Merge lp:~pedronis/ubuntu-push/be-nice into lp:ubuntu-push

[Samuele Pedroni]

update README, Makefile with more targets, move sample dev config to sampleconfigs

update README, Makefile with more targets, move sample dev config to sampleconfigs

[lp:~pedronis/ubuntu-push/be-nice]

101. By Samuele Pedroni on 2014-03-31

newline

102. By Samuele Pedroni on 2014-03-31

api port => 8080

103. By Samuele Pedroni on 2014-03-31

final tweaks

Unmerged revisions

=== modified file '.bzrignore'
--- .bzrignore	2014-02-07 19:36:38 +0000
+++ .bzrignore	2014-03-31 16:43:44 +0000
@@ -11,3 +11,5 @@
 debian/*.ex
 debian/*.EX
 debian/*.substvars
+ubuntu-push-client
+push-server-dev
 
=== modified file 'Makefile'
--- Makefile	2014-03-12 13:23:26 +0000
+++ Makefile	2014-03-31 16:43:44 +0000
@@ -12,6 +12,8 @@
 GODEPS += launchpad.net/go-xdg/v0
 GODEPS += code.google.com/p/gosqlite/sqlite3
 
+TOTEST = $(shell env GOPATH=$(GOPATH) go list $(PROJECT)/...|grep -v acceptance{|grep -v http13client )
+
 bootstrap:
 	mkdir -p $(GOPATH)/bin
 	mkdir -p $(GOPATH)/pkg
@@ -21,17 +23,26 @@
 	go install $(GODEPS)
 
 check:
-	go test $(TESTFLAGS) $(PROJECT)/...
+	go test $(TESTFLAGS) $(TOTEST)
 
 check-race:
-	go test $(TESTFLAGS) -race $(PROJECT)/...
+	go test $(TESTFLAGS) -race $(TOTEST)
+
+acceptance:
+	cd server/acceptance; ./acceptance.sh
+
+build-client:
+	go build ubuntu-push-client.go
+
+build-server-dev:
+	go build -o push-server-dev launchpad.net/ubuntu-push/server/dev
 
 coverage-summary:
-	go test $(TESTFLAGS) -a -cover $(PROJECT)/...
+	go test $(TESTFLAGS) -a -cover $(TOTEST)
 
 coverage-html:
 	mkdir -p coverhtml
-	for pkg in $$(go list $(PROJECT)/...|grep -v acceptance ); do \
+	for pkg in $(TOTEST); do \
 		relname="$${pkg#$(PROJECT)/}" ; \
 		mkdir -p coverhtml/$$(dirname $${relname}) ; \
 		go test $(TESTFLAGS) -a -coverprofile=coverhtml/$${relname}.out $$pkg ; \
@@ -52,5 +63,6 @@
 	# requires graphviz installed
 	dot -Tsvg $< > $@
 
-.PHONY: bootstrap check check-race format check-format coverage-summary \
-	coverage-html protocol-diagrams
+.PHONY: bootstrap check check-race format check-format \
+	acceptance build-client bluild-server-dev \
+	coverage-summary coverage-html protocol-diagrams
 
=== modified file 'README'
--- README	2014-02-21 16:17:28 +0000
+++ README	2014-03-31 16:43:44 +0000
@@ -15,8 +15,7 @@
    make check
 
 To produce coverage reports you need Go 1.2 (default on Trusty) and
-the cover tool (the latter can be obtained atm with something like:
-sudo GOPATH=<go-workspace> go get code.google.com/p/go.tools/cmd/cover ),
+the cover tool (in the golang-go.tools package),
 then run:
 
    make coverage-summary
@@ -31,4 +30,14 @@
 
 To run the acceptance tests, change to the acceptance subdir and run:
 
-   ./acceptance.sh
+  make acceptance
+
+There are build targets to build the client:
+
+  make build-client
+
+building ubuntu-push-client, and the development server:
+
+  make build-server-dev
+
+building push-server-dev.
 \ No newline at end of file
 
=== modified file 'client/client.go'
--- client/client.go	2014-03-26 16:26:36 +0000
+++ client/client.go	2014-03-31 16:43:44 +0000
@@ -20,9 +20,14 @@
 
 import (
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io/ioutil"
+	"os"
+	"strings"
+
 	"launchpad.net/go-dbus/v1"
+
 	"launchpad.net/ubuntu-push/bus"
 	"launchpad.net/ubuntu-push/bus/connectivity"
 	"launchpad.net/ubuntu-push/bus/networkmanager"
@@ -34,7 +39,6 @@
 	"launchpad.net/ubuntu-push/logger"
 	"launchpad.net/ubuntu-push/util"
 	"launchpad.net/ubuntu-push/whoopsie/identifier"
-	"os"
 )
 
 // ClientConfig holds the client configuration
@@ -42,8 +46,13 @@
 	connectivity.ConnectivityConfig // q.v.
 	// A reasonably large timeout for receive/answer pairs
 	ExchangeTimeout config.ConfigTimeDuration `json:"exchange_timeout"`
-	// The server to connect to
-	Addr config.ConfigHostPort
+	// A timeout to use when trying to connect to the server
+	ConnectTimeout config.ConfigTimeDuration `json:"connect_timeout"`
+	// The server to connect to or url to query for hosts to connect to
+	Addr string
+	// Host list management
+	HostsCachingExpiryTime config.ConfigTimeDuration `json:"hosts_cache_expiry"`  // potentially refresh host list after
+	ExpectAllRepairedTime  config.ConfigTimeDuration `json:"expect_all_repaired"` // worth retrying all servers after
 	// The PEM-encoded server certificate
 	CertPEMFile string `json:"cert_pem_file"`
 	// The logging level (one of "debug", "info", "error")
@@ -89,6 +98,12 @@
 	if err != nil {
 		return fmt.Errorf("reading config: %v", err)
 	}
+	// ignore spaces
+	client.config.Addr = strings.Replace(client.config.Addr, " ", "", -1)
+	if client.config.Addr == "" {
+		return errors.New("no hosts specified")
+	}
+
 	// later, we'll be specifying more logging options in the config file
 	client.log = logger.NewSimpleLogger(os.Stderr, client.config.LogLevel)
 
