from terminal")
 		} else {
 			log.Error().Msgf("You need to specify the origin certificate path by specifying the origincert option in the configuration file, or set TUNNEL_ORIGIN_CERT environment variable. See %s for more information.", serviceUrl)
 			return "", fmt.Errorf("client didn't specify origincert path")
 		}
 	}
-	return false
+	var err error
 	originCertPath, err = homedir.Expand(originCertPath)
 	if err != nil {
 		log.Err(err).Msgf("Cannot resolve origin certificate path")
 		return "", fmt.Errorf("cannot resolve path %s", originCertPath)
 	}
 	// Check that the user has acquired a certificate using the login command
 	ok, err := config.FileExists(originCertPath)
 	if err != nil {
 		log.Error().Err(err).Msgf("Cannot check if origin cert exists at path %s", originCertPath)
 		return "", fmt.Errorf("cannot check if origin cert exists at path %s", originCertPath)
 	}
 	if !ok {
 		log.Error().Msgf(`Cannot find a valid certificate for your origin at the path:
    %s
 If the path above is wrong, specify the path with the -origincert option.
 If you don't have a certificate signed by Cloudflare, run the command:
 	%s login
 `, originCertPath, os.Args[0])
 		return "", fmt.Errorf("cannot find a valid certificate at the path %s", originCertPath)
 	}
 	return originCertPath, nil
 }
-func dnsProxyStandAlone(c *cli.Context, namedTunnel *connection.TunnelProperties) bool {
+func readOriginCert(originCertPath string) ([]byte, error) {
-	return c.IsSet(flags.ProxyDns) &&
+	// Easier to send the certificate as []byte via RPC than decoding it at this point
-		!(c.IsSet(flags.Name) || // adhoc-named tunnel
+	originCert, err := ioutil.ReadFile(originCertPath)
-			c.IsSet(ingress.HelloWorldFlag) || // quick or named tunnel
+	if err != nil {
-			namedTunnel != nil) // named tunnel
+		return nil, fmt.Errorf("cannot read %s to load origin certificate", originCertPath)
 	}
 	return originCert, nil
 }
 func getOriginCert(originCertPath string, log *zerolog.Logger) ([]byte, error) {
 	if originCertPath, err := findOriginCert(originCertPath, log); err != nil {
 		return nil, err
 	} else {
 		return readOriginCert(originCertPath)
 	}
 }
 func prepareTunnelConfig(
 	ctx context.Context,
 	c *cli.Context,
-	info *cliutil.BuildInfo,
+	buildInfo *buildinfo.BuildInfo,
 	version string,
 	log, logTransport *zerolog.Logger,
 	observer *connection.Observer,
-	namedTunnel *connection.TunnelProperties,
+	namedTunnel *connection.NamedTunnelConfig,
-) (*supervisor.TunnelConfig, *orchestration.Config, error) {
+) (*origin.TunnelConfig, ingress.Ingress, error) {
-	transportProtocol := c.String(flags.Protocol)
+	isNamedTunnel := namedTunnel != nil
-	isPostQuantumEnforced := c.Bool(flags.PostQuantum)
+
-	featureSelector, err := features.NewFeatureSelector(ctx, namedTunnel.Credentials.AccountTag, c.StringSlice(flags.Features), isPostQuantumEnforced, log)
+	configHostname := c.String("hostname")
 	hostname, err := validation.ValidateHostname(configHostname)
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "Failed to create feature selector")
+		log.Err(err).Str(LogFieldHostname, configHostname).Msg("Invalid hostname")
 		return nil, ingress.Ingress{}, errors.Wrap(err, "Invalid hostname")
