From 0264a90fdd07e3f64988dd045a827ca39366c3af Mon Sep 17 00:00:00 2001
From: Caleb Doxsey <cdoxsey@pomerium.com>
Date: Mon, 23 Dec 2024 11:19:42 -0700
Subject: [PATCH 1/2] add udp support for desktop client

---
 api/listener_server.go      |  51 +++
 api/server.go               |   2 +
 proto/api.pb.go             | 839 +++++++++++++-----------------------
 proto/api.proto             |  11 +-
 proto/api_grpc.pb.go        | 123 +++---
 tunnel/tunnel_http3_test.go |   2 +-
 tunnel/tunnel_udp.go        |   5 +-
 tunnel/tunnel_udp_test.go   |   2 +-
 tunnel/urls.go              |   4 +-
 9 files changed, 443 insertions(+), 596 deletions(-)

diff --git a/api/listener_server.go b/api/listener_server.go
index 2a0f117..3f7c3db 100644
--- a/api/listener_server.go
+++ b/api/listener_server.go
@@ -11,6 +11,8 @@ import (
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/rs/zerolog/log"
+
 	pb "github.com/pomerium/cli/proto"
 )
 
@@ -70,6 +72,14 @@ func (s *server) connectTunnelLocked(id string) (net.Addr, error) {
 		return nil, err
 	}
 
+	if rec.GetConn().GetProtocol() == pb.Protocol_UDP {
+		return s.connectUDPTunnelLocked(id, tun, listenAddr)
+	}
+
+	return s.connectTCPTunnelLocked(id, tun, listenAddr)
+}
+
+func (s *server) connectTCPTunnelLocked(id string, tun Tunnel, listenAddr string) (net.Addr, error) {
 	ctx, cancel := context.WithCancel(context.Background())
 	lc := new(net.ListenConfig)
 	li, err := lc.Listen(ctx, "tcp", listenAddr)
@@ -98,6 +108,47 @@ func (s *server) connectTunnelLocked(id string) (net.Addr, error) {
 	return li.Addr(), nil
 }
 
+func (s *server) connectUDPTunnelLocked(id string, tun Tunnel, listenAddr string) (net.Addr, error) {
+	ctx, cancel := context.WithCancel(context.Background())
+
+	addr, err := net.ResolveUDPAddr("udp", listenAddr)
+	if err != nil {
+		_ = s.EventBroadcaster.Update(ctx, &pb.ConnectionStatusUpdate{
+			Id:        id,
+			LastError: proto.String(fmt.Errorf("ResolveUDPAddr: %w", err).Error()),
+			Ts:        timestamppb.Now(),
+		})
+		cancel()
+		return nil, err
+	}
+
+	conn, err := net.ListenUDP("udp", addr)
+	if err != nil {
+		_ = s.EventBroadcaster.Update(ctx, &pb.ConnectionStatusUpdate{
+			Id:        id,
+			LastError: proto.String(fmt.Errorf("ListenUDP: %w", err).Error()),
+			Ts:        timestamppb.Now(),
+		})
+		cancel()
+		return nil, err
+	}
+	context.AfterFunc(ctx, func() { _ = conn.Close() })
+
+	go func() {
+		defer cancel()
+		evt := (&tunnelEvents{EventBroadcaster: s.EventBroadcaster, id: id}).withPeer(conn)
+		defer evt.onTunnelClosed()
+		evt.onListening(ctx)
+
+		err := tun.RunUDPSessionManager(ctx, conn, evt)
+		if err != nil {
+			log.Ctx(ctx).Error().Err(err).Msg("error serving local connection")
+		}
+	}()
+
+	return addr, nil
+}
+
 func onContextCancel(ctx context.Context, cl io.Closer) {
 	<-ctx.Done()
 	_ = cl.Close()
diff --git a/api/server.go b/api/server.go
index f5d06b4..94ba6ee 100644
--- a/api/server.go
+++ b/api/server.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"net"
 	"sync"
 
 	"github.com/golang/groupcache/lru"
@@ -38,6 +39,7 @@ type ListenerStatus interface {
 // Tunnel is abstraction over tunnel.Tunnel to allow mocking
 type Tunnel interface {
 	Run(context.Context, io.ReadWriter, tunnel.EventSink) error
+	RunUDPSessionManager(ctx context.Context, conn *net.UDPConn, eventSink tunnel.EventSink) error
 }
 
 // Server implements both config and listener interfaces
diff --git a/proto/api.pb.go b/proto/api.pb.go
index bb7bacf..bb8e48e 100644
--- a/proto/api.pb.go
+++ b/proto/api.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.35.2
 // 	protoc        (unknown)
 // source: proto/api.proto
 
@@ -21,6 +21,55 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type Protocol int32
+
+const (
+	Protocol_UNKNOWN Protocol = 0
+	Protocol_TCP     Protocol = 1
+	Protocol_UDP     Protocol = 2
+)
+
+// Enum value maps for Protocol.
+var (
+	Protocol_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "TCP",
+		2: "UDP",
+	}
+	Protocol_value = map[string]int32{
+		"UNKNOWN": 0,
+		"TCP":     1,
+		"UDP":     2,
+	}
+)
+
+func (x Protocol) Enum() *Protocol {
+	p := new(Protocol)
+	*p = x
+	return p
+}
+
+func (x Protocol) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Protocol) Descriptor() protoreflect.EnumDescriptor {
+	return file_proto_api_proto_enumTypes[0].Descriptor()
+}
+
+func (Protocol) Type() protoreflect.EnumType {
+	return &file_proto_api_proto_enumTypes[0]
+}
+
+func (x Protocol) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Protocol.Descriptor instead.
+func (Protocol) EnumDescriptor() ([]byte, []int) {
+	return file_proto_api_proto_rawDescGZIP(), []int{0}
+}
+
 type ExportRequest_Format int32
 
 const (
@@ -54,11 +103,11 @@ func (x ExportRequest_Format) String() string {
 }
 
 func (ExportRequest_Format) Descriptor() protoreflect.EnumDescriptor {
-	return file_proto_api_proto_enumTypes[0].Descriptor()
+	return file_proto_api_proto_enumTypes[1].Descriptor()
 }
 
 func (ExportRequest_Format) Type() protoreflect.EnumType {
-	return &file_proto_api_proto_enumTypes[0]
+	return &file_proto_api_proto_enumTypes[1]
 }
 
 func (x ExportRequest_Format) Number() protoreflect.EnumNumber {
@@ -117,11 +166,11 @@ func (x ConnectionStatusUpdate_ConnectionStatus) String() string {
 }
 
 func (ConnectionStatusUpdate_ConnectionStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_proto_api_proto_enumTypes[1].Descriptor()
+	return file_proto_api_proto_enumTypes[2].Descriptor()
 }
 