@@ -116,6 +131,17 @@
 	return nil
 }
 
+// deriveSessionConfig dervies the session configuration from the client configuration bits.
+func (client *PushClient) deriveSessionConfig() session.ClientSessionConfig {
+	return session.ClientSessionConfig{
+		ConnectTimeout:         client.config.ConnectTimeout.TimeDuration(),
+		ExchangeTimeout:        client.config.ExchangeTimeout.TimeDuration(),
+		HostsCachingExpiryTime: client.config.HostsCachingExpiryTime.TimeDuration(),
+		ExpectAllRepairedTime:  client.config.ExpectAllRepairedTime.TimeDuration(),
+		PEM: client.pem,
+	}
+}
+
 // getDeviceId gets the whoopsie identifier for the device
 func (client *PushClient) getDeviceId() error {
 	err := client.idder.Generate()
@@ -143,8 +169,8 @@
 
 // initSession creates the session object
 func (client *PushClient) initSession() error {
-	sess, err := session.NewSession(string(client.config.Addr), client.pem,
-		client.config.ExchangeTimeout.Duration, client.deviceId,
+	sess, err := session.NewSession(client.config.Addr,
+		client.deriveSessionConfig(), client.deviceId,
 		client.levelMapFactory, client.log)
 	if err != nil {
 		return err
 
=== modified file 'client/client_test.go'
--- client/client_test.go	2014-03-26 16:26:36 +0000
+++ client/client_test.go	2014-03-31 16:43:44 +0000
@@ -17,10 +17,19 @@
 package client
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"reflect"
+	"testing"
+	"time"
+
 	. "launchpad.net/gocheck"
+
 	"launchpad.net/ubuntu-push/bus"
 	"launchpad.net/ubuntu-push/bus/networkmanager"
 	"launchpad.net/ubuntu-push/bus/notifications"
@@ -32,11 +41,6 @@
 	"launchpad.net/ubuntu-push/util"
 	"launchpad.net/ubuntu-push/whoopsie/identifier"
 	idtesting "launchpad.net/ubuntu-push/whoopsie/identifier/testing"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"testing"
-	"time"
 )
 
 func TestClient(t *testing.T) { TestingT(t) }
@@ -83,22 +87,37 @@
 	cs.timeouts = nil
 }
 
+func (cs *clientSuite) writeTestConfig(overrides map[string]interface{}) {
+	pem_file := helpers.SourceRelative("../server/acceptance/ssl/testing.cert")
+	cfgMap := map[string]interface{}{
+		"connect_timeout":        "7ms",
+		"exchange_timeout":       "10ms",
+		"hosts_cache_expiry":     "1h",
+		"expect_all_repaired":    "30m",
+		"stabilizing_timeout":    "0ms",
+		"connectivity_check_url": "",
+		"connectivity_check_md5": "",
+		"addr":            ":0",
+		"cert_pem_file":   pem_file,
+		"recheck_timeout": "3h",
+		"log_level":       "debug",
+	}
+	for k, v := range overrides {
+		cfgMap[k] = v
+	}
+	cfgBlob, err := json.Marshal(cfgMap)
+	if err != nil {
+		panic(err)
+	}
+	ioutil.WriteFile(cs.configPath, cfgBlob, 0600)
+}
+
 func (cs *clientSuite) SetUpTest(c *C) {
 	cs.log = helpers.NewTestLogger(c, "debug")
 	dir := c.MkDir()
 	cs.configPath = filepath.Join(dir, "config")
-	cfg := fmt.Sprintf(`
-{
-    "exchange_timeout": "10ms",
-    "stabilizing_timeout": "0ms",
-    "connectivity_check_url": "",
-    "connectivity_check_md5": "",
-    "addr": ":0",
-    "cert_pem_file": %#v,
-    "recheck_timeout": "3h",
-    "log_level": "debug"
-}`, helpers.SourceRelative("../server/acceptance/config/testing.cert"))
-	ioutil.WriteFile(cs.configPath, []byte(cfg), 0600)
+
+	cs.writeTestConfig(nil)
 }
 
 type sqlientSuite struct{ clientSuite }
@@ -119,7 +138,7 @@
 	err := cli.configure()
 	c.Assert(err, IsNil)
 	c.Assert(cli.config, NotNil)
-	c.Check(cli.config.ExchangeTimeout.Duration, Equals, time.Duration(10*time.Millisecond))
+	c.Check(cli.config.ExchangeTimeout.TimeDuration(), Equals, time.Duration(10*time.Millisecond))
 }
 
 func (cs *clientSuite) TestConfigureSetsUpLog(c *C) {
@@ -179,41 +198,70 @@
 }
 
 func (cs *clientSuite) TestConfigureBailsOnBadPEMFilename(c *C) {
-	ioutil.WriteFile(cs.configPath, []byte(`
-{
-    "exchange_timeout": "10ms",
-    "stabilizing_timeout": "0ms",
-    "connectivity_check_url": "",
-    "connectivity_check_md5": "",
-    "addr": ":0",
-    "cert_pem_file": "/a/b/c",
-    "log_level": "debug",
-    "recheck_timeout": "3h"
-}`), 0600)
-
+	cs.writeTestConfig(map[string]interface{}{
+		"cert_pem_file": "/a/b/c",
+	})
 	cli := NewPushClient(cs.configPath, cs.leveldbPath)
 	err := cli.configure()
 	c.Assert(err, ErrorMatches, "reading PEM file: .*")
 }
 
 func (cs *clientSuite) TestConfigureBailsOnBadPEM(c *C) {
-	ioutil.WriteFile(cs.configPath, []byte(`
-{
-    "exchange_timeout": "10ms",
-    "stabilizing_timeout": "0ms",
-    "connectivity_check_url": "",
-    "connectivity_check_md5": "",
-    "addr": ":0",
-    "cert_pem_file": "/etc/passwd",
-    "log_level": "debug",
-    "recheck_timeout": "3h"
-}`), 0600)
-
+	cs.writeTestConfig(map[string]interface{}{
+		"cert_pem_file": "/etc/passwd",
+	})
 	cli := NewPushClient(cs.configPath, cs.leveldbPath)
 	err := cli.configure()
 	c.Assert(err, ErrorMatches, "no PEM found.*")
 }
 