 	}
 	clientID := c.String("id")
 	if !c.IsSet("id") {
 		clientID, err = generateRandomClientID(log)
 		if err != nil {
 			return nil, ingress.Ingress{}, err
 		}
 	}
-	clientConfig, err := client.NewConfig(info.Version(), info.OSArch(), featureSelector)
+	tags, err := NewTagSliceFromCLI(c.StringSlice("tag"))
 	if err != nil {
 		return nil, nil, err
 	}
 	log.Info().Msgf("Generated Connector ID: %s", clientConfig.ConnectorID)
 	tags, err := NewTagSliceFromCLI(c.StringSlice(flags.Tag))
 	if err != nil {
 		log.Err(err).Msg("Tag parse failure")
-		return nil, nil, errors.Wrap(err, "Tag parse failure")
+		return nil, ingress.Ingress{}, errors.Wrap(err, "Tag parse failure")
 	}
 	tags = append(tags, pogs.Tag{Name: "ID", Value: clientConfig.ConnectorID.String()})
 	clientFeatures := featureSelector.Snapshot()
 	pqMode := clientFeatures.PostQuantum
 	if pqMode == features.PostQuantumStrict {
 		// Error if the user tries to force a non-quic transport protocol
 		if transportProtocol != connection.AutoSelectFlag && transportProtocol != connection.QUIC.String() {
 			return nil, nil, fmt.Errorf("post-quantum is only supported with the quic transport")
 		}
 		transportProtocol = connection.QUIC.String()
 	}
 	tags = append(tags, tunnelpogs.Tag{Name: "ID", Value: clientID})
 	var (
 		ingressRules  ingress.Ingress
 		classicTunnel *connection.ClassicTunnelConfig
 	)
 	cfg := config.GetConfiguration()
-	ingressRules, err := ingress.ParseIngressFromConfigAndCLI(cfg, c, log)
+	if isNamedTunnel {
-	if err != nil {
+		clientUUID, err := uuid.NewRandom()
-		return nil, nil, err
+		if err != nil {
 			return nil, ingress.Ingress{}, errors.Wrap(err, "can't generate connector UUID")
 		}
 		log.Info().Msgf("Generated Connector ID: %s", clientUUID)
 		features := append(c.StringSlice("features"), origin.FeatureSerializedHeaders)
 		namedTunnel.Client = tunnelpogs.ClientInfo{
 			ClientID: clientUUID[:],
 			Features: dedup(features),
 			Version:  version,
 			Arch:     buildInfo.OSArch(),
 		}
 		ingressRules, err = ingress.ParseIngress(cfg)
 		if err != nil && err != ingress.ErrNoIngressRules {
 			return nil, ingress.Ingress{}, err
 		}
 		if !ingressRules.IsEmpty() && c.IsSet("url") {
 			return nil, ingress.Ingress{}, ingress.ErrURLIncompatibleWithIngress
 		}
 	} else {
 		originCertPath := c.String("origincert")
 		originCertLog := log.With().
 			Str(LogFieldOriginCertPath, originCertPath).
 			Logger()
 		originCert, err := getOriginCert(originCertPath, &originCertLog)
 		if err != nil {
 			return nil, ingress.Ingress{}, errors.Wrap(err, "Error getting origin cert")
 		}
 		classicTunnel = &connection.ClassicTunnelConfig{
 			Hostname:   hostname,
 			OriginCert: originCert,
 			// turn off use of reconnect token and auth refresh when using named tunnels
 			UseReconnectToken: !isNamedTunnel && c.Bool("use-reconnect-token"),
 		}
 	}
-	protocolSelector, err := connection.NewProtocolSelector(transportProtocol, namedTunnel.Credentials.AccountTag, c.IsSet(TunnelTokenFlag), isPostQuantumEnforced, edgediscovery.ProtocolPercentage, connection.ResolveTTL, log)
+	// Convert single-origin configuration into multi-origin configuration.