 func (ConnectionStatusUpdate_ConnectionStatus) Type() protoreflect.EnumType {
-	return &file_proto_api_proto_enumTypes[1]
+	return &file_proto_api_proto_enumTypes[2]
 }
 
 func (x ConnectionStatusUpdate_ConnectionStatus) Number() protoreflect.EnumNumber {
@@ -148,11 +197,9 @@ type Record struct {
 
 func (x *Record) Reset() {
 	*x = Record{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Record) String() string {
@@ -163,7 +210,7 @@ func (*Record) ProtoMessage() {}
 
 func (x *Record) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -209,11 +256,9 @@ type Records struct {
 
 func (x *Records) Reset() {
 	*x = Records{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Records) String() string {
@@ -224,7 +269,7 @@ func (*Records) ProtoMessage() {}
 
 func (x *Records) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -264,11 +309,9 @@ type Selector struct {
 
 func (x *Selector) Reset() {
 	*x = Selector{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Selector) String() string {
@@ -279,7 +322,7 @@ func (*Selector) ProtoMessage() {}
 
 func (x *Selector) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -323,11 +366,9 @@ type DeleteRecordsResponse struct {
 
 func (x *DeleteRecordsResponse) Reset() {
 	*x = DeleteRecordsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeleteRecordsResponse) String() string {
@@ -338,7 +379,7 @@ func (*DeleteRecordsResponse) ProtoMessage() {}
 
 func (x *DeleteRecordsResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -368,11 +409,9 @@ type ExportRequest struct {
 
 func (x *ExportRequest) Reset() {
 	*x = ExportRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ExportRequest) String() string {
@@ -383,7 +422,7 @@ func (*ExportRequest) ProtoMessage() {}
 
 func (x *ExportRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -427,11 +466,9 @@ type GetTagsRequest struct {
 
 func (x *GetTagsRequest) Reset() {
 	*x = GetTagsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GetTagsRequest) String() string {
@@ -442,7 +479,7 @@ func (*GetTagsRequest) ProtoMessage() {}
 
 func (x *GetTagsRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -467,11 +504,9 @@ type GetTagsResponse struct {
 
 func (x *GetTagsResponse) Reset() {
 	*x = GetTagsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GetTagsResponse) String() string {
@@ -482,7 +517,7 @@ func (*GetTagsResponse) ProtoMessage() {}
 
 func (x *GetTagsResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -514,11 +549,9 @@ type ConfigData struct {
 
 func (x *ConfigData) Reset() {
 	*x = ConfigData{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ConfigData) String() string {
@@ -529,7 +562,7 @@ func (*ConfigData) ProtoMessage() {}
 
 func (x *ConfigData) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -567,11 +600,9 @@ type ImportRequest struct {
 
 func (x *ImportRequest) Reset() {
 	*x = ImportRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ImportRequest) String() string {
@@ -582,7 +613,7 @@ func (*ImportRequest) ProtoMessage() {}
 
 func (x *ImportRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -619,11 +650,9 @@ type ImportResponse struct {
 
 func (x *ImportResponse) Reset() {
 	*x = ImportResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ImportResponse) String() string {
@@ -634,7 +663,7 @@ func (*ImportResponse) ProtoMessage() {}
 
 func (x *ImportResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -661,11 +690,9 @@ type ListenerUpdateRequest struct {
 
 func (x *ListenerUpdateRequest) Reset() {
 	*x = ListenerUpdateRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListenerUpdateRequest) String() string {
@@ -676,7 +703,7 @@ func (*ListenerUpdateRequest) ProtoMessage() {}
 
 func (x *ListenerUpdateRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -717,11 +744,9 @@ type ListenerStatus struct {
 
 func (x *ListenerStatus) Reset() {
 	*x = ListenerStatus{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListenerStatus) String() string {
@@ -732,7 +757,7 @@ func (*ListenerStatus) ProtoMessage() {}
 
 func (x *ListenerStatus) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -778,11 +803,9 @@ type ListenerStatusResponse struct {
 
 func (x *ListenerStatusResponse) Reset() {
 	*x = ListenerStatusResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListenerStatusResponse) String() string {
@@ -793,7 +816,7 @@ func (*ListenerStatusResponse) ProtoMessage() {}
 
 func (x *ListenerStatusResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -825,11 +848,9 @@ type StatusUpdatesRequest struct {
 
 func (x *StatusUpdatesRequest) Reset() {
 	*x = StatusUpdatesRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StatusUpdatesRequest) String() string {
@@ -840,7 +861,7 @@ func (*StatusUpdatesRequest) ProtoMessage() {}
 
 func (x *StatusUpdatesRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -884,11 +905,9 @@ type ConnectionStatusUpdate struct {
 
 func (x *ConnectionStatusUpdate) Reset() {
 	*x = ConnectionStatusUpdate{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ConnectionStatusUpdate) String() string {
@@ -899,7 +918,7 @@ func (*ConnectionStatusUpdate) ProtoMessage() {}
 
 func (x *ConnectionStatusUpdate) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -981,11 +1000,9 @@ type KeyUsage struct {
 
 func (x *KeyUsage) Reset() {
 	*x = KeyUsage{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *KeyUsage) String() string {
@@ -996,7 +1013,7 @@ func (*KeyUsage) ProtoMessage() {}
 
 func (x *KeyUsage) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1107,11 +1124,9 @@ type Name struct {
 
 func (x *Name) Reset() {
 	*x = Name{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[16]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Name) String() string {
@@ -1122,7 +1137,7 @@ func (*Name) ProtoMessage() {}
 
 func (x *Name) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[16]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1231,11 +1246,9 @@ type CertificateInfo struct {
 
 func (x *CertificateInfo) Reset() {
 	*x = CertificateInfo{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[17]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CertificateInfo) String() string {
@@ -1246,7 +1259,7 @@ func (*CertificateInfo) ProtoMessage() {}
 
 func (x *CertificateInfo) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[17]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1422,11 +1435,9 @@ type Certificate struct {
 
 func (x *Certificate) Reset() {
 	*x = Certificate{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[18]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Certificate) String() string {
@@ -1437,7 +1448,7 @@ func (*Certificate) ProtoMessage() {}
 
 func (x *Certificate) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[18]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1488,11 +1499,9 @@ type ClientCertFromStore struct {
 
 func (x *ClientCertFromStore) Reset() {
 	*x = ClientCertFromStore{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[19]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ClientCertFromStore) String() string {
@@ -1503,7 +1512,7 @@ func (*ClientCertFromStore) ProtoMessage() {}
 
 func (x *ClientCertFromStore) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[19]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1540,6 +1549,8 @@ type Connection struct {
 
