cloudflared/2024.12.1-r0: cve remediation #36983
Merged
Octo STS / elastic-build
succeeded
Dec 13, 2024 in 2m 55s
APKs built successfully
Build ID: 24e0a846-bd4d-4c3d-85f7-111c4f0da7f1
Details
x86_64
Logs
Click to expand
his property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress (default: 30s)
--proxy-no-happy-eyeballs --url HTTP proxy should disable "happy eyeballs" for IPv4/v6 fallback This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress (default: false)
--proxy-keepalive-connections --url HTTP proxy maximum keepalive connection pool size This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress (default: 100)
--proxy-keepalive-timeout --url HTTP proxy timeout for closing an idle connection This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress (default: 1m30s)
--proxy-connection-timeout value DEPRECATED. No longer has any effect. (default: 1m30s)
--proxy-expect-continue-timeout value DEPRECATED. No longer has any effect. (default: 1m30s)
--http-host-header --url Sets the HTTP Host header for the local webserver. This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress [$TUNNEL_HTTP_HOST_HEADER]
--origin-server-name --url Hostname on the origin server certificate. This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress [$TUNNEL_ORIGIN_SERVER_NAME]
--unix-socket value Path to unix socket to use instead of --url [$TUNNEL_UNIX_SOCKET]
--origin-ca-pool --url Path to the CA for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare. This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress [$TUNNEL_ORIGIN_CA_POOL]
--no-tls-verify --url Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted. Note: The connection from your machine to Cloudflare's Edge is still encrypted. This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress (default: false) [$NO_TLS_VERIFY]
--no-chunked-encoding --url Disables chunked transfer encoding; useful if you are running a WSGI server. This flag only takes effect if you define your origin with --url and if you do not use ingress rules. The recommended way is to rely on ingress rules and define this property under `originRequest` as per https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress (default: false) [$TUNNEL_NO_CHUNKED_ENCODING]
--http2-origin Enables HTTP/2 origin servers. (default: false) [$TUNNEL_ORIGIN_ENABLE_HTTP2]
--bastion Runs as jump host (default: false) [$TUNNEL_BASTION]
--proxy-address value Listen address for the proxy. (default: "127.0.0.1") [$TUNNEL_PROXY_ADDRESS]
--proxy-port value Listen port for the proxy. (default: 0) [$TUNNEL_PROXY_PORT]
--loglevel value Application logging level {debug, info, warn, error, fatal}. At debug level cloudflared will log request URL, method, protocol, content length, as well as, all request and response headers. This can expose sensitive information in your logs. (default: "info") [$TUNNEL_LOGLEVEL]
--transport-loglevel value, --proto-loglevel value Transport logging level(previously called protocol logging level) {debug, info, warn, error, fatal} (default: "info") [$TUNNEL_PROTO_LOGLEVEL, $TUNNEL_TRANSPORT_LOGLEVEL]
--logfile value Save application log to this file for reporting issues. [$TUNNEL_LOGFILE]
--log-directory value Save application log to this directory for reporting issues. [$TUNNEL_LOGDIRECTORY]
--trace-output value Name of trace output file, generated when cloudflared stops. [$TUNNEL_TRACE_OUTPUT]
--proxy-dns Run a DNS over HTTPS proxy server. (default: false) [$TUNNEL_DNS]
--proxy-dns-port value Listen on given port for the DNS over HTTPS proxy server. (default: 53) [$TUNNEL_DNS_PORT]
--proxy-dns-address value Listen address for the DNS over HTTPS proxy server. (default: "localhost") [$TUNNEL_DNS_ADDRESS]
--proxy-dns-upstream value Upstream endpoint URL, you can specify multiple endpoints for redundancy. (default: "https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query") (accepts multiple inputs) [$TUNNEL_DNS_UPSTREAM]
--proxy-dns-max-upstream-conns value Maximum concurrent connections to upstream. Setting to 0 means unlimited. (default: 5) [$TUNNEL_DNS_MAX_UPSTREAM_CONNS]
--proxy-dns-bootstrap value bootstrap endpoint URL, you can specify multiple endpoints for redundancy. (default: "https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query") (accepts multiple inputs) [$TUNNEL_DNS_BOOTSTRAP]
--credentials-file value, --cred-file value Filepath at which to read/write the tunnel credentials [$TUNNEL_CRED_FILE]
--region value Cloudflare Edge region to connect to. Omit or set to empty to connect to the global region. [$TUNNEL_REGION]
--edge-ip-version value Cloudflare Edge IP address version to connect with. {4, 6, auto} (default: "4") [$TUNNEL_EDGE_IP_VERSION]
--edge-bind-address value Bind to IP address for outgoing connections to Cloudflare Edge. [$TUNNEL_EDGE_BIND_ADDRESS]
--hostname value Set a hostname on a Cloudflare zone to route traffic through this tunnel. [$TUNNEL_HOSTNAME]
--lb-pool value The name of a (new/existing) load balancing pool to add this origin to. [$TUNNEL_LB_POOL]
--metrics-update-freq value Frequency to update tunnel metrics (default: 5s) [$TUNNEL_METRICS_UPDATE_FREQ]
--retries value Maximum number of retries for connection/protocol errors. (default: 5) [$TUNNEL_RETRIES]
--label value Use this option to give a meaningful label to a specific connector. When a tunnel starts up, a connector id unique to the tunnel is generated. This is a uuid. To make it easier to identify a connector, we will use the hostname of the machine the tunnel is running on along with the connector ID. This option exists if one wants to have more control over what their individual connectors are called.