 	if ingressRules.IsEmpty() {
 		ingressRules, err = ingress.NewSingleOrigin(c, !isNamedTunnel)
 		if err != nil {
 			return nil, ingress.Ingress{}, err
 		}
 	}
 	var warpRoutingService *ingress.WarpRoutingService
 	warpRoutingEnabled := isWarpRoutingEnabled(cfg.WarpRouting, isNamedTunnel)
 	if warpRoutingEnabled {
 		warpRoutingService = ingress.NewWarpRoutingService()
 		log.Info().Msgf("Warp-routing is enabled")
 	}
 	protocolSelector, err := connection.NewProtocolSelector(c.String("protocol"), warpRoutingEnabled, namedTunnel, edgediscovery.ProtocolPercentage, origin.ResolveTTL, log)
 	if err != nil {
-		return nil, nil, err
+		return nil, ingress.Ingress{}, err
 	}
 	log.Info().Msgf("Initial protocol %s", protocolSelector.Current())
@ -173,11 +248,11 @@ func prepareTunnelConfig(
 	for _, p := range connection.ProtocolList {
 		tlsSettings := p.TLSSettings()
 		if tlsSettings == nil {
-			return nil, nil, fmt.Errorf("%s has unknown TLS settings", p)
+			return nil, ingress.Ingress{}, fmt.Errorf("%s has unknown TLS settings", p)
 		}
 		edgeTLSConfig, err := tlsconfig.CreateTunnelConfig(c, tlsSettings.ServerName)
 		if err != nil {
-			return nil, nil, errors.Wrap(err, "unable to create TLS config to connect with edge")
+			return nil, ingress.Ingress{}, errors.Wrap(err, "unable to create TLS config to connect with edge")
 		}
 		if len(tlsSettings.NextProtos) > 0 {
 			edgeTLSConfig.NextProtos = tlsSettings.NextProtos
@ -185,352 +260,82 @@ func prepareTunnelConfig(
 		edgeTLSConfigs[p] = edgeTLSConfig
 	}
 	originProxy := origin.NewOriginProxy(ingressRules, warpRoutingService, tags, log)
 	gracePeriod, err := gracePeriod(c)
 	if err != nil {
-		return nil, nil, err
+		return nil, ingress.Ingress{}, err
 	}
-	edgeIPVersion, err := parseConfigIPVersion(c.String(flags.EdgeIpVersion))
+	connectionConfig := &connection.Config{
-	if err != nil {
+		OriginProxy:     originProxy,
 		return nil, nil, err
 	}
 	edgeBindAddr, err := parseConfigBindAddress(c.String(flags.EdgeBindAddress))
 	if err != nil {
 		return nil, nil, err
 	}
 	if err := testIPBindable(edgeBindAddr); err != nil {
 		return nil, nil, fmt.Errorf("invalid edge-bind-address %s: %v", edgeBindAddr, err)
 	}
 	edgeIPVersion, err = adjustIPVersionByBindAddress(edgeIPVersion, edgeBindAddr)
 	if err != nil {
 		// This is not a fatal error, we just overrode edgeIPVersion
 		log.Warn().Str("edgeIPVersion", edgeIPVersion.String()).Err(err).Msg("Overriding edge-ip-version")
 	}
 	region := c.String(flags.Region)
 	endpoint := namedTunnel.Credentials.Endpoint
 	var resolvedRegion string
 	// set resolvedRegion to either the region passed as argument
 	// or to the endpoint in the credentials.
 	// Region and endpoint are interchangeable
 	if region != "" && endpoint != "" {
 		return nil, nil, fmt.Errorf("region provided with a token that has an endpoint")
 	} else if region != "" {
 		resolvedRegion = region
 	} else if endpoint != "" {
 		resolvedRegion = endpoint
 	}
 	warpRoutingConfig := ingress.NewWarpRoutingConfig(&cfg.WarpRouting)
 	// Setup origin dialer service and virtual services
 	originDialerService := ingress.NewOriginDialer(ingress.OriginConfig{
 		DefaultDialer:   ingress.NewDialer(warpRoutingConfig),
 		TCPWriteTimeout: c.Duration(flags.WriteStreamTimeout),
 	}, log)
 	// Setup DNS Resolver Service
 	originMetrics := origins.NewMetrics(prometheus.DefaultRegisterer)
 	dnsResolverAddrs := c.StringSlice(flags.VirtualDNSServiceResolverAddresses)
 	dnsService := origins.NewDNSResolverService(origins.NewDNSDialer(), log, originMetrics)
 	if len(dnsResolverAddrs) > 0 {
 		addrs, err := parseResolverAddrPorts(dnsResolverAddrs)
 		if err != nil {