 	// name is a user friendly connection name that a user may define
 	Name *string `protobuf:"bytes,1,opt,name=name,proto3,oneof" json:"name,omitempty"`
+	// the protocol to use for the connection
+	Protocol *Protocol `protobuf:"varint,10,opt,name=protocol,proto3,enum=pomerium.cli.Protocol,oneof" json:"protocol,omitempty"`
 	// remote_addr is a remote pomerium host:port
 	RemoteAddr string `protobuf:"bytes,2,opt,name=remote_addr,json=remoteAddr,proto3" json:"remote_addr,omitempty"`
 	// listen_address, if not provided, will assign a random port each time
@@ -1558,11 +1569,9 @@ type Connection struct {
 
 func (x *Connection) Reset() {
 	*x = Connection{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_proto_api_proto_msgTypes[20]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_proto_api_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Connection) String() string {
@@ -1573,7 +1582,7 @@ func (*Connection) ProtoMessage() {}
 
 func (x *Connection) ProtoReflect() protoreflect.Message {
 	mi := &file_proto_api_proto_msgTypes[20]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1595,6 +1604,13 @@ func (x *Connection) GetName() string {
 	return ""
 }
 
+func (x *Connection) GetProtocol() Protocol {
+	if x != nil && x.Protocol != nil {
+		return *x.Protocol
+	}
+	return Protocol_UNKNOWN
+}
+
 func (x *Connection) GetRemoteAddr() string {
 	if x != nil {
 		return x.RemoteAddr
@@ -1912,82 +1928,89 @@ var file_proto_api_proto_rawDesc = []byte{
 	0x52, 0x0d, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x88,
 	0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f, 0x66, 0x69,
 	0x6c, 0x74, 0x65, 0x72, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0xf3, 0x03, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x6e,
+	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0xb9, 0x04, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x6e,
 	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x17, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12,
-	0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x41, 0x64, 0x64, 0x72,
-	0x12, 0x24, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x02, 0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x41,
-	0x64, 0x64, 0x72, 0x88, 0x01, 0x01, 0x12, 0x26, 0x0a, 0x0c, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69,
-	0x75, 0x6d, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x03, 0x52, 0x0b,
-	0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x3a,
-	0x0a, 0x18, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65,
-	0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
-	0x48, 0x00, 0x52, 0x16, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x54, 0x6c, 0x73, 0x56, 0x65,
-	0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x07, 0x63, 0x61,
-	0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x06, 0x63,
-	0x61, 0x43, 0x65, 0x72, 0x74, 0x12, 0x3f, 0x0a, 0x0b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
-	0x63, 0x65, 0x72, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x6f, 0x6d,
-	0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x48, 0x04, 0x52, 0x0a, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43,
-	0x65, 0x72, 0x74, 0x88, 0x01, 0x01, 0x12, 0x5b, 0x0a, 0x16, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x72, 0x6f, 0x6d, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75,
-	0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74,
-	0x46, 0x72, 0x6f, 0x6d, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x48, 0x05, 0x52, 0x13, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x46, 0x72, 0x6f, 0x6d, 0x53, 0x74, 0x6f, 0x72, 0x65,
-	0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x74, 0x6c, 0x73, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0e, 0x0a, 0x0c, 0x5f,
-	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x42, 0x0f, 0x0a, 0x0d, 0x5f,
-	0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x5f, 0x75, 0x72, 0x6c, 0x42, 0x0e, 0x0a, 0x0c,
-	0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x42, 0x19, 0x0a, 0x17,
-	0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x72, 0x6f,
-	0x6d, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x4a, 0x04, 0x08, 0x08, 0x10, 0x09, 0x32, 0x8a, 0x03,
-	0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x35, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74,
-	0x12, 0x16, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e,
-	0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x1a, 0x15, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72,
-	0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12,
-	0x45, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x16, 0x2e, 0x70, 0x6f, 0x6d, 0x65,
-	0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f,
-	0x72, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x06, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74,
-	0x12, 0x14, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x1a, 0x14, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75,
-	0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x46, 0x0a, 0x07,
-	0x47, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x12, 0x1c, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69,
-	0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d,
-	0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x06, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x1b,
-	0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x45, 0x78,
-	0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x70, 0x6f,
-	0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x44, 0x61, 0x74, 0x61, 0x12, 0x43, 0x0a, 0x06, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x12,
-	0x1b, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x49,
-	0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x70,
-	0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x49, 0x6d, 0x70, 0x6f,
-	0x72, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x87, 0x02, 0x0a, 0x08, 0x4c,
-	0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x53, 0x0a, 0x06, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75,
-	0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x53, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49, 0x0a, 0x09,
-	0x47, 0x65, 0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x16, 0x2e, 0x70, 0x6f, 0x6d, 0x65,
-	0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f,
-	0x72, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5b, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72,
-	0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70,
-	0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x43, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x30, 0x01, 0x42, 0x1f, 0x5a, 0x1d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2f, 0x63, 0x6c, 0x69, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x37, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69,
+	0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x48, 0x02, 0x52, 0x08, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f,
+	0x74, 0x65, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12, 0x24, 0x0a, 0x0b, 0x6c, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x03,
+	0x52, 0x0a, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x41, 0x64, 0x64, 0x72, 0x88, 0x01, 0x01, 0x12,
+	0x26, 0x0a, 0x0c, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x5f, 0x75, 0x72, 0x6c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x04, 0x52, 0x0b, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75,
+	0x6d, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x3a, 0x0a, 0x18, 0x64, 0x69, 0x73, 0x61, 0x62,
+	0x6c, 0x65, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x16, 0x64, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x54, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x07, 0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x12, 0x3f,
+	0x0a, 0x0b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63,
+	0x6c, 0x69, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x48, 0x05,
+	0x52, 0x0a, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x88, 0x01, 0x01, 0x12,
+	0x5b, 0x0a, 0x16, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66,
+	0x72, 0x6f, 0x6d, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x21, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x46, 0x72, 0x6f, 0x6d, 0x53, 0x74, 0x6f,
+	0x72, 0x65, 0x48, 0x06, 0x52, 0x13, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74,
+	0x46, 0x72, 0x6f, 0x6d, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a, 0x0b,
+	0x74, 0x6c, 0x73, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
+	0x6c, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x5f, 0x61, 0x64, 0x64,
+	0x72, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x5f, 0x75,
+	0x72, 0x6c, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65,
+	0x72, 0x74, 0x42, 0x19, 0x0a, 0x17, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65,
+	0x72, 0x74, 0x5f, 0x66, 0x72, 0x6f, 0x6d, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x4a, 0x04, 0x08,
+	0x08, 0x10, 0x09, 0x2a, 0x29, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
+	0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03,
+	0x54, 0x43, 0x50, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x02, 0x32, 0x8a,
+	0x03, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x35, 0x0a, 0x04, 0x4c, 0x69, 0x73,
+	0x74, 0x12, 0x16, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69,
+	0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x1a, 0x15, 0x2e, 0x70, 0x6f, 0x6d, 0x65,
+	0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
+	0x12, 0x45, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x16, 0x2e, 0x70, 0x6f, 0x6d,
+	0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c,
+	0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x06, 0x55, 0x70, 0x73, 0x65, 0x72,
+	0x74, 0x12, 0x14, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69,
+	0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x1a, 0x14, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69,
+	0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x46, 0x0a,
+	0x07, 0x47, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x12, 0x1c, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72,
+	0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75,
+	0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x67, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x06, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x12,
+	0x1b, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x45,
+	0x78, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x70,
+	0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x44, 0x61, 0x74, 0x61, 0x12, 0x43, 0x0a, 0x06, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74,
+	0x12, 0x1b, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e,
+	0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e,
+	0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x49, 0x6d, 0x70,
+	0x6f, 0x72, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x87, 0x02, 0x0a, 0x08,
+	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x53, 0x0a, 0x06, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c,
+	0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69,
+	0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49, 0x0a,
+	0x09, 0x47, 0x65, 0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x16, 0x2e, 0x70, 0x6f, 0x6d,
+	0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c,
+	0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5b, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6d, 0x65,
+	0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e,
+	0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2e, 0x63, 0x6c, 0x69, 0x2e, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x30, 0x01, 0x42, 0x1f, 0x5a, 0x1d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6f, 0x6d, 0x65, 0x72, 0x69, 0x75, 0x6d, 0x2f, 0x63, 0x6c, 0x69,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -2002,75 +2025,77 @@ func file_proto_api_proto_rawDescGZIP() []byte {
 	return file_proto_api_proto_rawDescData
 }
 