--grace-period value When cloudflared receives SIGINT/SIGTERM it will stop accepting new requests, wait for in-progress requests to terminate, then shutdown. Waiting for in-progress requests will timeout after this grace period, or when a second SIGTERM/SIGINT is received. (default: 30s) [$TUNNEL_GRACE_PERIOD]
--compression-quality value (beta) Use cross-stream compression instead HTTP compression. 0-off, 1-low, 2-medium, >=3-high. (default: 0) [$TUNNEL_COMPRESSION_LEVEL]
--name value, -n value Stable name to identify the tunnel. Using this flag will create, route and run a tunnel. For production usage, execute each command separately [$TUNNEL_NAME]
--post-quantum, --pq When given creates an experimental post-quantum secure tunnel (default: false) [$TUNNEL_POST_QUANTUM]
--management-diagnostics Enables the in-depth diagnostic routes to be made available over the management service (/debug/pprof, /metrics, etc.) (default: true) [$TUNNEL_MANAGEMENT_DIAGNOSTICS]
--overwrite-dns, -f Overwrites existing DNS records with this hostname (default: false) [$TUNNEL_FORCE_PROVISIONING_DNS]
--help, -h show help (default: false)
running step "Test quick tunnel creation"
running step "start daemon on localhost"
daemon started as pid 56 with: cloudflared tunnel --url localhost:8080/
looking for 3 lines in output within 30 seconds
aarch64
Logs
Click to expand
nfo msg="loading plugin" id=io.containerd.grpc.v1.events type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.230595109Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.images type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.230608109Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.introspection type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.230620229Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.leases type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.230640109Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.namespaces type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.230653109Z" level=info msg="loading plugin" id=io.containerd.sandbox.store.v1.local type=io.containerd.sandbox.store.v1
time="2024-12-13T21:20:42.230665349Z" level=info msg="loading plugin" id=io.containerd.cri.v1.images type=io.containerd.cri.v1
time="2024-12-13T21:20:42.230727309Z" level=info msg="Get image filesystem path \"/var/lib/docker/containerd/daemon/io.containerd.snapshotter.v1.overlayfs\" for snapshotter \"overlayfs\""
time="2024-12-13T21:20:42.230747629Z" level=info msg="Start snapshots syncer"
time="2024-12-13T21:20:42.230782069Z" level=info msg="loading plugin" id=io.containerd.cri.v1.runtime type=io.containerd.cri.v1
time="2024-12-13T21:20:42.230965189Z" level=info msg="starting cri plugin" config="{\"containerd\":{\"defaultRuntimeName\":\"runc\",\"runtimes\":{\"runc\":{\"runtimeType\":\"io.containerd.runc.v2\",\"runtimePath\":\"\",\"PodAnnotations\":null,\"ContainerAnnotations\":null,\"options\":{\"BinaryName\":\"\",\"CriuImagePath\":\"\",\"CriuWorkPath\":\"\",\"IoGid\":0,\"IoUid\":0,\"NoNewKeyring\":false,\"Root\":\"\",\"ShimCgroup\":\"\"},\"privileged_without_host_devices\":false,\"privileged_without_host_devices_all_devices_allowed\":false,\"baseRuntimeSpec\":\"\",\"cniConfDir\":\"\",\"cniMaxConfNum\":0,\"snapshotter\":\"\",\"sandboxer\":\"podsandbox\",\"io_type\":\"\"}},\"ignoreBlockIONotEnabledErrors\":false,\"ignoreRdtNotEnabledErrors\":false},\"cni\":{\"binDir\":\"/opt/cni/bin\",\"confDir\":\"/etc/cni/net.d\",\"maxConfNum\":1,\"setupSerially\":false,\"confTemplate\":\"\",\"ipPref\":\"\",\"useInternalLoopback\":false},\"enableSelinux\":false,\"selinuxCategoryRange\":1024,\"maxContainerLogSize\":16384,\"disableApparmor\":false,\"restrictOOMScoreAdj\":false,\"disableProcMount\":false,\"unsetSeccompProfile\":\"\",\"tolerateMissingHugetlbController\":true,\"disableHugetlbController\":true,\"device_ownership_from_security_context\":false,\"ignoreImageDefinedVolumes\":false,\"netnsMountsUnderStateDir\":false,\"enableUnprivilegedPorts\":true,\"enableUnprivilegedICMP\":true,\"enableCDI\":true,\"cdiSpecDirs\":[\"/etc/cdi\",\"/var/run/cdi\"],\"drainExecSyncIOTimeout\":\"0s\",\"ignoreDeprecationWarnings\":null,\"containerdRootDir\":\"/var/lib/docker/containerd/daemon\",\"containerdEndpoint\":\"/var/run/docker/containerd/containerd.sock\",\"rootDir\":\"/var/lib/docker/containerd/daemon/io.containerd.grpc.v1.cri\",\"stateDir\":\"/var/run/docker/containerd/daemon/io.containerd.grpc.v1.cri\"}"