+func (cs *clientSuite) TestConfigureBailsOnNoHosts(c *C) {
+	cs.writeTestConfig(map[string]interface{}{
+		"addr": "  ",
+	})
+	cli := NewPushClient(cs.configPath, cs.leveldbPath)
+	err := cli.configure()
+	c.Assert(err, ErrorMatches, "no hosts specified")
+}
+
+func (cs *clientSuite) TestConfigureRemovesBlanksInAddr(c *C) {
+	cs.writeTestConfig(map[string]interface{}{
+		"addr": " foo: 443",
+	})
+	cli := NewPushClient(cs.configPath, cs.leveldbPath)
+	err := cli.configure()
+	c.Assert(err, IsNil)
+	c.Check(cli.config.Addr, Equals, "foo:443")
+}
+
+/*****************************************************************
+    deriveSessionConfig tests
+******************************************************************/
+
+func (cs *clientSuite) TestDeriveSessionConfig(c *C) {
+	cli := NewPushClient(cs.configPath, cs.leveldbPath)
+	err := cli.configure()
+	c.Assert(err, IsNil)
+	expected := session.ClientSessionConfig{
+		ConnectTimeout:         7 * time.Millisecond,
+		ExchangeTimeout:        10 * time.Millisecond,
+		HostsCachingExpiryTime: 1 * time.Hour,
+		ExpectAllRepairedTime:  30 * time.Minute,
+		PEM: cli.pem,
+	}
+	// sanity check that we are looking at all fields
+	vExpected := reflect.ValueOf(expected)
+	nf := vExpected.NumField()
+	for i := 0; i < nf; i++ {
+		fv := vExpected.Field(i)
+		// field isn't empty/zero
+		c.Assert(fv.Interface(), Not(DeepEquals), reflect.Zero(fv.Type()).Interface(), Commentf("forgot about: %s", vExpected.Type().Field(i).Name))
+	}
+	// finally compare
+	conf := cli.deriveSessionConfig()
+	c.Check(conf, DeepEquals, expected)
+}
+
 /*****************************************************************
     getDeviceId tests
 ******************************************************************/
@@ -308,6 +356,7 @@
 	cli := NewPushClient(cs.configPath, cs.leveldbPath)
 	cli.log = cs.log
 	c.Assert(cli.initSession(), IsNil)
+	cs.log.ResetCapture()
 	cli.hasConnectivity = true
 	cli.handleErr(errors.New("bananas"))
 	c.Check(cs.log.Captured(), Matches, ".*session exited.*bananas\n")
@@ -363,7 +412,7 @@
 func (cs *clientSuite) TestHandleConnStateC2D(c *C) {
 	cli := NewPushClient(cs.configPath, cs.leveldbPath)
 	cli.log = cs.log
-	cli.session, _ = session.NewSession(string(cli.config.Addr), cli.pem, cli.config.ExchangeTimeout.Duration, cli.deviceId, levelmap.NewLevelMap, cs.log)
+	cli.session, _ = session.NewSession(cli.config.Addr, cli.deriveSessionConfig(), cli.deviceId, levelmap.NewLevelMap, cs.log)
 	cli.session.Dial()
 	cli.hasConnectivity = true
 
@@ -376,7 +425,7 @@
 func (cs *clientSuite) TestHandleConnStateC2DPending(c *C) {
 	cli := NewPushClient(cs.configPath, cs.leveldbPath)
 	cli.log = cs.log
-	cli.session, _ = session.NewSession(string(cli.config.Addr), cli.pem, cli.config.ExchangeTimeout.Duration, cli.deviceId, levelmap.NewLevelMap, cs.log)
+	cli.session, _ = session.NewSession(cli.config.Addr, cli.deriveSessionConfig(), cli.deviceId, levelmap.NewLevelMap, cs.log)
 	cli.hasConnectivity = true
 
 	cli.handleConnState(false)
 
=== modified file 'client/gethosts/gethost_test.go'
--- client/gethosts/gethost_test.go	2014-03-24 15:32:29 +0000
+++ client/gethosts/gethost_test.go	2014-03-31 16:43:44 +0000
@@ -61,18 +61,16 @@
 }
 
 func (s *getHostsSuite) TestGetTimeout(c *C) {
-	finish := make(chan bool, 1)
+	started := make(chan bool, 1)
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		<-finish
+		started <- true
+		time.Sleep(700 * time.Millisecond)
 	}))
 	defer func() {
-		time.Sleep(100 * time.Millisecond) // work around -race issue
+		<-started
 		ts.Close()
 	}()
-	defer func() {
-		finish <- true
-	}()
-	gh := New("foobar", ts.URL, 1*time.Second)
+	gh := New("foobar", ts.URL, 500*time.Millisecond)
 	_, err := gh.Get()
 	c.Check(err, ErrorMatches, ".*closed.*")
 }
 
=== modified file 'client/session/session.go'
--- client/session/session.go	2014-03-26 16:26:36 +0000
+++ client/session/session.go	2014-03-31 16:43:44 +0000
@@ -23,14 +23,18 @@
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"math/rand"
+	"net"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"launchpad.net/ubuntu-push/client/gethosts"
 	"launchpad.net/ubuntu-push/client/session/levelmap"
 	"launchpad.net/ubuntu-push/logger"
 	"launchpad.net/ubuntu-push/protocol"
 	"launchpad.net/ubuntu-push/util"
-	"math/rand"
-	"net"
-	"sync/atomic"
-	"time"
 )
 
 var wireVersionBytes = []byte{protocol.ProtocolWireVersion}
@@ -45,6 +49,15 @@
 	protocol.NotificationsMsg
 }
 
+// parseServerAddrSpec recognizes whether spec is a HTTP URL to get
+// hosts from or a |-separated list of host:port pairs.
+func parseServerAddrSpec(spec string) (hostsEndpoint string, fallbackHosts []string) {
+	if strings.HasPrefix(spec, "http") {
+		return spec, nil
+	}
+	return "", strings.Split(spec, "|")
+}
+
 // ClientSessionState is a way to broadly track the progress of the session
 type ClientSessionState uint32
 
@@ -56,15 +69,38 @@
 	Running
 )
 
-// ClienSession holds a client<->server session and its configuration.
+type hostGetter interface {
+	Get() ([]string, error)
+}
+
+// ClientSessionConfig groups the client session configuration.
+type ClientSessionConfig struct {
+	ConnectTimeout         time.Duration
+	ExchangeTimeout        time.Duration
+	HostsCachingExpiryTime time.Duration
+	ExpectAllRepairedTime  time.Duration
+	PEM                    []byte
+}
+
+// ClientSession holds a client<->server session and its configuration.
 type ClientSession struct {
 	// configuration
-	DeviceId        string
-	ServerAddr      string
-	ExchangeTimeout time.Duration
-	Levels          levelmap.LevelMap
-	Protocolator    func(net.Conn) protocol.Protocol
+	DeviceId string
+	ClientSessionConfig
+	Levels       levelmap.LevelMap
+	Protocolator func(net.Conn) protocol.Protocol
+	// hosts
+	getHost                hostGetter
+	fallbackHosts          []string
+	deliveryHostsTimestamp time.Time
+	deliveryHosts          []string
+	lastAttemptTimestamp   time.Time
+	leftToTry              int
+	tryHost                int
+	// hook for testing
+	timeSince func(time.Time) time.Duration
 	// connection
+	connLock     sync.RWMutex
 	Connection   net.Conn
 	Log          logger.Logger
 	TLS          *tls.Config
@@ -77,7 +113,7 @@
 	MsgCh  chan *Notification
 }
 