-var file_proto_api_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_proto_api_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
 var file_proto_api_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
-var file_proto_api_proto_goTypes = []interface{}{
-	(ExportRequest_Format)(0),                    // 0: pomerium.cli.ExportRequest.Format
-	(ConnectionStatusUpdate_ConnectionStatus)(0), // 1: pomerium.cli.ConnectionStatusUpdate.ConnectionStatus
-	(*Record)(nil),                               // 2: pomerium.cli.Record
-	(*Records)(nil),                              // 3: pomerium.cli.Records
-	(*Selector)(nil),                             // 4: pomerium.cli.Selector
-	(*DeleteRecordsResponse)(nil),                // 5: pomerium.cli.DeleteRecordsResponse
-	(*ExportRequest)(nil),                        // 6: pomerium.cli.ExportRequest
-	(*GetTagsRequest)(nil),                       // 7: pomerium.cli.GetTagsRequest
-	(*GetTagsResponse)(nil),                      // 8: pomerium.cli.GetTagsResponse
-	(*ConfigData)(nil),                           // 9: pomerium.cli.ConfigData
-	(*ImportRequest)(nil),                        // 10: pomerium.cli.ImportRequest
-	(*ImportResponse)(nil),                       // 11: pomerium.cli.ImportResponse
-	(*ListenerUpdateRequest)(nil),                // 12: pomerium.cli.ListenerUpdateRequest
-	(*ListenerStatus)(nil),                       // 13: pomerium.cli.ListenerStatus
-	(*ListenerStatusResponse)(nil),               // 14: pomerium.cli.ListenerStatusResponse
-	(*StatusUpdatesRequest)(nil),                 // 15: pomerium.cli.StatusUpdatesRequest
-	(*ConnectionStatusUpdate)(nil),               // 16: pomerium.cli.ConnectionStatusUpdate
-	(*KeyUsage)(nil),                             // 17: pomerium.cli.KeyUsage
-	(*Name)(nil),                                 // 18: pomerium.cli.Name
-	(*CertificateInfo)(nil),                      // 19: pomerium.cli.CertificateInfo
-	(*Certificate)(nil),                          // 20: pomerium.cli.Certificate
-	(*ClientCertFromStore)(nil),                  // 21: pomerium.cli.ClientCertFromStore
-	(*Connection)(nil),                           // 22: pomerium.cli.Connection
-	nil,                                          // 23: pomerium.cli.ListenerStatusResponse.ListenersEntry
-	(*timestamppb.Timestamp)(nil),                // 24: google.protobuf.Timestamp
+var file_proto_api_proto_goTypes = []any{
+	(Protocol)(0),                                // 0: pomerium.cli.Protocol
+	(ExportRequest_Format)(0),                    // 1: pomerium.cli.ExportRequest.Format
+	(ConnectionStatusUpdate_ConnectionStatus)(0), // 2: pomerium.cli.ConnectionStatusUpdate.ConnectionStatus
+	(*Record)(nil),                               // 3: pomerium.cli.Record
+	(*Records)(nil),                              // 4: pomerium.cli.Records
+	(*Selector)(nil),                             // 5: pomerium.cli.Selector
+	(*DeleteRecordsResponse)(nil),                // 6: pomerium.cli.DeleteRecordsResponse
+	(*ExportRequest)(nil),                        // 7: pomerium.cli.ExportRequest
+	(*GetTagsRequest)(nil),                       // 8: pomerium.cli.GetTagsRequest
+	(*GetTagsResponse)(nil),                      // 9: pomerium.cli.GetTagsResponse
+	(*ConfigData)(nil),                           // 10: pomerium.cli.ConfigData
+	(*ImportRequest)(nil),                        // 11: pomerium.cli.ImportRequest
+	(*ImportResponse)(nil),                       // 12: pomerium.cli.ImportResponse
+	(*ListenerUpdateRequest)(nil),                // 13: pomerium.cli.ListenerUpdateRequest
+	(*ListenerStatus)(nil),                       // 14: pomerium.cli.ListenerStatus
+	(*ListenerStatusResponse)(nil),               // 15: pomerium.cli.ListenerStatusResponse
+	(*StatusUpdatesRequest)(nil),                 // 16: pomerium.cli.StatusUpdatesRequest
+	(*ConnectionStatusUpdate)(nil),               // 17: pomerium.cli.ConnectionStatusUpdate
+	(*KeyUsage)(nil),                             // 18: pomerium.cli.KeyUsage
+	(*Name)(nil),                                 // 19: pomerium.cli.Name
+	(*CertificateInfo)(nil),                      // 20: pomerium.cli.CertificateInfo
+	(*Certificate)(nil),                          // 21: pomerium.cli.Certificate
+	(*ClientCertFromStore)(nil),                  // 22: pomerium.cli.ClientCertFromStore
+	(*Connection)(nil),                           // 23: pomerium.cli.Connection
+	nil,                                          // 24: pomerium.cli.ListenerStatusResponse.ListenersEntry
+	(*timestamppb.Timestamp)(nil),                // 25: google.protobuf.Timestamp
 }
 var file_proto_api_proto_depIdxs = []int32{
-	22, // 0: pomerium.cli.Record.conn:type_name -> pomerium.cli.Connection
-	2,  // 1: pomerium.cli.Records.records:type_name -> pomerium.cli.Record
-	4,  // 2: pomerium.cli.ExportRequest.selector:type_name -> pomerium.cli.Selector
-	0,  // 3: pomerium.cli.ExportRequest.format:type_name -> pomerium.cli.ExportRequest.Format
-	23, // 4: pomerium.cli.ListenerStatusResponse.listeners:type_name -> pomerium.cli.ListenerStatusResponse.ListenersEntry
-	1,  // 5: pomerium.cli.ConnectionStatusUpdate.status:type_name -> pomerium.cli.ConnectionStatusUpdate.ConnectionStatus
-	24, // 6: pomerium.cli.ConnectionStatusUpdate.ts:type_name -> google.protobuf.Timestamp
-	18, // 7: pomerium.cli.CertificateInfo.issuer:type_name -> pomerium.cli.Name
-	18, // 8: pomerium.cli.CertificateInfo.subject:type_name -> pomerium.cli.Name
-	24, // 9: pomerium.cli.CertificateInfo.not_before:type_name -> google.protobuf.Timestamp
-	24, // 10: pomerium.cli.CertificateInfo.not_after:type_name -> google.protobuf.Timestamp
-	17, // 11: pomerium.cli.CertificateInfo.key_usage:type_name -> pomerium.cli.KeyUsage
-	19, // 12: pomerium.cli.Certificate.info:type_name -> pomerium.cli.CertificateInfo
-	20, // 13: pomerium.cli.Connection.client_cert:type_name -> pomerium.cli.Certificate
-	21, // 14: pomerium.cli.Connection.client_cert_from_store:type_name -> pomerium.cli.ClientCertFromStore
-	13, // 15: pomerium.cli.ListenerStatusResponse.ListenersEntry.value:type_name -> pomerium.cli.ListenerStatus
-	4,  // 16: pomerium.cli.Config.List:input_type -> pomerium.cli.Selector
-	4,  // 17: pomerium.cli.Config.Delete:input_type -> pomerium.cli.Selector
-	2,  // 18: pomerium.cli.Config.Upsert:input_type -> pomerium.cli.Record
-	7,  // 19: pomerium.cli.Config.GetTags:input_type -> pomerium.cli.GetTagsRequest
-	6,  // 20: pomerium.cli.Config.Export:input_type -> pomerium.cli.ExportRequest
-	10, // 21: pomerium.cli.Config.Import:input_type -> pomerium.cli.ImportRequest
-	12, // 22: pomerium.cli.Listener.Update:input_type -> pomerium.cli.ListenerUpdateRequest
-	4,  // 23: pomerium.cli.Listener.GetStatus:input_type -> pomerium.cli.Selector
-	15, // 24: pomerium.cli.Listener.StatusUpdates:input_type -> pomerium.cli.StatusUpdatesRequest
-	3,  // 25: pomerium.cli.Config.List:output_type -> pomerium.cli.Records
-	5,  // 26: pomerium.cli.Config.Delete:output_type -> pomerium.cli.DeleteRecordsResponse
-	2,  // 27: pomerium.cli.Config.Upsert:output_type -> pomerium.cli.Record
-	8,  // 28: pomerium.cli.Config.GetTags:output_type -> pomerium.cli.GetTagsResponse
-	9,  // 29: pomerium.cli.Config.Export:output_type -> pomerium.cli.ConfigData
-	11, // 30: pomerium.cli.Config.Import:output_type -> pomerium.cli.ImportResponse
-	14, // 31: pomerium.cli.Listener.Update:output_type -> pomerium.cli.ListenerStatusResponse
-	14, // 32: pomerium.cli.Listener.GetStatus:output_type -> pomerium.cli.ListenerStatusResponse
-	16, // 33: pomerium.cli.Listener.StatusUpdates:output_type -> pomerium.cli.ConnectionStatusUpdate
-	25, // [25:34] is the sub-list for method output_type
-	16, // [16:25] is the sub-list for method input_type
-	16, // [16:16] is the sub-list for extension type_name
-	16, // [16:16] is the sub-list for extension extendee
-	0,  // [0:16] is the sub-list for field type_name
+	23, // 0: pomerium.cli.Record.conn:type_name -> pomerium.cli.Connection
+	3,  // 1: pomerium.cli.Records.records:type_name -> pomerium.cli.Record
+	5,  // 2: pomerium.cli.ExportRequest.selector:type_name -> pomerium.cli.Selector
+	1,  // 3: pomerium.cli.ExportRequest.format:type_name -> pomerium.cli.ExportRequest.Format
+	24, // 4: pomerium.cli.ListenerStatusResponse.listeners:type_name -> pomerium.cli.ListenerStatusResponse.ListenersEntry
+	2,  // 5: pomerium.cli.ConnectionStatusUpdate.status:type_name -> pomerium.cli.ConnectionStatusUpdate.ConnectionStatus
+	25, // 6: pomerium.cli.ConnectionStatusUpdate.ts:type_name -> google.protobuf.Timestamp
+	19, // 7: pomerium.cli.CertificateInfo.issuer:type_name -> pomerium.cli.Name
+	19, // 8: pomerium.cli.CertificateInfo.subject:type_name -> pomerium.cli.Name
+	25, // 9: pomerium.cli.CertificateInfo.not_before:type_name -> google.protobuf.Timestamp
+	25, // 10: pomerium.cli.CertificateInfo.not_after:type_name -> google.protobuf.Timestamp
+	18, // 11: pomerium.cli.CertificateInfo.key_usage:type_name -> pomerium.cli.KeyUsage
+	20, // 12: pomerium.cli.Certificate.info:type_name -> pomerium.cli.CertificateInfo
+	0,  // 13: pomerium.cli.Connection.protocol:type_name -> pomerium.cli.Protocol
+	21, // 14: pomerium.cli.Connection.client_cert:type_name -> pomerium.cli.Certificate
+	22, // 15: pomerium.cli.Connection.client_cert_from_store:type_name -> pomerium.cli.ClientCertFromStore
+	14, // 16: pomerium.cli.ListenerStatusResponse.ListenersEntry.value:type_name -> pomerium.cli.ListenerStatus
+	5,  // 17: pomerium.cli.Config.List:input_type -> pomerium.cli.Selector
+	5,  // 18: pomerium.cli.Config.Delete:input_type -> pomerium.cli.Selector
+	3,  // 19: pomerium.cli.Config.Upsert:input_type -> pomerium.cli.Record
+	8,  // 20: pomerium.cli.Config.GetTags:input_type -> pomerium.cli.GetTagsRequest
+	7,  // 21: pomerium.cli.Config.Export:input_type -> pomerium.cli.ExportRequest
+	11, // 22: pomerium.cli.Config.Import:input_type -> pomerium.cli.ImportRequest
+	13, // 23: pomerium.cli.Listener.Update:input_type -> pomerium.cli.ListenerUpdateRequest
+	5,  // 24: pomerium.cli.Listener.GetStatus:input_type -> pomerium.cli.Selector
+	16, // 25: pomerium.cli.Listener.StatusUpdates:input_type -> pomerium.cli.StatusUpdatesRequest
+	4,  // 26: pomerium.cli.Config.List:output_type -> pomerium.cli.Records
+	6,  // 27: pomerium.cli.Config.Delete:output_type -> pomerium.cli.DeleteRecordsResponse
+	3,  // 28: pomerium.cli.Config.Upsert:output_type -> pomerium.cli.Record
+	9,  // 29: pomerium.cli.Config.GetTags:output_type -> pomerium.cli.GetTagsResponse
+	10, // 30: pomerium.cli.Config.Export:output_type -> pomerium.cli.ConfigData
+	12, // 31: pomerium.cli.Config.Import:output_type -> pomerium.cli.ImportResponse
+	15, // 32: pomerium.cli.Listener.Update:output_type -> pomerium.cli.ListenerStatusResponse
+	15, // 33: pomerium.cli.Listener.GetStatus:output_type -> pomerium.cli.ListenerStatusResponse
+	17, // 34: pomerium.cli.Listener.StatusUpdates:output_type -> pomerium.cli.ConnectionStatusUpdate
+	26, // [26:35] is the sub-list for method output_type
+	17, // [17:26] is the sub-list for method input_type
+	17, // [17:17] is the sub-list for extension type_name
+	17, // [17:17] is the sub-list for extension extendee
+	0,  // [0:17] is the sub-list for field type_name
 }
 