time="2024-12-13T21:20:42.231021509Z" level=info msg="loading plugin" id=io.containerd.podsandbox.controller.v1.podsandbox type=io.containerd.podsandbox.controller.v1
time="2024-12-13T21:20:42.231735189Z" level=info msg="loading plugin" id=io.containerd.sandbox.controller.v1.shim type=io.containerd.sandbox.controller.v1
time="2024-12-13T21:20:42.232029029Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.sandbox-controllers type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232080709Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.sandboxes type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232095829Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.snapshots type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232108829Z" level=info msg="loading plugin" id=io.containerd.streaming.v1.manager type=io.containerd.streaming.v1
time="2024-12-13T21:20:42.232123829Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.streaming type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232136269Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.tasks type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232148429Z" level=info msg="loading plugin" id=io.containerd.transfer.v1.local type=io.containerd.transfer.v1
time="2024-12-13T21:20:42.232182229Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.transfer type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232197589Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.version type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232208429Z" level=info msg="loading plugin" id=io.containerd.monitor.container.v1.restart type=io.containerd.monitor.container.v1
time="2024-12-13T21:20:42.232250349Z" level=info msg="loading plugin" id=io.containerd.tracing.processor.v1.otlp type=io.containerd.tracing.processor.v1
time="2024-12-13T21:20:42.232266549Z" level=info msg="skip loading plugin" error="skip plugin: tracing endpoint not configured" id=io.containerd.tracing.processor.v1.otlp type=io.containerd.tracing.processor.v1
time="2024-12-13T21:20:42.232277389Z" level=info msg="loading plugin" id=io.containerd.internal.v1.tracing type=io.containerd.internal.v1
time="2024-12-13T21:20:42.232286989Z" level=info msg="skip loading plugin" error="skip plugin: tracing endpoint not configured" id=io.containerd.internal.v1.tracing type=io.containerd.internal.v1
time="2024-12-13T21:20:42.232297309Z" level=info msg="loading plugin" id=io.containerd.ttrpc.v1.otelttrpc type=io.containerd.ttrpc.v1
time="2024-12-13T21:20:42.232318189Z" level=info msg="loading plugin" id=io.containerd.grpc.v1.healthcheck type=io.containerd.grpc.v1
time="2024-12-13T21:20:42.232332869Z" level=info msg="loading plugin" id=io.containerd.nri.v1.nri type=io.containerd.nri.v1
time="2024-12-13T21:20:42.232382749Z" level=info msg="runtime interface created"
time="2024-12-13T21:20:42.232392109Z" level=info msg="created NRI interface"
time="2024-12-13T21:20:42.232636789Z" level=info msg=serving... address=/var/run/docker/containerd/containerd-debug.sock
time="2024-12-13T21:20:42.232702749Z" level=info msg=serving... address=/var/run/docker/containerd/containerd.sock.ttrpc
time="2024-12-13T21:20:42.232754309Z" level=info msg=serving... address=/var/run/docker/containerd/containerd.sock
time="2024-12-13T21:20:42.232775589Z" level=info msg="containerd successfully booted in 0.057581s"
time="2024-12-13T21:20:44.518672327Z" level=info msg="Loading containers: start."
time="2024-12-13T21:20:44.771754911Z" level=info msg="Loading containers: done."
