TUN-10557: Bump quic-go v0.59.1

Bumps quic-go to v0.59.1 (chungthuang fork rebased from upstream v0.45 onto
v0.59.1). Upstream removed the `logging` package and replaced its
callback-based ConnectionTracer with the structured `qlog`/`qlogwriter` event
API, which required migrating cloudflared's QUIC metrics collection.

Migrations:

- quic/tracing.go: connTracer no longer fills a logging.ConnectionTracer
  callback struct. It implements qlogwriter.Trace + qlogwriter.Recorder and
  dispatches qlog events (PacketSent, PacketReceived, MetricsUpdated, ...) to
  the collector through RecordEvent. NewClientTracer now returns a function
  compatible with quic.Config.Tracer.

- quic/metrics.go: collector methods take qlog types (qlog.Frame,
  qlog.PacketType, qlog.MetricsUpdated, ...) and plain int64 in place of the
  removed logging.ByteCount/Frame/RTTStats/TransportParameters.

- quic/conversion.go: PacketType, PacketDropReason and PacketLossReason are
  strings upstream rather than numeric iotas, so the converters become
  pass-through allowlists. CongestionState is also a string;
  congestionStateToFloat maps it back to the numeric gauge values cloudflared
  exports.

- quic.Connection/quic.Stream became *quic.Conn/*quic.Stream; updated
  ConnWithCloser, SafeStreamCloser and the connection package accordingly.
  Tests and generated mocks (mocks/mock_quic_connection.go) were adapted to
  the new pointer-based API.

Closes TUN-10557

Author: lmpn

carrier/websocket_test.go

@@ -2,10 +2,11 @@ package carrier
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"math/rand"
+	"math/big"
 	"testing"
 	"time"
 
@@ -23,28 +24,19 @@ import (
 func websocketClientTLSConfig(t *testing.T) *tls.Config {
 	certPool := x509.NewCertPool()
 	helloCert, err := tlsconfig.GetHelloCertificateX509()
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	certPool.AddCert(helloCert)
 	assert.NotNil(t, certPool)
 	return &tls.Config{RootCAs: certPool}
 }
 
-func TestWebsocketHeaders(t *testing.T) {
-	req := testRequest(t, "http://example.com", nil)
-	wsHeaders := websocketHeaders(req)
-	for _, header := range stripWebsocketHeaders {
-		assert.Empty(t, wsHeaders[header])
-	}
-	assert.Equal(t, "curl/7.59.0", wsHeaders.Get("User-Agent"))
-}
-
 func TestServe(t *testing.T) {
 	log := zerolog.Nop()
 	shutdownC := make(chan struct{})
 	errC := make(chan error)
 	listener, err := hello.CreateTLSListener("localhost:1111")
-	assert.NoError(t, err)
-	defer listener.Close()
+	require.NoError(t, err)
+	defer func() { _ = listener.Close() }()
 
 	go func() {
 		errC <- hello.StartHelloWorldServer(&log, listener, shutdownC)
@@ -56,19 +48,25 @@ func TestServe(t *testing.T) {
 	assert.NotNil(t, tlsConfig)
 	d := gws.Dialer{TLSClientConfig: tlsConfig}
 	conn, resp, err := clientConnect(req, &d)
-	assert.NoError(t, err)
+	require.NoError(t, err)
+	defer func() { _ = resp.Body.Close() }()
 	assert.Equal(t, "websocket", resp.Header.Get("Upgrade"))
 
-	for i := 0; i < 1000; i++ {
-		messageSize := rand.Int()%2048 + 1
-		clientMessage := make([]byte, messageSize)
-		// rand.Read always returns len(clientMessage) and a nil error
-		rand.Read(clientMessage)
+	for range 1000 {
+		messageSize, err := rand.Int(rand.Reader, big.NewInt(2048))
+		require.NoError(t, err)
+		clientMessage := make([]byte, messageSize.Int64()+1)
+		for i := range clientMessage {
+			n, err := rand.Int(rand.Reader, big.NewInt(256))
+			n8 := uint8(n.Uint64()) //nolint:gosec // test-only
+			require.NoError(t, err)
+			clientMessage[i] = n8
+		}
 		err = conn.WriteMessage(websocket.BinaryFrame, clientMessage)
-		assert.NoError(t, err)
+		require.NoError(t, err)
 
 		messageType, message, err := conn.ReadMessage()
-		assert.NoError(t, err)
+		require.NoError(t, err)
 		assert.Equal(t, websocket.BinaryFrame, messageType)
 		assert.Equal(t, clientMessage, message)
 	}
@@ -97,27 +95,30 @@ func TestWebsocketWrapper(t *testing.T) {
 	req := testRequest(t, testAddr, nil)
 	conn, resp, err := clientConnect(req, &d)
 	require.NoError(t, err)
+	defer func() { _ = resp.Body.Close() }()
 	assert.Equal(t, "websocket", resp.Header.Get("Upgrade"))
 