 			return nil, nil, fmt.Errorf("invalid %s provided: %w", flags.VirtualDNSServiceResolverAddresses, err)
 		}
 		dnsService = origins.NewStaticDNSResolverService(addrs, origins.NewDNSDialer(), log, originMetrics)
 	}
 	originDialerService.AddReservedService(dnsService, []netip.AddrPort{origins.VirtualDNSServiceAddr})
 	tunnelConfig := &supervisor.TunnelConfig{
 		ClientConfig:    clientConfig,
 		GracePeriod:     gracePeriod,
-		EdgeAddrs:       c.StringSlice(flags.Edge),
+		ReplaceExisting: c.Bool("force"),
-		Region:          resolvedRegion,
+	}
-		EdgeIPVersion:   edgeIPVersion,
+	muxerConfig := &connection.MuxerConfig{
-		EdgeBindAddr:    edgeBindAddr,
+		HeartbeatInterval: c.Duration("heartbeat-interval"),
 		HAConnections:   c.Int(flags.HaConnections),
 		IsAutoupdated:   c.Bool(flags.IsAutoUpdated),
 		LBPool:          c.String(flags.LBPool),
 		Tags:            tags,
 		Log:             log,
 		LogTransport:    logTransport,
 		Observer:        observer,
 		ReportedVersion: info.Version(),
 		// Note TUN-3758 , we use Int because UInt is not supported with altsrc
-		Retries:                             uint(c.Int(flags.Retries)), // nolint: gosec
+		MaxHeartbeats: uint64(c.Int("heartbeat-count")),
-		RunFromTerminal:                     isRunningFromTerminal(),
+		// Note TUN-3758 , we use Int because UInt is not supported with altsrc
-		NamedTunnel:                         namedTunnel,
+		CompressionSetting: h2mux.CompressionSetting(uint64(c.Int("compression-quality"))),
-		ProtocolSelector:                    protocolSelector,
+		MetricsUpdateFreq:  c.Duration("metrics-update-freq"),
 		EdgeTLSConfigs:                      edgeTLSConfigs,
 		MaxEdgeAddrRetries:                  uint8(c.Int(flags.MaxEdgeAddrRetries)), // nolint: gosec
 		RPCTimeout:                          c.Duration(flags.RpcTimeout),
 		WriteStreamTimeout:                  c.Duration(flags.WriteStreamTimeout),
 		DisableQUICPathMTUDiscovery:         c.Bool(flags.QuicDisablePathMTUDiscovery),
 		QUICConnectionLevelFlowControlLimit: c.Uint64(flags.QuicConnLevelFlowControlLimit),
 		QUICStreamLevelFlowControlLimit:     c.Uint64(flags.QuicStreamLevelFlowControlLimit),
 		OriginDNSService:                    dnsService,
 		OriginDialerService:                 originDialerService,
 	}
 	icmpRouter, err := newICMPRouter(c, log)
 	if err != nil {
 		log.Warn().Err(err).Msg("ICMP proxy feature is disabled")
 	} else {
 		tunnelConfig.ICMPRouterServer = icmpRouter
 	}
 	orchestratorConfig := &orchestration.Config{
 		Ingress:             &ingressRules,
 		WarpRouting:         warpRoutingConfig,
 		OriginDialerService: originDialerService,
 		ConfigurationFlags:  parseConfigFlags(c),
 	}
 	return tunnelConfig, orchestratorConfig, nil
 }
 func parseConfigFlags(c *cli.Context) map[string]string {
 	result := make(map[string]string)
 	for _, flag := range configFlags {
 		if v := c.String(flag); c.IsSet(flag) && v != "" {
 			result[flag] = v
 		}
 	}
-	return result
+	return &origin.TunnelConfig{
 		ConnectionConfig: connectionConfig,
 		OSArch:           buildInfo.OSArch(),
 		ClientID:         clientID,
 		EdgeAddrs:        c.StringSlice("edge"),
 		Region:           c.String("region"),
 		HAConnections:    c.Int("ha-connections"),
 		IncidentLookup:   origin.NewIncidentLookup(),
 		IsAutoupdated:    c.Bool("is-autoupdated"),
 		LBPool:           c.String("lb-pool"),
 		Tags:             tags,
 		Log:              log,
 		LogTransport:     logTransport,
 		Observer:         observer,
 		ReportedVersion:  version,
 		// Note TUN-3758 , we use Int because UInt is not supported with altsrc
 		Retries:          uint(c.Int("retries")),
 		RunFromTerminal:  isRunningFromTerminal(),
 		NamedTunnel:      namedTunnel,
