Luis Neto

TUN-9016: update go to 1.24 ## Summary Update several moving parts of cloudflared build system: * use goboring 1.24.2 in cfsetup * update linter and fix lint issues * update packages namely **quic-go and net** * install script for macos * update docker files to use go 1.24.1 * remove usage of cloudflare-go * pin golang linter Closes TUN-9016

TUN-10557: Bump quic-go v0.59.1 Bumps quic-go to v0.59.1 (chungthuang fork rebased from upstream v0.45 onto v0.59.1). Upstream removed the `logging` package and replaced its callback-based ConnectionTracer with the structured `qlog`/`qlogwriter` event API, which required migrating cloudflared's QUIC metrics collection. Migrations: - quic/tracing.go: connTracer no longer fills a logging.ConnectionTracer callback struct. It implements qlogwriter.Trace + qlogwriter.Recorder and dispatches qlog events (PacketSent, PacketReceived, MetricsUpdated, ...) to the collector through RecordEvent. NewClientTracer now returns a function compatible with quic.Config.Tracer. - quic/metrics.go: collector methods take qlog types (qlog.Frame, qlog.PacketType, qlog.MetricsUpdated, ...) and plain int64 in place of the removed logging.ByteCount/Frame/RTTStats/TransportParameters. - quic/conversion.go: PacketType, PacketDropReason and PacketLossReason are strings upstream rather than numeric iotas, so the converters become pass-through allowlists. CongestionState is also a string; congestionStateToFloat maps it back to the numeric gauge values cloudflared exports. - quic.Connection/quic.Stream became *quic.Conn/*quic.Stream; updated ConnWithCloser, SafeStreamCloser and the connection package accordingly. Tests and generated mocks (mocks/mock_quic_connection.go) were adapted to the new pointer-based API. Closes TUN-10557

TUN-10563: introduce QUICConnection interface The bump of the QUIC library introduces a cyclic dependency between the connection and quic modules hence it is necessary to break this coupling. Right now, the connection module depends on the quic module for the datagram v2/v3 and to which a QUIC connection (currently an interface) is passed. As it is there is no issue however, under the hood, interface is a wrapper around an UDP connection and a QUIC connection meaning this type must be exposed to the quic module since the QUIC Connection will no longer be a interface but a struct. Given the above, these changes introduce an interface, QUICConnection, with the surface used today in cloudflared and a struct, ConnWithCloser, that implements said interface within the quic module. Closes TUN-10563

TUN-10413: Centralize TLS curve configuration in crypto/ and adopt X25519MLKEM768 for QUIC/H2 Introduce a new crypto/ package as the single source of truth for TLS curve preferences used on every edge-facing connection, and adopt X25519MLKEM768 as the primary post-quantum key exchange for both QUIC and HTTP/2: PQ Prefer (default): X25519MLKEM768, P256Kyber768Draft00, CurveP256 PQ Strict (--post-quantum): X25519MLKEM768, P256Kyber768Draft00 The curve list is identical under FIPS and non-FIPS builds, so crypto.GetCurvePreferences takes only a features.PostQuantumMode and returns a fresh slice on every call. HTTP/2 now applies these curve preferences the same way QUIC does. The previous PostQuantumStrict rejection in serveHTTP2 and the forced QUIC-only selection in NewProtocolSelector are removed since both transports support the same post-quantum curves; the needPQ parameter is dropped from NewProtocolSelector accordingly. Also fix a shared tls.Config race: both the QUIC and HTTP/2 paths now Clone() the per-protocol entry from TunnelConfig.EdgeTLSConfigs before mutating CurvePreferences instead of writing through the shared map entry. Legacy Kyber draft curve X25519Kyber768Draft00 and the unused removeDuplicates helper are removed along with the old supervisor/pqtunnels.go / _test.go files. AGENTS.md is updated with guidance on the new crypto/ package, the cfdcrypto import alias, the tls.Config cloning rule, and the lint workflow implications of .golangci.yaml's whole-files: true setting.

TUN-8960: Connect to FED API GW based on the OriginCert's endpoint ## Summary Within the scope of the FEDRamp High RM, it is necessary to detect if an user should connect to a FEDRamp colo. At first, it was considered to add the --fedramp as global flag however this could be a footgun for the user or even an hindrance, thus, the proposal is to save in the token (during login) if the user authenticated using the FEDRamp Dashboard. This solution makes it easier to the user as they will only be required to pass the flag in login and nothing else. * Introduces the new field, endpoint, in OriginCert * Refactors login to remove the private key and certificate which are no longer used * Login will only store the Argo Tunnel Token * Remove namedTunnelToken as it was only used to for serialization Closes TUN-8960

TUN-8855: fix lint issues ## Summary Fix lint issues necessary for a subsequent PR. This is only separate to allow a better code review of the actual changes. Closes TUN-8855

TUN-8855: Update PQ curve preferences ## Summary Nowadays, Cloudflared only supports X25519Kyber768Draft00 (0x6399,25497) but older versions may use different preferences. For FIPS compliance we are required to use P256Kyber768Draft00 (0xfe32,65074) which is supported in our internal fork of [Go-Boring-1.22.10](https://bitbucket.cfdata.org/projects/PLAT/repos/goboring/browse?at=refs/heads/go-boring/1.22.10 "Follow link"). In the near future, Go will support by default the X25519MLKEM768 (0x11ec,4588) given this we may drop the usage of our public fork of GO. To summarise: * Cloudflared FIPS: QUIC_CURVE_PREFERENCES=65074 * Cloudflared non-FIPS: QUIC_CURVE_PREFERENCES=4588 Closes TUN-8855

TUN-9583: set proper url and hostname for cloudflared tail command This commit adds support for FedRAMP environments. Cloudflared will now dynamically configure the management hostname and API URL, switching to FedRAMP-specific values like `management.fed.argotunnel.com` and `https://api.fed.cloudflare.com/client/v4` when a FedRAMP endpoint is detected. Key to this is an enhanced `ParseToken` function, which now includes an `IsFed()` method to determine if a management token's issuer is `fed-tunnelstore`. This allows cloudflared to correctly identify and operate within a FedRAMP context, ensuring proper connectivity. Closes TUN-9583

TUN-9161: Remove P256Kyber768Draft00PQKex curve from nonFips curve preferences Remove P256Kyber768Draft00PQKex curve from nonFips curve preferences and add tests to verify that the advertised curves are the same as the curve preferences we set. Closes TUN-9161

TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341 * TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341 Closes TUN-10216