-func NewSession(serverAddr string, pem []byte, exchangeTimeout time.Duration,
+func NewSession(serverAddrSpec string, conf ClientSessionConfig,
 	deviceId string, levelmapFactory func() (levelmap.LevelMap, error),
 	log logger.Logger) (*ClientSession, error) {
 	state := uint32(Disconnected)
@@ -85,19 +121,27 @@
 	if err != nil {
 		return nil, err
 	}
+	var getHost hostGetter
+	log.Infof("using addr: %v", serverAddrSpec)
+	hostsEndpoint, fallbackHosts := parseServerAddrSpec(serverAddrSpec)
+	if hostsEndpoint != "" {
+		getHost = gethosts.New(deviceId, hostsEndpoint, conf.ExchangeTimeout)
+	}
 	sess := &ClientSession{
-		ExchangeTimeout: exchangeTimeout,
-		ServerAddr:      serverAddr,
-		DeviceId:        deviceId,
-		Log:             log,
-		Protocolator:    protocol.NewProtocol0,
-		Levels:          levels,
-		TLS:             &tls.Config{InsecureSkipVerify: true}, // XXX
-		stateP:          &state,
+		ClientSessionConfig: conf,
+		getHost:             getHost,
+		fallbackHosts:       fallbackHosts,
+		DeviceId:            deviceId,
+		Log:                 log,
+		Protocolator:        protocol.NewProtocol0,
+		Levels:              levels,
+		TLS:                 &tls.Config{InsecureSkipVerify: true}, // XXX
+		stateP:              &state,
+		timeSince:           time.Since,
 	}
-	if pem != nil {
+	if sess.PEM != nil {
 		cp := x509.NewCertPool()
-		ok := cp.AppendCertsFromPEM(pem)
+		ok := cp.AppendCertsFromPEM(sess.PEM)
 		if !ok {
 			return nil, errors.New("could not parse certificate")
 		}
@@ -114,15 +158,90 @@
 	atomic.StoreUint32(sess.stateP, uint32(state))
 }
 
+func (sess *ClientSession) setConnection(conn net.Conn) {
+	sess.connLock.Lock()
+	defer sess.connLock.Unlock()
+	sess.Connection = conn
+}
+
+func (sess *ClientSession) getConnection() net.Conn {
+	sess.connLock.RLock()
+	defer sess.connLock.RUnlock()
+	return sess.Connection
+}
+
+// getHosts sets deliveryHosts possibly querying a remote endpoint
+func (sess *ClientSession) getHosts() error {
+	if sess.getHost != nil {
+		if sess.timeSince(sess.deliveryHostsTimestamp) < sess.HostsCachingExpiryTime {
+			return nil
+		}
+		hosts, err := sess.getHost.Get()
+		if err != nil {
+			sess.Log.Errorf("getHosts: %v", err)
+			sess.setState(Error)
+			return err
+		}
+		sess.deliveryHostsTimestamp = time.Now()
+		sess.deliveryHosts = hosts
+	} else {
+		sess.deliveryHosts = sess.fallbackHosts
+	}
+	return nil
+}
+
+// startConnectionAttempt/nextHostToTry help connect iterating over candidate hosts
+
+func (sess *ClientSession) startConnectionAttempt() {
+	if sess.timeSince(sess.lastAttemptTimestamp) > sess.ExpectAllRepairedTime {
+		sess.tryHost = 0
+	}
+	sess.leftToTry = len(sess.deliveryHosts)
+	if sess.leftToTry == 0 {
+		panic("should have got hosts from config or remote at this point")
+	}
+	sess.lastAttemptTimestamp = time.Now()
+}
+
+func (sess *ClientSession) nextHostToTry() string {
+	if sess.leftToTry == 0 {
+		return ""
+	}
+	res := sess.deliveryHosts[sess.tryHost]
+	sess.tryHost = (sess.tryHost + 1) % len(sess.deliveryHosts)
+	sess.leftToTry--
+	return res
+}
+
+// we reached the Started state, we can retry with the same host if we
+// have to retry again
+func (sess *ClientSession) started() {
+	sess.tryHost--
+	if sess.tryHost == -1 {
+		sess.tryHost = len(sess.deliveryHosts) - 1
+	}
+	sess.setState(Started)
+}
+
 // connect to a server using the configuration in the ClientSession
 // and set up the connection.
 func (sess *ClientSession) connect() error {
-	conn, err := net.DialTimeout("tcp", sess.ServerAddr, sess.ExchangeTimeout)
-	if err != nil {
-		sess.setState(Error)
-		return fmt.Errorf("connect: %s", err)
+	sess.startConnectionAttempt()
+	var err error
+	var conn net.Conn
+	for {
+		host := sess.nextHostToTry()
+		if host == "" {
+			sess.setState(Error)
+			return fmt.Errorf("connect: %s", err)
+		}
+		sess.Log.Debugf("trying to connect to: %v", host)
+		conn, err = net.DialTimeout("tcp", host, sess.ConnectTimeout)
+		if err == nil {
+			break
+		}
 	}
-	sess.Connection = tls.Client(conn, sess.TLS)
+	sess.setConnection(tls.Client(conn, sess.TLS))
 	sess.setState(Connected)
 	return nil
 }
@@ -145,6 +264,8 @@
 	sess.doClose()
 }
 func (sess *ClientSession) doClose() {
+	sess.connLock.Lock()
+	defer sess.connLock.Unlock()
 	if sess.Connection != nil {
 		sess.Connection.Close()
 		// we ignore Close errors, on purpose (the thinking being that
@@ -224,7 +345,7 @@
 
 // Call this when you've connected and want to start looping.
 func (sess *ClientSession) start() error {
-	conn := sess.Connection
+	conn := sess.getConnection()
 	err := conn.SetDeadline(time.Now().Add(sess.ExchangeTimeout))
 	if err != nil {
 		sess.setState(Error)
@@ -279,15 +400,19 @@
 	sess.proto = proto
 	sess.pingInterval = pingInterval
 	sess.Log.Debugf("Connected %v.", conn.LocalAddr())
-	sess.setState(Started)
+	sess.started() // deals with choosing which host to retry with as well
 	return nil
 }
 