 func init() { file_proto_api_proto_init() }
@@ -2078,268 +2103,14 @@ func file_proto_api_proto_init() {
 	if File_proto_api_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_proto_api_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Record); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Records); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Selector); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteRecordsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExportRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetTagsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetTagsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ConfigData); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ImportRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ImportResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListenerUpdateRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListenerStatus); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListenerStatusResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StatusUpdatesRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ConnectionStatusUpdate); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*KeyUsage); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Name); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CertificateInfo); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Certificate); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ClientCertFromStore); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_proto_api_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Connection); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	file_proto_api_proto_msgTypes[0].OneofWrappers = []interface{}{}
-	file_proto_api_proto_msgTypes[8].OneofWrappers = []interface{}{}
-	file_proto_api_proto_msgTypes[11].OneofWrappers = []interface{}{}
-	file_proto_api_proto_msgTypes[14].OneofWrappers = []interface{}{}
-	file_proto_api_proto_msgTypes[17].OneofWrappers = []interface{}{}
-	file_proto_api_proto_msgTypes[18].OneofWrappers = []interface{}{}
-	file_proto_api_proto_msgTypes[19].OneofWrappers = []interface{}{}
-	file_proto_api_proto_msgTypes[20].OneofWrappers = []interface{}{
+	file_proto_api_proto_msgTypes[0].OneofWrappers = []any{}
+	file_proto_api_proto_msgTypes[8].OneofWrappers = []any{}
+	file_proto_api_proto_msgTypes[11].OneofWrappers = []any{}
+	file_proto_api_proto_msgTypes[14].OneofWrappers = []any{}
+	file_proto_api_proto_msgTypes[17].OneofWrappers = []any{}
+	file_proto_api_proto_msgTypes[18].OneofWrappers = []any{}
+	file_proto_api_proto_msgTypes[19].OneofWrappers = []any{}
+	file_proto_api_proto_msgTypes[20].OneofWrappers = []any{
 		(*Connection_DisableTlsVerification)(nil),
 		(*Connection_CaCert)(nil),
 	}
@@ -2348,7 +2119,7 @@ func file_proto_api_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proto_api_proto_rawDesc,
-			NumEnums:      2,
+			NumEnums:      3,
 			NumMessages:   22,
 			NumExtensions: 0,
 			NumServices:   2,
diff --git a/proto/api.proto b/proto/api.proto
index 886ddac..1fe4ef2 100644
--- a/proto/api.proto
+++ b/proto/api.proto
@@ -85,7 +85,8 @@ service Listener {
   // StatusUpdates opens a stream to listen to connection status updates
   // a client has to subscribe and continuously
   // listen to the broadcasted updates
-  rpc StatusUpdates(StatusUpdatesRequest) returns (stream ConnectionStatusUpdate);
+  rpc StatusUpdates(StatusUpdatesRequest)
+      returns (stream ConnectionStatusUpdate);
 }
 