 	// Websocket now connected to test server so lets check our wrapper
 	wrapper := cfwebsocket.GorillaConn{Conn: conn}
 	buf := make([]byte, 100)
-	wrapper.Write([]byte("abc"))
+	_, err = wrapper.Write([]byte("abc"))
+	require.NoError(t, err)
 	n, err := wrapper.Read(buf)
 	require.NoError(t, err)
-	require.Equal(t, n, 3)
+	require.Equal(t, 3, n)
 	require.Equal(t, "abc", string(buf[:n]))
 
 	// Test partial read, read 1 of 3 bytes in one read and the other 2 in another read
-	wrapper.Write([]byte("abc"))
+	_, err = wrapper.Write([]byte("abc"))
+	require.NoError(t, err)
 	buf = buf[:1]
 	n, err = wrapper.Read(buf)
 	require.NoError(t, err)
-	require.Equal(t, n, 1)
+	require.Equal(t, 1, n)
 	require.Equal(t, "a", string(buf[:n]))
 	buf = buf[:cap(buf)]
 	n, err = wrapper.Read(buf)
 	require.NoError(t, err)
-	require.Equal(t, n, 2)
+	require.Equal(t, 2, n)
 	require.Equal(t, "bc", string(buf[:n]))
 }

connection/quic_connection.go

@@ -143,7 +143,7 @@ func (q *quicConnection) Serve(ctx context.Context) error {
 }
 
 // serveControlStream will serve the RPC; blocking until the control plane is done.
-func (q *quicConnection) serveControlStream(ctx context.Context, controlStream quic.Stream) error {
+func (q *quicConnection) serveControlStream(ctx context.Context, controlStream *quic.Stream) error {
 	return q.controlStreamHandler.ServeControlStream(ctx, controlStream, q.connOptions.ConnectionOptions(), q.orchestrator)
 }
 
@@ -166,7 +166,7 @@ func (q *quicConnection) acceptStream(ctx context.Context) error {
 	}
 }
 
-func (q *quicConnection) runStream(quicStream quic.Stream) {
+func (q *quicConnection) runStream(quicStream *quic.Stream) {
 	ctx := quicStream.Context()
 	stream := cfdquic.NewSafeStreamCloser(quicStream, q.streamWriteTimeout, q.logger)
 	defer func() { _ = stream.Close() }()

connection/quic_connection_test.go

@@ -530,7 +530,7 @@ func TestServeUDPSession(t *testing.T) {
 	ctx, cancel := context.WithCancel(t.Context())
 
 	// Establish QUIC connection with edge
-	edgeQUICSessionChan := make(chan quic.Connection)
+	edgeQUICSessionChan := make(chan *quic.Conn)
 	go func() {
 		earlyListener, err := quic.Listen(udpListener, testTLSServerConfig, testQUICConfig)
 		assert.NoError(t, err)
@@ -779,7 +779,7 @@ func TestDialQuicWithSkipPortReuse(t *testing.T) {
 	<-serverDone
 }
 
-func serveSession(ctx context.Context, datagramConn *datagramV2Connection, edgeQUICSession quic.Connection, closeType closeReason, expectedReason string, t *testing.T) {
+func serveSession(ctx context.Context, datagramConn *datagramV2Connection, edgeQUICSession cfdquic.QUICConnection, closeType closeReason, expectedReason string, t *testing.T) {
 	payload := []byte(t.Name())
 	sessionID := uuid.New()
 	cfdConn, originConn := net.Pipe()
@@ -843,7 +843,7 @@ const (
 	closedByTimeout
 )
 