 // run calls connect, and if it works it calls start, and if it works
 // it runs loop in a goroutine, and ships its return value over ErrCh.
-func (sess *ClientSession) run(closer func(), connecter, starter, looper func() error) error {
+func (sess *ClientSession) run(closer func(), hostGetter, connecter, starter, looper func() error) error {
 	closer()
-	err := connecter()
+	err := hostGetter()
+	if err != nil {
+		return err
+	}
+	err = connecter()
 	if err == nil {
 		err = starter()
 		if err == nil {
@@ -317,7 +442,7 @@
 		// keep on trying.
 		panic("can't Dial() without a protocol constructor.")
 	}
-	return sess.run(sess.doClose, sess.connect, sess.start, sess.loop)
+	return sess.run(sess.doClose, sess.getHosts, sess.connect, sess.start, sess.loop)
 }
 
 func init() {
 
=== modified file 'client/session/session_test.go'
--- client/session/session_test.go	2014-03-27 13:26:10 +0000
+++ client/session/session_test.go	2014-03-31 16:43:44 +0000
@@ -23,16 +23,21 @@
 	"fmt"
 	"io"
 	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"testing"
+	"time"
+
 	. "launchpad.net/gocheck"
+
 	"launchpad.net/ubuntu-push/client/session/levelmap"
+	//"launchpad.net/ubuntu-push/client/gethosts"
 	"launchpad.net/ubuntu-push/logger"
 	"launchpad.net/ubuntu-push/protocol"
 	helpers "launchpad.net/ubuntu-push/testing"
 	"launchpad.net/ubuntu-push/testing/condition"
-	"net"
-	"reflect"
-	"testing"
-	"time"
 )
 
 func TestSession(t *testing.T) { TestingT(t) }
@@ -181,23 +186,51 @@
 }
 
 /****************************************************************
+  parseServerAddrSpec() tests
+****************************************************************/
+
+func (cs *clientSessionSuite) TestParseServerAddrSpec(c *C) {
+	hEp, fallbackHosts := parseServerAddrSpec("http://foo/hosts")
+	c.Check(hEp, Equals, "http://foo/hosts")
+	c.Check(fallbackHosts, IsNil)
+
+	hEp, fallbackHosts = parseServerAddrSpec("foo:443")
+	c.Check(hEp, Equals, "")
+	c.Check(fallbackHosts, DeepEquals, []string{"foo:443"})
+
+	hEp, fallbackHosts = parseServerAddrSpec("foo:443|bar:443")
+	c.Check(hEp, Equals, "")
+	c.Check(fallbackHosts, DeepEquals, []string{"foo:443", "bar:443"})
+}
+
+/****************************************************************
   NewSession() tests
 ****************************************************************/
 
+var dummyConf = ClientSessionConfig{}
+
 func (cs *clientSessionSuite) TestNewSessionPlainWorks(c *C) {
-	sess, err := NewSession("", nil, 0, "", cs.lvls, cs.log)
+	sess, err := NewSession("foo:443", dummyConf, "", cs.lvls, cs.log)
 	c.Check(sess, NotNil)
 	c.Check(err, IsNil)
+	c.Check(sess.fallbackHosts, DeepEquals, []string{"foo:443"})
 	// but no root CAs set
 	c.Check(sess.TLS.RootCAs, IsNil)
 	c.Check(sess.State(), Equals, Disconnected)
 }
 
-var certfile string = helpers.SourceRelative("../../server/acceptance/config/testing.cert")
+func (cs *clientSessionSuite) TestNewSessionHostEndpointWorks(c *C) {
+	sess, err := NewSession("http://foo/hosts", dummyConf, "wah", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+	c.Check(sess.getHost, NotNil)
+}
+
+var certfile string = helpers.SourceRelative("../../server/acceptance/ssl/testing.cert")
 var pem, _ = ioutil.ReadFile(certfile)
 
 func (cs *clientSessionSuite) TestNewSessionPEMWorks(c *C) {
-	sess, err := NewSession("", pem, 0, "wah", cs.lvls, cs.log)
+	conf := ClientSessionConfig{PEM: pem}
+	sess, err := NewSession("", conf, "wah", cs.lvls, cs.log)
 	c.Check(sess, NotNil)
 	c.Assert(err, IsNil)
 	c.Check(sess.TLS.RootCAs, NotNil)
@@ -205,25 +238,172 @@
 
 func (cs *clientSessionSuite) TestNewSessionBadPEMFileContentFails(c *C) {
 	badpem := []byte("This is not the PEM you're looking for.")
-	sess, err := NewSession("", badpem, 0, "wah", cs.lvls, cs.log)
+	conf := ClientSessionConfig{PEM: badpem}
+	sess, err := NewSession("", conf, "wah", cs.lvls, cs.log)
 	c.Check(sess, IsNil)
 	c.Check(err, NotNil)
 }
 
 func (cs *clientSessionSuite) TestNewSessionBadLevelMapFails(c *C) {
 	ferr := func() (levelmap.LevelMap, error) { return nil, errors.New("Busted.") }
-	sess, err := NewSession("", nil, 0, "wah", ferr, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", ferr, cs.log)
 	c.Check(sess, IsNil)
 	c.Assert(err, NotNil)
 }
 