 message ListenerUpdateRequest {
@@ -211,10 +212,18 @@ message ClientCertFromStore {
   optional string subject_filter = 2;
 }
 
+enum Protocol {
+  UNKNOWN = 0;
+  TCP = 1;
+  UDP = 2;
+}
+
 // Connection
 message Connection {
   // name is a user friendly connection name that a user may define
   optional string name = 1;
+  // the protocol to use for the connection
+  optional Protocol protocol = 10;
   // remote_addr is a remote pomerium host:port
   string remote_addr = 2;
   // listen_address, if not provided, will assign a random port each time
diff --git a/proto/api_grpc.pb.go b/proto/api_grpc.pb.go
index e994d97..8257339 100644
--- a/proto/api_grpc.pb.go
+++ b/proto/api_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: proto/api.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	Config_List_FullMethodName    = "/pomerium.cli.Config/List"
@@ -30,6 +30,8 @@ const (
 // ConfigClient is the client API for Config service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Config represents desktop client configuration
 type ConfigClient interface {
 	// List returns records that match Selector
 	List(ctx context.Context, in *Selector, opts ...grpc.CallOption) (*Records, error)
@@ -55,8 +57,9 @@ func NewConfigClient(cc grpc.ClientConnInterface) ConfigClient {
 }
 
 func (c *configClient) List(ctx context.Context, in *Selector, opts ...grpc.CallOption) (*Records, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Records)
-	err := c.cc.Invoke(ctx, Config_List_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Config_List_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -64,8 +67,9 @@ func (c *configClient) List(ctx context.Context, in *Selector, opts ...grpc.Call
 }
 
 func (c *configClient) Delete(ctx context.Context, in *Selector, opts ...grpc.CallOption) (*DeleteRecordsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeleteRecordsResponse)
-	err := c.cc.Invoke(ctx, Config_Delete_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Config_Delete_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +77,9 @@ func (c *configClient) Delete(ctx context.Context, in *Selector, opts ...grpc.Ca
 }
 
 func (c *configClient) Upsert(ctx context.Context, in *Record, opts ...grpc.CallOption) (*Record, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Record)
-	err := c.cc.Invoke(ctx, Config_Upsert_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Config_Upsert_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -82,8 +87,9 @@ func (c *configClient) Upsert(ctx context.Context, in *Record, opts ...grpc.Call
 }
 
 func (c *configClient) GetTags(ctx context.Context, in *GetTagsRequest, opts ...grpc.CallOption) (*GetTagsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetTagsResponse)
-	err := c.cc.Invoke(ctx, Config_GetTags_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Config_GetTags_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -91,8 +97,9 @@ func (c *configClient) GetTags(ctx context.Context, in *GetTagsRequest, opts ...
 }
 
 func (c *configClient) Export(ctx context.Context, in *ExportRequest, opts ...grpc.CallOption) (*ConfigData, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ConfigData)
-	err := c.cc.Invoke(ctx, Config_Export_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Config_Export_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -100,8 +107,9 @@ func (c *configClient) Export(ctx context.Context, in *ExportRequest, opts ...gr
 }
 
 func (c *configClient) Import(ctx context.Context, in *ImportRequest, opts ...grpc.CallOption) (*ImportResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ImportResponse)
-	err := c.cc.Invoke(ctx, Config_Import_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Config_Import_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -110,7 +118,9 @@ func (c *configClient) Import(ctx context.Context, in *ImportRequest, opts ...gr
 