-func runRPCServer(ctx context.Context, session quic.Connection, sessionRPCServer pogs.SessionManager, configRPCServer pogs.ConfigurationManager, t *testing.T) {
+func runRPCServer(ctx context.Context, session cfdquic.QUICConnection, sessionRPCServer pogs.SessionManager, configRPCServer pogs.ConfigurationManager, t *testing.T) {
 	stream, err := session.AcceptStream(ctx)
 	require.NoError(t, err)
 

connection/quic_datagram_v2.go

@@ -8,7 +8,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	pkgerrors "github.com/pkg/errors"
+	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
@@ -22,7 +22,7 @@ import (
 	"github.com/cloudflare/cloudflared/packet"
 	cfdquic "github.com/cloudflare/cloudflared/quic"
 	"github.com/cloudflare/cloudflared/tracing"
-	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
+	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	rpcquic "github.com/cloudflare/cloudflared/tunnelrpc/quic"
 )
 
@@ -31,14 +31,14 @@ const (
 	demuxChanCapacity = 16
 )
 
-var errInvalidDestinationIP = pkgerrors.New("unable to parse destination IP")
+var errInvalidDestinationIP = errors.New("unable to parse destination IP")
 
 // DatagramSessionHandler is a service that can serve datagrams for a connection and handle sessions from incoming
 // connection streams.
 type DatagramSessionHandler interface {
 	Serve(context.Context) error
 
-	tunnelpogs.SessionManager
+	pogs.SessionManager
 }
 
 type datagramV2Connection struct {
@@ -111,7 +111,7 @@ func (d *datagramV2Connection) Serve(ctx context.Context) error {
 }
 
 // RegisterUdpSession is the RPC method invoked by edge to register and run a session
-func (q *datagramV2Connection) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeAfterIdleHint time.Duration, traceContext string) (*tunnelpogs.RegisterUdpSessionResponse, error) {
+func (q *datagramV2Connection) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeAfterIdleHint time.Duration, traceContext string) (*pogs.RegisterUdpSessionResponse, error) {
 	traceCtx := tracing.NewTracedContext(ctx, traceContext, q.logger)
 	ctx, registerSpan := traceCtx.Tracer().Start(traceCtx, "register-session", trace.WithAttributes(
 		attribute.String("session-id", sessionID.String()),
@@ -123,7 +123,7 @@ func (q *datagramV2Connection) RegisterUdpSession(ctx context.Context, sessionID
 	if err := q.flowLimiter.Acquire(management.UDP.String()); err != nil {
 		log.Warn().Msgf("Too many concurrent sessions being handled, rejecting udp proxy to %s:%d", dstIP, dstPort)
 
-		err := pkgerrors.Wrap(err, "failed to start udp session due to rate limiting")
+		err := errors.Wrap(err, "failed to start udp session due to rate limiting")
 		tracing.EndWithErrorStatus(registerSpan, err)
 		return nil, err
 	}
@@ -180,7 +180,7 @@ func (q *datagramV2Connection) RegisterUdpSession(ctx context.Context, sessionID
 		Msgf("Registered session")
 	tracing.End(registerSpan)
 
-	resp := tunnelpogs.RegisterUdpSessionResponse{
+	resp := pogs.RegisterUdpSessionResponse{
 		Spans: traceCtx.GetProtoSpans(),
 	}
 

connection/quic_datagram_v2_test.go

@@ -1,13 +1,11 @@
 package connection
 
 import (
-	"context"
 	"net"
 	"testing"
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/quic-go/quic-go"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
@@ -16,73 +14,15 @@ import (
 	"github.com/cloudflare/cloudflared/mocks"
 )
 
-type mockQuicConnection struct{}
-
-func (m *mockQuicConnection) AcceptStream(_ context.Context) (quic.Stream, error) {
-	return nil, nil
-}
-
-func (m *mockQuicConnection) AcceptUniStream(_ context.Context) (quic.ReceiveStream, error) {
-	return nil, nil
-}
-
-func (m *mockQuicConnection) OpenStream() (quic.Stream, error) {
-	return nil, nil
-}
-
-func (m *mockQuicConnection) OpenStreamSync(_ context.Context) (quic.Stream, error) {
-	return nil, nil
-}
-
-func (m *mockQuicConnection) OpenUniStream() (quic.SendStream, error) {
-	return nil, nil
-}
-
-func (m *mockQuicConnection) OpenUniStreamSync(_ context.Context) (quic.SendStream, error) {
-	return nil, nil
-}
-
-func (m *mockQuicConnection) LocalAddr() net.Addr {
-	return nil
-}
-
-func (m *mockQuicConnection) RemoteAddr() net.Addr {
-	return nil
-}
-
-func (m *mockQuicConnection) CloseWithError(_ quic.ApplicationErrorCode, s string) error {
-	return nil
-}
-
-func (m *mockQuicConnection) Context() context.Context {
-	return nil
-}
-
-func (m *mockQuicConnection) ConnectionState() quic.ConnectionState {
-	panic("not meant to be called")
-}
-
-func (m *mockQuicConnection) SendDatagram(_ []byte) error {
-	return nil
-}
-
-func (m *mockQuicConnection) ReceiveDatagram(_ context.Context) ([]byte, error) {
-	return nil, nil
-}
-
-func (m *mockQuicConnection) AddPath(*quic.Transport) (*quic.Path, error) {
-	return nil, nil
-}
-
 func TestRateLimitOnNewDatagramV2UDPSession(t *testing.T) {
 	log := zerolog.Nop()
-	conn := &mockQuicConnection{}
 	ctrl := gomock.NewController(t)
 	flowLimiterMock := mocks.NewMockLimiter(ctrl)
+	connMock := mocks.NewMockQUICConnection(ctrl)
 