 /****************************************************************
+  getHosts() tests
+****************************************************************/
+
+func (cs *clientSessionSuite) TestGetHostsFallback(c *C) {
+	fallback := []string{"foo:443", "bar:443"}
+	sess := &ClientSession{fallbackHosts: fallback}
+	err := sess.getHosts()
+	c.Assert(err, IsNil)
+	c.Check(sess.deliveryHosts, DeepEquals, fallback)
+}
+
+type testHostGetter struct {
+	hosts []string
+	err   error
+}
+
+func (thg *testHostGetter) Get() ([]string, error) {
+	return thg.hosts, thg.err
+}
+
+func (cs *clientSessionSuite) TestGetHostsRemote(c *C) {
+	hostGetter := &testHostGetter{[]string{"foo:443", "bar:443"}, nil}
+	sess := &ClientSession{getHost: hostGetter, timeSince: time.Since}
+	err := sess.getHosts()
+	c.Assert(err, IsNil)
+	c.Check(sess.deliveryHosts, DeepEquals, []string{"foo:443", "bar:443"})
+}
+
+func (cs *clientSessionSuite) TestGetHostsRemoteError(c *C) {
+	sess, err := NewSession("", dummyConf, "", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+	hostsErr := errors.New("failed")
+	hostGetter := &testHostGetter{nil, hostsErr}
+	sess.getHost = hostGetter
+	err = sess.getHosts()
+	c.Assert(err, Equals, hostsErr)
+	c.Check(sess.deliveryHosts, IsNil)
+	c.Check(sess.State(), Equals, Error)
+}
+
+func (cs *clientSessionSuite) TestGetHostsRemoteCaching(c *C) {
+	hostGetter := &testHostGetter{[]string{"foo:443", "bar:443"}, nil}
+	sess := &ClientSession{
+		getHost: hostGetter,
+		ClientSessionConfig: ClientSessionConfig{
+			HostsCachingExpiryTime: 2 * time.Hour,
+		},
+		timeSince: time.Since,
+	}
+	err := sess.getHosts()
+	c.Assert(err, IsNil)
+	hostGetter.hosts = []string{"baz:443"}
+	// cached
+	err = sess.getHosts()
+	c.Assert(err, IsNil)
+	c.Check(sess.deliveryHosts, DeepEquals, []string{"foo:443", "bar:443"})
+	// expired
+	sess.timeSince = func(ts time.Time) time.Duration {
+		return 3 * time.Hour
+	}
+	err = sess.getHosts()
+	c.Assert(err, IsNil)
+	c.Check(sess.deliveryHosts, DeepEquals, []string{"baz:443"})
+}
+
+/****************************************************************
+  startConnectionAttempt()/nextHostToTry()/started tests
+****************************************************************/
+
+func (cs *clientSessionSuite) TestStartConnectionAttempt(c *C) {
+	since := time.Since(time.Time{})
+	sess := &ClientSession{
+		ClientSessionConfig: ClientSessionConfig{
+			ExpectAllRepairedTime: 10 * time.Second,
+		},
+		timeSince: func(ts time.Time) time.Duration {
+			return since
+		},
+		deliveryHosts: []string{"foo:443", "bar:443"},
+	}
+	// start from first host
+	sess.startConnectionAttempt()
+	c.Check(sess.lastAttemptTimestamp, Not(Equals), 0)
+	c.Check(sess.tryHost, Equals, 0)
+	c.Check(sess.leftToTry, Equals, 2)
+	since = 1 * time.Second
+	sess.tryHost = 1
+	// just continue
+	sess.startConnectionAttempt()
+	c.Check(sess.tryHost, Equals, 1)
+	sess.tryHost = 2
+}
+
+func (cs *clientSessionSuite) TestStartConnectionAttemptNoHostsPanic(c *C) {
+	since := time.Since(time.Time{})
+	sess := &ClientSession{
+		ClientSessionConfig: ClientSessionConfig{
+			ExpectAllRepairedTime: 10 * time.Second,
+		},
+		timeSince: func(ts time.Time) time.Duration {
+			return since
+		},
+	}
+	c.Check(sess.startConnectionAttempt, PanicMatches, "should have got hosts from config or remote at this point")
+}
+
+func (cs *clientSessionSuite) TestNextHostToTry(c *C) {
+	sess := &ClientSession{
+		deliveryHosts: []string{"foo:443", "bar:443", "baz:443"},
+		tryHost:       0,
+		leftToTry:     3,
+	}
+	c.Check(sess.nextHostToTry(), Equals, "foo:443")
+	c.Check(sess.nextHostToTry(), Equals, "bar:443")
+	c.Check(sess.nextHostToTry(), Equals, "baz:443")
+	c.Check(sess.nextHostToTry(), Equals, "")
+	c.Check(sess.nextHostToTry(), Equals, "")
+	c.Check(sess.tryHost, Equals, 0)
+
+	sess.leftToTry = 3
+	sess.tryHost = 1
+	c.Check(sess.nextHostToTry(), Equals, "bar:443")
+	c.Check(sess.nextHostToTry(), Equals, "baz:443")
+	c.Check(sess.nextHostToTry(), Equals, "foo:443")
+	c.Check(sess.nextHostToTry(), Equals, "")
+	c.Check(sess.nextHostToTry(), Equals, "")
+	c.Check(sess.tryHost, Equals, 1)
+}
+
+func (cs *clientSessionSuite) TestStarted(c *C) {
+	sess, err := NewSession("", dummyConf, "", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+
+	sess.deliveryHosts = []string{"foo:443", "bar:443", "baz:443"}
+	sess.tryHost = 1
+
+	sess.started()
+	c.Check(sess.tryHost, Equals, 0)
+	c.Check(sess.State(), Equals, Started)
+
+	sess.started()
+	c.Check(sess.tryHost, Equals, 2)
+}
+
+/****************************************************************
   connect() tests
 ****************************************************************/
 
 func (cs *clientSessionSuite) TestConnectFailsWithNoAddress(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
+	sess.deliveryHosts = []string{"nowhere"}
 	err = sess.connect()
 	c.Check(err, ErrorMatches, ".*connect.*address.*")
 	c.Check(sess.State(), Equals, Error)
@@ -233,20 +413,36 @@
 	srv, err := net.Listen("tcp", "localhost:0")
 	c.Assert(err, IsNil)
 	defer srv.Close()
-	sess, err := NewSession(srv.Addr().String(), nil, 0, "wah", cs.lvls, cs.log)
-	c.Assert(err, IsNil)
-	err = sess.connect()
-	c.Check(err, IsNil)
-	c.Check(sess.Connection, NotNil)
-	c.Check(sess.State(), Equals, Connected)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+	sess.deliveryHosts = []string{srv.Addr().String()}
+	err = sess.connect()
+	c.Check(err, IsNil)
+	c.Check(sess.Connection, NotNil)
+	c.Check(sess.State(), Equals, Connected)
+}
+
+func (cs *clientSessionSuite) TestConnectSecondConnects(c *C) {
+	srv, err := net.Listen("tcp", "localhost:0")
+	c.Assert(err, IsNil)
+	defer srv.Close()
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+	sess.deliveryHosts = []string{"nowhere", srv.Addr().String()}
+	err = sess.connect()
+	c.Check(err, IsNil)
+	c.Check(sess.Connection, NotNil)
+	c.Check(sess.State(), Equals, Connected)
+	c.Check(sess.tryHost, Equals, 0)
 }
 