 		ClassicTunnel:    classicTunnel,
 		MuxerConfig:      muxerConfig,
 		ProtocolSelector: protocolSelector,
 		EdgeTLSConfigs:   edgeTLSConfigs,
 	}, ingressRules, nil
 }
 func gracePeriod(c *cli.Context) (time.Duration, error) {
-	period := c.Duration(flags.GracePeriod)
+	period := c.Duration("grace-period")
 	if period > connection.MaxGracePeriod {
-		return time.Duration(0), fmt.Errorf("%s must be equal or less than %v", flags.GracePeriod, connection.MaxGracePeriod)
+		return time.Duration(0), fmt.Errorf("grace-period must be equal or less than %v", connection.MaxGracePeriod)
 	}
 	return period, nil
 }
 func isWarpRoutingEnabled(warpConfig config.WarpRoutingConfig, isNamedTunnel bool) bool {
 	return warpConfig.Enabled && isNamedTunnel
 }
 func isRunningFromTerminal() bool {
-	return term.IsTerminal(int(os.Stdout.Fd()))
+	return terminal.IsTerminal(int(os.Stdout.Fd()))
 }
-// ParseConfigIPVersion returns the IP version from possible expected values from config
+// Remove any duplicates from the slice
-func parseConfigIPVersion(version string) (v allregions.ConfigIPVersion, err error) {
+func dedup(slice []string) []string {
-	switch version {
+
-	case "4":
+	// Convert the slice into a set
-		v = allregions.IPv4Only
+	set := make(map[string]bool, 0)
-	case "6":
+	for _, str := range slice {
-		v = allregions.IPv6Only
+		set[str] = true
 	case "auto":
 		v = allregions.Auto
 	default: // unspecified or invalid
 		err = fmt.Errorf("invalid value for edge-ip-version: %s", version)
 	}
-	return
+
-}
+	// Convert the set back into a slice
-
+	keys := make([]string, len(set))
-func parseConfigBindAddress(ipstr string) (net.IP, error) {
+	i := 0
-	// Unspecified - it's fine
+	for str := range set {
-	if ipstr == "" {
+		keys[i] = str
-		return nil, nil
+		i++
-	}
+	}
-	ip := net.ParseIP(ipstr)
+	return keys
 	if ip == nil {
 		return nil, fmt.Errorf("invalid value for edge-bind-address: %s", ipstr)
 	}
 	return ip, nil
 }
 func testIPBindable(ip net.IP) error {
 	// "Unspecified" = let OS choose, so always bindable
 	if ip == nil {
 		return nil
 	}
 	addr := &net.UDPAddr{IP: ip, Port: 0}
 	listener, err := net.ListenUDP("udp", addr)
 	if err != nil {
 		return err
 	}
 	listener.Close()
 	return nil
 }
 func adjustIPVersionByBindAddress(ipVersion allregions.ConfigIPVersion, ip net.IP) (allregions.ConfigIPVersion, error) {
 	if ip == nil {
 		return ipVersion, nil
 	}
 	// https://pkg.go.dev/net#IP.To4: "If ip is not an IPv4 address, To4 returns nil."
 	if ip.To4() != nil {
 		if ipVersion == allregions.IPv6Only {
 			return allregions.IPv4Only, fmt.Errorf("IPv4 bind address is specified, but edge-ip-version is IPv6")
 		}
 		return allregions.IPv4Only, nil
 	} else {
 		if ipVersion == allregions.IPv4Only {
 			return allregions.IPv6Only, fmt.Errorf("IPv6 bind address is specified, but edge-ip-version is IPv4")
 		}
 		return allregions.IPv6Only, nil
 	}
 }
 func newICMPRouter(c *cli.Context, logger *zerolog.Logger) (ingress.ICMPRouterServer, error) {
 	ipv4Src, ipv6Src, err := determineICMPSources(c, logger)
 	if err != nil {
 		return nil, err
 	}
 	icmpRouter, err := ingress.NewICMPRouter(ipv4Src, ipv6Src, logger, icmpFunnelTimeout)
 	if err != nil {
 		return nil, err
 	}
 	return icmpRouter, nil
 }
 func determineICMPSources(c *cli.Context, logger *zerolog.Logger) (netip.Addr, netip.Addr, error) {
 	ipv4Src, err := determineICMPv4Src(c.String(flags.ICMPV4Src), logger)
 	if err != nil {
 		return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv4 source address for ICMP proxy")
 	}
 	logger.Info().Msgf("ICMP proxy will use %s as source for IPv4", ipv4Src)
 	ipv6Src, zone, err := determineICMPv6Src(c.String(flags.ICMPV6Src), logger, ipv4Src)
 	if err != nil {