 	datagramConn := NewDatagramV2Connection(
 		t.Context(),
-		conn,
+		connMock,
 		nil,
 		nil,
 		0,

connection/quic_datagram_v3.go

@@ -12,7 +12,7 @@ import (
 	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/management"
 	cfdquic "github.com/cloudflare/cloudflared/quic"
-	cfdquicv3 "github.com/cloudflare/cloudflared/quic/v3"
+	v3 "github.com/cloudflare/cloudflared/quic/v3"
 	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 
@@ -25,25 +25,25 @@ type datagramV3Connection struct {
 	conn  cfdquic.QUICConnection
 	index uint8
 	// datagramMuxer mux/demux datagrams from quic connection
-	datagramMuxer cfdquicv3.DatagramConn
-	metrics       cfdquicv3.Metrics
+	datagramMuxer v3.DatagramConn
+	metrics       v3.Metrics
 	logger        *zerolog.Logger
 }
 
 func NewDatagramV3Connection(ctx context.Context,
 	conn cfdquic.QUICConnection,
-	sessionManager cfdquicv3.SessionManager,
+	sessionManager v3.SessionManager,
 	icmpRouter ingress.ICMPRouter,
 	index uint8,
-	metrics cfdquicv3.Metrics,
+	metrics v3.Metrics,
 	logger *zerolog.Logger,
 ) DatagramSessionHandler {
 	log := logger.
 		With().
 		Int(management.EventTypeKey, int(management.UDP)).
 		Uint8(LogFieldConnIndex, index).
 		Logger()
-	datagramMuxer := cfdquicv3.NewDatagramConn(conn, sessionManager, icmpRouter, index, metrics, &log)
+	datagramMuxer := v3.NewDatagramConn(conn, sessionManager, icmpRouter, index, metrics, &log)
 
 	return &datagramV3Connection{
 		conn,

go.mod

@@ -23,7 +23,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.22.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/quic-go/quic-go v0.52.0
+	github.com/quic-go/quic-go v0.59.1
 	github.com/rs/zerolog v1.20.0
 	github.com/shirou/gopsutil/v4 v4.26.3
 	github.com/stretchr/testify v1.11.1
@@ -35,7 +35,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0
 	go.opentelemetry.io/proto/otlp v1.10.0
 	go.uber.org/automaxprocs v1.6.0
-	go.uber.org/mock v0.5.1
+	go.uber.org/mock v0.5.2
 	golang.org/x/crypto v0.52.0
 	golang.org/x/net v0.55.0
 	golang.org/x/sync v0.20.0
@@ -65,10 +65,8 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-playground/validator/v10 v10.15.1 // indirect
-	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/google/pprof v0.0.0-20250418163039-24c5476c6587 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
@@ -77,7 +75,6 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/onsi/ginkgo/v2 v2.23.4 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.9 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
@@ -108,5 +105,4 @@ replace github.com/prometheus/golang_client => github.com/prometheus/golang_clie
 
 replace gopkg.in/yaml.v3 => gopkg.in/yaml.v3 v3.0.1
 
-// This fork is based on quic-go v0.45
-replace github.com/quic-go/quic-go => github.com/chungthuang/quic-go v0.45.1-0.20250428085412-43229ad201fd
+replace github.com/quic-go/quic-go => github.com/chungthuang/quic-go v0.45.1-0.20260529212404-a9fddf436fc4 // This fork is based on quic-go v0.59.1