 // ConfigServer is the server API for Config service.
 // All implementations should embed UnimplementedConfigServer
-// for forward compatibility
+// for forward compatibility.
+//
+// Config represents desktop client configuration
 type ConfigServer interface {
 	// List returns records that match Selector
 	List(context.Context, *Selector) (*Records, error)
@@ -127,9 +137,12 @@ type ConfigServer interface {
 	Import(context.Context, *ImportRequest) (*ImportResponse, error)
 }
 
-// UnimplementedConfigServer should be embedded to have forward compatible implementations.
-type UnimplementedConfigServer struct {
-}
+// UnimplementedConfigServer should be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedConfigServer struct{}
 
 func (UnimplementedConfigServer) List(context.Context, *Selector) (*Records, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method List not implemented")
@@ -149,6 +162,7 @@ func (UnimplementedConfigServer) Export(context.Context, *ExportRequest) (*Confi
 func (UnimplementedConfigServer) Import(context.Context, *ImportRequest) (*ImportResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Import not implemented")
 }
+func (UnimplementedConfigServer) testEmbeddedByValue() {}
 
 // UnsafeConfigServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to ConfigServer will
@@ -158,6 +172,13 @@ type UnsafeConfigServer interface {
 }
 
 func RegisterConfigServer(s grpc.ServiceRegistrar, srv ConfigServer) {
+	// If the following call pancis, it indicates UnimplementedConfigServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Config_ServiceDesc, srv)
 }
 
@@ -314,6 +335,8 @@ const (
 // ListenerClient is the client API for Listener service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Listener service controls listeners
 type ListenerClient interface {
 	// Update alters connection status.
 	Update(ctx context.Context, in *ListenerUpdateRequest, opts ...grpc.CallOption) (*ListenerStatusResponse, error)
@@ -322,7 +345,7 @@ type ListenerClient interface {
 	// StatusUpdates opens a stream to listen to connection status updates
 	// a client has to subscribe and continuously
 	// listen to the broadcasted updates
-	StatusUpdates(ctx context.Context, in *StatusUpdatesRequest, opts ...grpc.CallOption) (Listener_StatusUpdatesClient, error)
+	StatusUpdates(ctx context.Context, in *StatusUpdatesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ConnectionStatusUpdate], error)
 }
 
 type listenerClient struct {
@@ -334,8 +357,9 @@ func NewListenerClient(cc grpc.ClientConnInterface) ListenerClient {
 }
 
 func (c *listenerClient) Update(ctx context.Context, in *ListenerUpdateRequest, opts ...grpc.CallOption) (*ListenerStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListenerStatusResponse)
-	err := c.cc.Invoke(ctx, Listener_Update_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Listener_Update_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -343,20 +367,22 @@ func (c *listenerClient) Update(ctx context.Context, in *ListenerUpdateRequest,
 }
 
 func (c *listenerClient) GetStatus(ctx context.Context, in *Selector, opts ...grpc.CallOption) (*ListenerStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListenerStatusResponse)
-	err := c.cc.Invoke(ctx, Listener_GetStatus_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Listener_GetStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *listenerClient) StatusUpdates(ctx context.Context, in *StatusUpdatesRequest, opts ...grpc.CallOption) (Listener_StatusUpdatesClient, error) {
-	stream, err := c.cc.NewStream(ctx, &Listener_ServiceDesc.Streams[0], Listener_StatusUpdates_FullMethodName, opts...)
+func (c *listenerClient) StatusUpdates(ctx context.Context, in *StatusUpdatesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ConnectionStatusUpdate], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Listener_ServiceDesc.Streams[0], Listener_StatusUpdates_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &listenerStatusUpdatesClient{stream}
+	x := &grpc.GenericClientStream[StatusUpdatesRequest, ConnectionStatusUpdate]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -366,26 +392,14 @@ func (c *listenerClient) StatusUpdates(ctx context.Context, in *StatusUpdatesReq
 	return x, nil
 }
 
-type Listener_StatusUpdatesClient interface {
-	Recv() (*ConnectionStatusUpdate, error)
-	grpc.ClientStream
-}
-
-type listenerStatusUpdatesClient struct {
-	grpc.ClientStream
-}
-
-func (x *listenerStatusUpdatesClient) Recv() (*ConnectionStatusUpdate, error) {
-	m := new(ConnectionStatusUpdate)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Listener_StatusUpdatesClient = grpc.ServerStreamingClient[ConnectionStatusUpdate]
 
 // ListenerServer is the server API for Listener service.
 // All implementations should embed UnimplementedListenerServer
-// for forward compatibility
+// for forward compatibility.
+//
+// Listener service controls listeners
 type ListenerServer interface {
 	// Update alters connection status.
 	Update(context.Context, *ListenerUpdateRequest) (*ListenerStatusResponse, error)
@@ -394,12 +408,15 @@ type ListenerServer interface {
 	// StatusUpdates opens a stream to listen to connection status updates
 	// a client has to subscribe and continuously
 	// listen to the broadcasted updates
-	StatusUpdates(*StatusUpdatesRequest, Listener_StatusUpdatesServer) error
+	StatusUpdates(*StatusUpdatesRequest, grpc.ServerStreamingServer[ConnectionStatusUpdate]) error
 }
 
-// UnimplementedListenerServer should be embedded to have forward compatible implementations.
-type UnimplementedListenerServer struct {
-}
+// UnimplementedListenerServer should be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedListenerServer struct{}
 
 func (UnimplementedListenerServer) Update(context.Context, *ListenerUpdateRequest) (*ListenerStatusResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Update not implemented")
@@ -407,9 +424,10 @@ func (UnimplementedListenerServer) Update(context.Context, *ListenerUpdateReques
 func (UnimplementedListenerServer) GetStatus(context.Context, *Selector) (*ListenerStatusResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetStatus not implemented")
 }
-func (UnimplementedListenerServer) StatusUpdates(*StatusUpdatesRequest, Listener_StatusUpdatesServer) error {
+func (UnimplementedListenerServer) StatusUpdates(*StatusUpdatesRequest, grpc.ServerStreamingServer[ConnectionStatusUpdate]) error {
 	return status.Errorf(codes.Unimplemented, "method StatusUpdates not implemented")
 }
+func (UnimplementedListenerServer) testEmbeddedByValue() {}
 
 // UnsafeListenerServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to ListenerServer will
@@ -419,6 +437,13 @@ type UnsafeListenerServer interface {
 }
 
 func RegisterListenerServer(s grpc.ServiceRegistrar, srv ListenerServer) {
+	// If the following call pancis, it indicates UnimplementedListenerServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Listener_ServiceDesc, srv)
 }
 
@@ -463,21 +488,11 @@ func _Listener_StatusUpdates_Handler(srv interface{}, stream grpc.ServerStream)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(ListenerServer).StatusUpdates(m, &listenerStatusUpdatesServer{stream})
+	return srv.(ListenerServer).StatusUpdates(m, &grpc.GenericServerStream[StatusUpdatesRequest, ConnectionStatusUpdate]{ServerStream: stream})
 }
 
-type Listener_StatusUpdatesServer interface {
-	Send(*ConnectionStatusUpdate) error
-	grpc.ServerStream
-}
-
-type listenerStatusUpdatesServer struct {
-	grpc.ServerStream
-}
-
-func (x *listenerStatusUpdatesServer) Send(m *ConnectionStatusUpdate) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Listener_StatusUpdatesServer = grpc.ServerStreamingServer[ConnectionStatusUpdate]
 
 // Listener_ServiceDesc is the grpc.ServiceDesc for Listener service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/tunnel/tunnel_http3_test.go b/tunnel/tunnel_http3_test.go
index be25f9a..51b8b1c 100644
--- a/tunnel/tunnel_http3_test.go
+++ b/tunnel/tunnel_http3_test.go
@@ -212,7 +212,7 @@ func TestUDPTunnelViaHTTP3(t *testing.T) {
 	require.NoError(t, err)
 
 	tunErrC := make(chan error, 1)
-	go func() { tunErrC <- tun.RunUDPSessionManager(ctx, tunnelConn) }()
+	go func() { tunErrC <- tun.RunUDPSessionManager(ctx, tunnelConn, LogEvents()) }()
 
 	// create the local connection
 
diff --git a/tunnel/tunnel_udp.go b/tunnel/tunnel_udp.go
index 48bc7a4..840dc26 100644
--- a/tunnel/tunnel_udp.go
+++ b/tunnel/tunnel_udp.go
@@ -70,14 +70,13 @@ func (tun *Tunnel) RunUDPListener(ctx context.Context, listenerAddress string) e
 	}
 	defer conn.Close()
 
-	err = tun.RunUDPSessionManager(ctx, conn)
+	err = tun.RunUDPSessionManager(ctx, conn, LogEvents())
 	log.Ctx(ctx).Error().Err(err).Msg("stopped udp listener")
 	return err
 }
 
-func (tun *Tunnel) RunUDPSessionManager(ctx context.Context, conn *net.UDPConn) error {
+func (tun *Tunnel) RunUDPSessionManager(ctx context.Context, conn *net.UDPConn, eventSink EventSink) error {
 	tunneler := newFallbackUDPTunneler(&http3tunneler{cfg: tun.cfg}, &http1tunneler{cfg: tun.cfg})
-	eventSink := LogEvents()
 	return newUDPSessionManager(conn, func(ctx context.Context, urw UDPDatagramReaderWriter) error {
 		return tun.runWithJWT(ctx, eventSink, func(ctx context.Context, rawJWT string) error {
 			// always disconnect after 10 minutes
diff --git a/tunnel/tunnel_udp_test.go b/tunnel/tunnel_udp_test.go
index c549621..0ac6c86 100644
--- a/tunnel/tunnel_udp_test.go
+++ b/tunnel/tunnel_udp_test.go
@@ -68,7 +68,7 @@ func TestUDPSessionManager(t *testing.T) {
 	require.NoError(t, err)
 
 	tunErrC := make(chan error, 1)
-	go func() { tunErrC <- tun.RunUDPSessionManager(ctx, tunnelConn) }()
+	go func() { tunErrC <- tun.RunUDPSessionManager(ctx, tunnelConn, LogEvents()) }()
 
 	localAddr, err := net.ResolveUDPAddr("udp", "127.0.0.1:"+localPort)
 	require.NoError(t, err)
diff --git a/tunnel/urls.go b/tunnel/urls.go
index 3878abf..a51e4b2 100644
--- a/tunnel/urls.go
+++ b/tunnel/urls.go
@@ -18,13 +18,13 @@ func ParseURLs(destination string, pomeriumURL string) (destinationAddr string,
 		if len(paths) == 0 {
 			destinationAddr = destinationURL.Host
 			proxyURL = &url.URL{
-				Scheme: strings.TrimPrefix(destinationURL.Scheme, "tcp+"),
+				Scheme: strings.TrimPrefix(strings.TrimPrefix(destinationURL.Scheme, "tcp+"), "udp+"),
 				Host:   destinationURL.Hostname(),
 			}
 		} else {
 			destinationAddr = paths[0]
 			proxyURL = &url.URL{
-				Scheme: strings.TrimPrefix(destinationURL.Scheme, "tcp+"),
+				Scheme: strings.TrimPrefix(strings.TrimPrefix(destinationURL.Scheme, "tcp+"), "udp+"),
 				Host:   destinationURL.Host,
 			}
 		}

From 0909095862f23d0a3283dbef1ece3e373ccc9bbe Mon Sep 17 00:00:00 2001
From: Caleb Doxsey <cdoxsey@pomerium.com>
Date: Thu, 26 Dec 2024 09:14:36 -0700
Subject: [PATCH 2/2] fix

---
 api/file_provider.go   | 2 +-
 api/listener_server.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/file_provider.go b/api/file_provider.go
index a5be781..cf7b611 100644
--- a/api/file_provider.go
+++ b/api/file_provider.go
@@ -24,5 +24,5 @@ func (f FileConfigProvider) Load() ([]byte, error) {
 
 // Save stores data to the file
 func (f FileConfigProvider) Save(data []byte) error {
-	return os.WriteFile(string(f), data, 0600)
+	return os.WriteFile(string(f), data, 0o600)
 }
diff --git a/api/listener_server.go b/api/listener_server.go
index 3f7c3db..19d5079 100644
--- a/api/listener_server.go
+++ b/api/listener_server.go
@@ -136,7 +136,7 @@ func (s *server) connectUDPTunnelLocked(id string, tun Tunnel, listenAddr string
 
 	go func() {
 		defer cancel()
-		evt := (&tunnelEvents{EventBroadcaster: s.EventBroadcaster, id: id}).withPeer(conn)
+		evt := &tunnelEvents{EventBroadcaster: s.EventBroadcaster, id: id}
 		defer evt.onTunnelClosed()
 		evt.onListening(ctx)