 		return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv6 source address for ICMP proxy")
 	}
 	if zone != "" {
 		logger.Info().Msgf("ICMP proxy will use %s in zone %s as source for IPv6", ipv6Src, zone)
 	} else {
 		logger.Info().Msgf("ICMP proxy will use %s as source for IPv6", ipv6Src)
 	}
 	return ipv4Src, ipv6Src, nil
 }
 func determineICMPv4Src(userDefinedSrc string, logger *zerolog.Logger) (netip.Addr, error) {
 	if userDefinedSrc != "" {
 		addr, err := netip.ParseAddr(userDefinedSrc)
 		if err != nil {
 			return netip.Addr{}, err
 		}
 		if addr.Is4() {
 			return addr, nil
 		}
 		return netip.Addr{}, fmt.Errorf("expect IPv4, but %s is IPv6", userDefinedSrc)
 	}
 	addr, err := findLocalAddr(net.ParseIP("192.168.0.1"), 53)
 	if err != nil {
 		addr = netip.IPv4Unspecified()
 		logger.Debug().Err(err).Msgf("Failed to determine the IPv4 for this machine. It will use %s to send/listen for ICMPv4 echo", addr)
 	}
 	return addr, nil
 }
 type interfaceIP struct {
 	name string
 	ip   net.IP
 }
 func determineICMPv6Src(userDefinedSrc string, logger *zerolog.Logger, ipv4Src netip.Addr) (addr netip.Addr, zone string, err error) {
 	if userDefinedSrc != "" {
 		addr, err := netip.ParseAddr(userDefinedSrc)
 		if err != nil {
 			return netip.Addr{}, "", err
 		}
 		if addr.Is6() {
 			return addr, addr.Zone(), nil
 		}
 		return netip.Addr{}, "", fmt.Errorf("expect IPv6, but %s is IPv4", userDefinedSrc)
 	}
 	// Loop through all the interfaces, the preference is
 	// 1. The interface where ipv4Src is in
 	// 2. Interface with IPv6 address
 	// 3. Unspecified interface
 	interfaces, err := net.Interfaces()
 	if err != nil {
 		return netip.IPv6Unspecified(), "", nil
 	}
 	interfacesWithIPv6 := make([]interfaceIP, 0)
 	for _, interf := range interfaces {
 		interfaceAddrs, err := interf.Addrs()
 		if err != nil {
 			continue
 		}
 		foundIPv4SrcInterface := false
 		for _, interfaceAddr := range interfaceAddrs {
 			if ipnet, ok := interfaceAddr.(*net.IPNet); ok {
 				ip := ipnet.IP
 				if ip.Equal(ipv4Src.AsSlice()) {
 					foundIPv4SrcInterface = true
 				}
 				if ip.To4() == nil {
 					interfacesWithIPv6 = append(interfacesWithIPv6, interfaceIP{
 						name: interf.Name,
 						ip:   ip,
 					})
 				}
 			}
 		}
 		// Found the interface of ipv4Src. Loop through the addresses to see if there is an IPv6
 		if foundIPv4SrcInterface {
 			for _, interfaceAddr := range interfaceAddrs {
 				if ipnet, ok := interfaceAddr.(*net.IPNet); ok {
 					ip := ipnet.IP
 					if ip.To4() == nil {
 						addr, err := netip.ParseAddr(ip.String())
 						if err == nil {
 							return addr, interf.Name, nil
 						}
 					}
 				}
 			}
 		}
 	}
 	for _, interf := range interfacesWithIPv6 {
 		addr, err := netip.ParseAddr(interf.ip.String())
 		if err == nil {
 			return addr, interf.name, nil
 		}
 	}
 	logger.Debug().Err(err).Msgf("Failed to determine the IPv6 for this machine. It will use %s to send/listen for ICMPv6 echo", netip.IPv6Unspecified())
 	return netip.IPv6Unspecified(), "", nil
 }
 // FindLocalAddr tries to dial UDP and returns the local address picked by the OS
 func findLocalAddr(dst net.IP, port int) (netip.Addr, error) {
 	udpConn, err := net.DialUDP("udp", nil, &net.UDPAddr{
 		IP:   dst,
 		Port: port,
 	})
 	if err != nil {
 		return netip.Addr{}, err
 	}
 	defer udpConn.Close()
 	localAddrPort, err := netip.ParseAddrPort(udpConn.LocalAddr().String())
 	if err != nil {
 		return netip.Addr{}, err
 	}
 	localAddr := localAddrPort.Addr()
 	return localAddr, nil
 }
 func parseResolverAddrPorts(input []string) ([]netip.AddrPort, error) {
 	// We don't allow more than 10 resolvers to be provided statically for the resolver service.
