Add HTTP/SOCKS5 proxy support for Cloudflare edge connections

[Copilot]

cloudflared ignored proxy environment variables when establishing TCP connections to the Cloudflare edge, making it impossible to route tunnel traffic through a local proxy (e.g., mitmproxy, SOCKS5 proxy).

Changes

• edgediscovery/dial.go: Replace direct net.Dialer.DialContext with proxy.FromEnvironmentUsing(&dialer) from golang.org/x/net/proxy, which reads ALL_PROXY/all_proxy and NO_PROXY/no_proxy environment variables
  • Prefers proxy.ContextDialer path (used by both net.Dialer and the SOCKS5 dialer) to preserve context timeout semantics
  • Goroutine-based fallback for custom proxy types lacking ContextDialer support, ensuring the timeout is still honoured

Usage

# Route cloudflared edge connections through a SOCKS5 proxy
ALL_PROXY=socks5://127.0.0.1:1080 cloudflared tunnel run my-tunnel

# With authentication
ALL_PROXY=******proxy-host:1080 cloudflared tunnel run my-tunnel

When ALL_PROXY is unset, behaviour is identical to before.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• protocol-v2.argotunnel.com
  • Triggering command: /tmp/go-build2994755737/b001/edgediscovery.test /tmp/go-build2994755737/b001/edgediscovery.test -test.testlogfile=/tmp/go-build2994755737/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s memm�� /client.go /socks.go (dns block)
  • Triggering command: /tmp/go-build2992108656/b622/edgediscovery.test /tmp/go-build2992108656/b622/edgediscovery.test -test.testlogfile=/tmp/go-build2992108656/b622/testlog.txt -test.paniconexit0 -test.v=test2json -test.timeout=10m0s -test.v=true -trimpath (dns block)
• update.argotunnel.com
  • Triggering command: /tmp/go-build2992108656/b597/updater.test /tmp/go-build2992108656/b597/updater.test -test.testlogfile=/tmp/go-build2992108656/b597/testlog.txt -test.paniconexit0 -test.v=test2json -test.timeout=10m0s -test.v=true -trimpath (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.