 func (cs *clientSessionSuite) TestConnectConnectFail(c *C) {
 	srv, err := net.Listen("tcp", "localhost:0")
 	c.Assert(err, IsNil)
-	sess, err := NewSession(srv.Addr().String(), nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession(srv.Addr().String(), dummyConf, "wah", cs.lvls, cs.log)
 	srv.Close()
 	c.Assert(err, IsNil)
+	sess.deliveryHosts = []string{srv.Addr().String()}
 	err = sess.connect()
 	c.Check(err, ErrorMatches, ".*connection refused")
 	c.Check(sess.State(), Equals, Error)
@@ -257,7 +453,7 @@
 ****************************************************************/
 
 func (cs *clientSessionSuite) TestClose(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestClose"}
 	sess.Close()
@@ -266,7 +462,7 @@
 }
 
 func (cs *clientSessionSuite) TestCloseTwice(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestCloseTwice"}
 	sess.Close()
@@ -277,7 +473,7 @@
 }
 
 func (cs *clientSessionSuite) TestCloseFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestCloseFails", CloseCondition: condition.Work(false)}
 	sess.Close()
@@ -291,7 +487,7 @@
 func (d *derp) Stop()        { d.stopped = true }
 
 func (cs *clientSessionSuite) TestCloseStopsRetrier(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	ar := new(derp)
 	sess.retrier = ar
@@ -308,7 +504,7 @@
 
 func (cs *clientSessionSuite) TestAutoRedialWorks(c *C) {
 	// checks that AutoRedial sets up a retrier and tries redialing it
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	ar := new(derp)
 	sess.retrier = ar
@@ -319,7 +515,7 @@
 
 func (cs *clientSessionSuite) TestAutoRedialStopsRetrier(c *C) {
 	// checks that AutoRedial stops the previous retrier
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	ch := make(chan uint32)
 	c.Check(sess.retrier, IsNil)
@@ -344,7 +540,10 @@
 
 func (s *msgSuite) SetUpTest(c *C) {
 	var err error
-	s.sess, err = NewSession("", nil, time.Millisecond, "wah", levelmap.NewLevelMap, helpers.NewTestLogger(c, "debug"))
+	conf := ClientSessionConfig{
+		ExchangeTimeout: time.Millisecond,
+	}
+	s.sess, err = NewSession("", conf, "wah", levelmap.NewLevelMap, helpers.NewTestLogger(c, "debug"))
 	c.Assert(err, IsNil)
 	s.sess.Connection = &testConn{Name: "TestHandle*"}
 	s.errCh = make(chan error, 1)
@@ -519,7 +718,7 @@
   start() tests
 ****************************************************************/
 func (cs *clientSessionSuite) TestStartFailsIfSetDeadlineFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestStartFailsIfSetDeadlineFails",
 		DeadlineCondition: condition.Work(false)} // setdeadline will fail
@@ -529,7 +728,7 @@
 }
 
 func (cs *clientSessionSuite) TestStartFailsIfWriteFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestStartFailsIfWriteFails",
 		WriteCondition: condition.Work(false)} // write will fail
@@ -539,7 +738,7 @@
 }
 
 func (cs *clientSessionSuite) TestStartFailsIfGetLevelsFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Levels = &brokenLevelMap{}
 	sess.Connection = &testConn{Name: "TestStartConnectMessageFails"}
@@ -559,7 +758,7 @@
 }
 
 func (cs *clientSessionSuite) TestStartConnectMessageFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestStartConnectMessageFails"}
 	errCh := make(chan error, 1)
@@ -585,7 +784,7 @@
 }
 
 func (cs *clientSessionSuite) TestStartConnackReadError(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestStartConnackReadError"}
 	errCh := make(chan error, 1)
@@ -609,7 +808,7 @@
 }
 
 func (cs *clientSessionSuite) TestStartBadConnack(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestStartBadConnack"}
 	errCh := make(chan error, 1)
@@ -633,7 +832,7 @@
 }
 
 func (cs *clientSessionSuite) TestStartNotConnack(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestStartBadConnack"}
 	errCh := make(chan error, 1)
@@ -657,7 +856,7 @@
 }
 
 func (cs *clientSessionSuite) TestStartWorks(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Connection = &testConn{Name: "TestStartWorks"}
 	errCh := make(chan error, 1)
@@ -688,34 +887,49 @@
   run() tests
 ****************************************************************/
 
-func (cs *clientSessionSuite) TestRunBailsIfConnectFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+func (cs *clientSessionSuite) TestRunBailsIfHostGetterFails(c *C) {
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
-	failure := errors.New("TestRunBailsIfConnectFails")
+	failure := errors.New("TestRunBailsIfHostGetterFails")
 	has_closed := false
 	err = sess.run(
 		func() { has_closed = true },
 		func() error { return failure },
 		nil,
+		nil,
 		nil)
 	c.Check(err, Equals, failure)
 	c.Check(has_closed, Equals, true)
 }
 
+func (cs *clientSessionSuite) TestRunBailsIfConnectFails(c *C) {
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+	failure := errors.New("TestRunBailsIfConnectFails")
+	err = sess.run(
+		func() {},
+		func() error { return nil },
+		func() error { return failure },
+		nil,
+		nil)
+	c.Check(err, Equals, failure)
+}
+
 func (cs *clientSessionSuite) TestRunBailsIfStartFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	failure := errors.New("TestRunBailsIfStartFails")
 	err = sess.run(
 		func() {},
 		func() error { return nil },
+		func() error { return nil },
 		func() error { return failure },
 		nil)
 	c.Check(err, Equals, failure)
 }
 
 func (cs *clientSessionSuite) TestRunRunsEvenIfLoopFails(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	// just to make a point: until here we haven't set ErrCh & MsgCh (no
 	// biggie if this stops being true)
@@ -727,6 +941,7 @@
 		func() {},
 		func() error { return nil },
 		func() error { return nil },
+		func() error { return nil },
 		func() error { sess.MsgCh <- notf; return <-failureCh })
 	c.Check(err, Equals, nil)
 	// if run doesn't error it sets up the channels
@@ -744,7 +959,7 @@
 ****************************************************************/
 
 func (cs *clientSessionSuite) TestJitter(c *C) {
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	num_tries := 20       // should do the math
 	spread := time.Second //
@@ -776,12 +991,17 @@
 
 func (cs *clientSessionSuite) TestDialPanics(c *C) {
 	// one last unhappy test
-	sess, err := NewSession("", nil, 0, "wah", cs.lvls, cs.log)
+	sess, err := NewSession("", dummyConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	sess.Protocolator = nil
 	c.Check(sess.Dial, PanicMatches, ".*protocol constructor.")
 }
 