 	if len(input) > 10 {
 		return nil, errors.New("too many addresses provided, max: 10")
 	}
 	addrs := make([]netip.AddrPort, 0, len(input))
 	for _, val := range input {
 		addr, err := netip.ParseAddrPort(val)
 		if err != nil {
 			return nil, err
 		}
 		addrs = append(addrs, addr)
 	}
 	return addrs, nil
 }
--- a/cmd/cloudflared/tunnel/configuration_test.go
+++ b/cmd/cloudflared/tunnel/configuration_test.go
@ -1,5 +1,4 @@
-//go:build ignore
+// +build ignore
 // TODO: Remove the above build tag and include this test when we start compiling with Golang 1.10.0+
 package tunnel
@ -8,7 +7,6 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"net"
 	"os"
 	"testing"
@ -214,23 +212,3 @@ func getCertPoolSubjects(certPool *x509.CertPool) ([]*pkix.Name, error) {
 func isUnrecoverableError(err error) bool {
 	return err != nil && err.Error() != "crypto/x509: system root pool is not available on Windows"
 }
 func TestTestIPBindable(t *testing.T) {
 	assert.Nil(t, testIPBindable(nil))
 	// Public services - if one of these IPs is on the machine, the test environment is too weird
 	assert.NotNil(t, testIPBindable(net.ParseIP("8.8.8.8")))
 	assert.NotNil(t, testIPBindable(net.ParseIP("1.1.1.1")))
 	addrs, err := net.InterfaceAddrs()
 	if err != nil {
 		t.Fatal(err)
 	}
 	for i, addr := range addrs {
 		if i >= 3 {
 			break
 		}
 		ip := addr.(*net.IPNet).IP
 		assert.Nil(t, testIPBindable(ip))
 	}
 }
--- a/cmd/cloudflared/tunnel/credential_finder.go
+++ b/cmd/cloudflared/tunnel/credential_finder.go
@ -4,9 +4,7 @@ import (
 	"fmt"
 	"path/filepath"
 	cfdflags "github.com/cloudflare/cloudflared/cmd/cloudflared/flags"
 	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/credentials"
 	"github.com/google/uuid"
 	"github.com/rs/zerolog"
@ -58,13 +56,13 @@ func newSearchByID(id uuid.UUID, c *cli.Context, log *zerolog.Logger, fs fileSys
 }
 func (s searchByID) Path() (string, error) {
-	originCertPath := s.c.String(cfdflags.OriginCert)
+	originCertPath := s.c.String("origincert")
 	originCertLog := s.log.With().
-		Str("originCertPath", originCertPath).
+		Str(LogFieldOriginCertPath, originCertPath).
 		Logger()
 	// Fallback to look for tunnel credentials in the origin cert directory
-	if originCertPath, err := credentials.FindOriginCert(originCertPath, &originCertLog); err == nil {
+	if originCertPath, err := findOriginCert(originCertPath, &originCertLog); err == nil {
 		originCertDir := filepath.Dir(originCertPath)
 		if filePath, err := tunnelFilePath(s.id, originCertDir); err == nil {
 			if s.fs.validFilePath(filePath) {
--- a/cmd/cloudflared/tunnel/filesystem.go
+++ b/cmd/cloudflared/tunnel/filesystem.go
@ -1,6 +1,7 @@
 package tunnel
 import (
 	"io/ioutil"
 	"os"
 )
@ -22,5 +23,5 @@ func (fs realFileSystem) validFilePath(path string) bool {
 }
 func (fs realFileSystem) readFile(filePath string) ([]byte, error) {
-	return os.ReadFile(filePath)
+	return ioutil.ReadFile(filePath)
 }
--- a/cmd/cloudflared/tunnel/info.go
+++ b/cmd/cloudflared/tunnel/info.go
@ -5,12 +5,12 @@ import (
 	"github.com/google/uuid"
-	"github.com/cloudflare/cloudflared/cfapi"
+	"github.com/cloudflare/cloudflared/tunnelstore"
 )
 type Info struct {
-	ID         uuid.UUID             `json:"id"`
+	ID         uuid.UUID                   `json:"id"`
-	Name       string                `json:"name"`
+	Name       string                      `json:"name"`
-	CreatedAt  time.Time             `json:"createdAt"`
+	CreatedAt  time.Time                   `json:"createdAt"`
-	Connectors []*cfapi.ActiveClient `json:"conns"`
+	Connectors []*tunnelstore.ActiveClient `json:"conns"`
 }
--- a/Show More
+++ b/Show More