time="2024-12-13T21:20:44.782627231Z" level=info msg="Docker daemon" commit=92a83937d0280dcbea92099b01e01aa4251c1777 containerd-snapshotter=false storage-driver=overlay2 version=dev
time="2024-12-13T21:20:44.782793271Z" level=info msg="Daemon has completed initialization"
time="2024-12-13T21:20:44.814319309Z" level=info msg="API listen on /var/run/docker.sock"
evaluating pipelines for package requirements
building test workspace in: '/tmp/melange-guest-2292031501-main' with apko
Error: rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 109346087047205543085)
Error running `chainctl auth token`: exit status 1
2024/12/13 21:20:45 [DEBUG] GET https://apk.cgr.dev/wolfi-presubmit/51164ad6350ce937b48ccdca507bcf69cc9ede41/apk-configuration
2024/12/13 21:20:46 [DEBUG] GET https://packages.wolfi.dev/os/apk-configuration
setting apk repositories: [https://apk.cgr.dev/wolfi-presubmit/51164ad6350ce937b48ccdca507bcf69cc9ede41 https://packages.wolfi.dev/os]
image configuration:
contents:
build repositories: []
runtime repositories: []
keyring: []
packages: [bash coreutils curl grep procps netcat-openbsd cloudflared busybox]
installing ncurses-terminfo-base (6.5_p20241006-r4)
installing ca-certificates-bundle (20241010-r2)
installing wolfi-baselayout (20230201-r15)
installing glibc (2.40-r3)
installing libgcc (14.2.0-r6)
installing ld-linux (2.40-r3)
installing glibc-locale-posix (2.40-r3)
installing ncurses (6.5_p20241006-r4)
installing bash (5.2.37-r2)
installing libxcrypt (4.4.36-r8)
installing libcrypt1 (2.40-r3)
installing busybox (1.37.0-r0)
installing cloudflared (2024.12.1-r1)
installing libattr1 (2.5.2-r4)
installing libacl1 (2.3.2-r4)
installing libcrypto3 (3.4.0-r4)
installing coreutils (9.5-r3)
installing libunistring (1.3-r1)
installing libidn2 (2.3.7-r3)
installing libpsl (0.21.5-r4)
installing libbrotlicommon1 (1.1.0-r4)
installing libbrotlidec1 (1.1.0-r4)
installing krb5-conf (1.0-r3)
installing libverto (0.3.2-r4)
installing keyutils-libs (1.6.3-r5)
installing libcom_err (1.47.1-r1)
installing libssl3 (3.4.0-r4)
installing krb5-libs (1.21.3-r2)
installing zlib (1.3.1-r4)
installing readline (8.2.13-r1)
installing sqlite-libs (3.47.2-r0)
installing heimdal-libs (7.8.0-r7)
installing gdbm (1.24-r1)
installing cyrus-sasl (2.1.28-r5)
installing libevent (2.1.12-r6)
installing libldap (2.6.9-r0)
installing libnghttp2-14 (1.64.0-r1)
installing libcurl-openssl4 (8.11.1-r0)
installing curl (8.11.1-r0)
installing libpcre2-8-0 (10.44-r2)
installing grep (3.11-r2)
installing libmd (1.1.0-r2)
installing libbsd (0.12.2-r1)
installing netcat-openbsd (1.226-r4)
installing libproc-2-0 (4.0.4-r2)
installing procps (4.0.4-r2)
installing wolfi-keys (1-r8)
installing apk-tools (2.14.4-r1)
installing wolfi-base (1-r6)
built image layer tarball as /tmp/apko-temp-259602474/apko-aarch64.tar.gz
using /tmp/apko-temp-259602474/apko-aarch64.tar.gz for image layer
OCI layer digest: sha256:c58c7f9edc1d93863c81a5ffb794fde31b23f63d67f8b0eaeaffb70c4949f9b3
OCI layer diffID: sha256:fb525400552709f2104d014ecd0c3390444dbd6da7bdf464f5dd789d7c340367
saving OCI image locally: apko.local/cache:c843f37b9dfbf6cef2a75bd1facb7389e4b6aa9164f5d3616b6e7985b376ab8e
skipping local domain tagging apko.local/cache:c843f37b9dfbf6cef2a75bd1facb7389e4b6aa9164f5d3616b6e7985b376ab8e as index.docker.io/library/melange:latest
populating workspace /tmp/melange-workspace-2204920034 from cloudflared
ImgRef = apko.local/cache:c843f37b9dfbf6cef2a75bd1facb7389e4b6aa9164f5d3616b6e7985b376ab8e
Indexes
https://apk.cgr.dev/wolfi-presubmit/51164ad6350ce937b48ccdca507bcf69cc9ede41
Packages
- ✅ cloudflared (success | 43s | x86_64 logs | aarch64 logs)
Tests
- ✅ cloudflared (success | 17s | x86_64 logs | aarch64 logs)
More Observability
Command
cg build log \
--build-id 24e0a846-bd4d-4c3d-85f7-111c4f0da7f1 \
--project prod-wolfi-os \
--cluster elastic-pre-a \
--namespace pre-wolfi \
--start 2024-12-13T21:18:01Z \
--end 2024-12-13T21:30:57Z \
--attrs pkg,arch
Loading