+var (
+	dialTestTimeout = 100 * time.Millisecond
+	dialTestConf    = ClientSessionConfig{ExchangeTimeout: dialTestTimeout}
+)
+
 func (cs *clientSessionSuite) TestDialWorks(c *C) {
 	// happy path thoughts
 	cert, err := tls.X509KeyPair(helpers.TestCertPEMBlock, helpers.TestKeyPEMBlock)
@@ -791,10 +1011,22 @@
 		SessionTicketsDisabled: true,
 	}
 
-	timeout := 100 * time.Millisecond
 	lst, err := tls.Listen("tcp", "localhost:0", tlsCfg)
 	c.Assert(err, IsNil)
-	sess, err := NewSession(lst.Addr().String(), nil, timeout, "wah", cs.lvls, cs.log)
+	// advertise
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, err := json.Marshal(map[string]interface{}{
+			"hosts": []string{"nowhere", lst.Addr().String()},
+		})
+		if err != nil {
+			panic(err)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Write(b)
+	}))
+	defer ts.Close()
+
+	sess, err := NewSession(ts.URL, dialTestConf, "wah", cs.lvls, cs.log)
 	c.Assert(err, IsNil)
 	tconn := &testConn{CloseCondition: condition.Fail2Work(10)}
 	sess.Connection = tconn
@@ -819,10 +1051,13 @@
 	c.Check(tconn.CloseCondition.String(), Matches, ".* 9 to go.")
 
 	// now, start: 1. protocol version
-	v, err := protocol.ReadWireFormatVersion(srv, timeout)
+	v, err := protocol.ReadWireFormatVersion(srv, dialTestTimeout)
 	c.Assert(err, IsNil)
 	c.Assert(v, Equals, protocol.ProtocolWireVersion)
 
+	// if something goes wrong session would try the first/other host
+	c.Check(sess.tryHost, Equals, 0)
+
 	// 2. "connect" (but on the fake protcol above! woo)
 
 	c.Check(takeNext(downCh), Equals, "deadline 100ms")
@@ -843,6 +1078,9 @@
 	c.Check(takeNext(downCh), Equals, protocol.PingPongMsg{Type: "pong"})
 	upCh <- nil
 
+	// session would retry the same host
+	c.Check(sess.tryHost, Equals, 1)
+
 	// and broadcasts...
 	b := &protocol.BroadcastMsg{
 		Type:     "broadcast",
@@ -870,3 +1108,30 @@
 	upCh <- failure
 	c.Check(<-sess.ErrCh, Equals, failure)
 }
+
+func (cs *clientSessionSuite) TestDialWorksDirect(c *C) {
+	// happy path thoughts
+	cert, err := tls.X509KeyPair(helpers.TestCertPEMBlock, helpers.TestKeyPEMBlock)
+	c.Assert(err, IsNil)
+	tlsCfg := &tls.Config{
+		Certificates:           []tls.Certificate{cert},
+		SessionTicketsDisabled: true,
+	}
+
+	lst, err := tls.Listen("tcp", "localhost:0", tlsCfg)
+	c.Assert(err, IsNil)
+	sess, err := NewSession(lst.Addr().String(), dialTestConf, "wah", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+	defer sess.Close()
+
+	upCh := make(chan interface{}, 5)
+	downCh := make(chan interface{}, 5)
+	proto := &testProtocol{up: upCh, down: downCh}
+	sess.Protocolator = func(net.Conn) protocol.Protocol { return proto }
+
+	go sess.Dial()
+
+	_, err = lst.Accept()
+	c.Assert(err, IsNil)
+	// connect done
+}
 
=== modified file 'debian/config.json'
--- debian/config.json	2014-03-20 12:17:40 +0000
+++ debian/config.json	2014-03-31 16:43:44 +0000
@@ -1,5 +1,8 @@
 {
+    "connect_timeout": "20s",
     "exchange_timeout": "30s",
+    "hosts_cache_expiry": "12h",
+    "expect_all_repaired": "40m",
     "addr": "push-delivery.ubuntu.com:443",
     "cert_pem_file": "",
     "stabilizing_timeout": "2s",
 
=== added directory 'sampleconfigs'
=== renamed file 'server/acceptance/config/config.json' => 'sampleconfigs/dev.json'
--- server/acceptance/config/config.json	2014-01-17 17:20:34 +0000
+++ sampleconfigs/dev.json	2014-03-31 16:43:44 +0000
@@ -4,8 +4,8 @@
     "broker_queue_size": 10000,
     "session_queue_size": 10,
     "addr": "127.0.0.1:9090",
-    "key_pem_file": "testing.key",
-    "cert_pem_file": "testing.cert",
+    "key_pem_file": "../server/acceptance/ssl/testing.key",
+    "cert_pem_file": "../server/acceptance/ssl/testing.cert",
     "http_addr": "127.0.0.1:8888",
     "http_read_timeout": "5s",
     "http_write_timeout": "5s"
 
=== renamed directory 'server/acceptance/config' => 'server/acceptance/ssl'
=== modified file 'server/acceptance/suites/helpers.go'
--- server/acceptance/suites/helpers.go	2014-03-25 19:08:00 +0000
+++ server/acceptance/suites/helpers.go	2014-03-31 16:43:44 +0000
@@ -48,8 +48,8 @@
 		"session_queue_size": 10,
 		"broker_queue_size":  100,
 		"addr":               addr,
-		"key_pem_file":       helpers.SourceRelative("../config/testing.key"),
-		"cert_pem_file":      helpers.SourceRelative("../config/testing.cert"),
+		"key_pem_file":       helpers.SourceRelative("../ssl/testing.key"),
+		"cert_pem_file":      helpers.SourceRelative("../ssl/testing.cert"),
 	})
 }
 
 
=== modified file 'server/acceptance/suites/suite.go'
--- server/acceptance/suites/suite.go	2014-03-25 19:08:00 +0000
+++ server/acceptance/suites/suite.go	2014-03-31 16:43:44 +0000
@@ -128,9 +128,9 @@
 }
 
 func testClientSession(addr string, deviceId string, reportPings bool) *acceptance.ClientSession {
-	certPEMBlock, err := ioutil.ReadFile(helpers.SourceRelative("../config/testing.cert"))
+	certPEMBlock, err := ioutil.ReadFile(helpers.SourceRelative("../ssl/testing.cert"))
 	if err != nil {
-		panic(fmt.Sprintf("could not read config/testing.cert: %v", err))
+		panic(fmt.Sprintf("could not read ssl/testing.cert: %v", err))
 	}
 	return &acceptance.ClientSession{
 		ExchangeTimeout: 100 * time.Millisecond,