Release 2021.5.9

CHANGES.md

@@ -1,5 +1,12 @@
 **Experimental**: This is a new format for release notes. The format and availability is subject to change.
 
+## 2021.5.9
+### New Features
+- Uses new Worker based login helper service to facilitate token exchange in cloudflared flows.
+
+### Bug Fixes
+- Fixes Centos-7 builds.
+
 ## 2021.5.8
 ### New Features
 - When creating a DNS record to point a hostname at a tunnel, you can now use --overwrite-dns to overwrite any existing

RELEASE_NOTES

@@ -1,3 +1,8 @@
+2021.5.9
+- 2021-05-20 TUN-4426: Fix centos builds
+- 2021-05-20 Update changelog
+- 2021-04-30 AUTH-3426: Point to new transfer service URL and eliminate PUT /ok
+
 2021.5.8
 - 2021-05-14 TUN-4419: Improve error message when cloudflared cannot reach origin
 - 2021-05-19 TUN-4425: --overwrite-dns flag for in adhoc and route dns cmds

cfsetup.yaml

@@ -279,6 +279,7 @@ centos-7:
       - https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
     pre-cache:
       - yum install -y fakeroot
+      - yum upgrade -y binutils-2.27-44.base.el7.x86_64
       - wget https://golang.org/dl/go1.16.3.linux-amd64.tar.gz -P /tmp/
       - tar -C /usr/local -xzf /tmp/go1.16.3.linux-amd64.tar.gz
     post-cache:
@@ -291,6 +292,7 @@ centos-7:
     builddeps: *el7_builddeps
     pre-cache:
       - yum install -y fakeroot
+      - yum upgrade -y binutils-2.27-44.base.el7.x86_64
       - wget https://golang.org/dl/go1.16.3.linux-amd64.tar.gz -P /tmp/
       - tar -C /usr/local -xzf /tmp/go1.16.3.linux-amd64.tar.gz
     post-cache:

cmd/cloudflared/tunnel/login.go

@@ -20,7 +20,7 @@ import (
 
 const (
 	baseLoginURL     = "https://dash.cloudflare.com/argotunnel"
-	callbackStoreURL = "https://login.argotunnel.com/"
+	callbackStoreURL = "https://login.cloudflareaccess.org/"
 )
 
 func buildLoginSubcommand(hidden bool) *cli.Command {

token/transfer.go

@@ -15,7 +15,7 @@ import (
 )
 
 const (
-	baseStoreURL  = "https://login.argotunnel.com/"
+	baseStoreURL  = "https://login.cloudflareaccess.org/"
 	clientTimeout = time.Second * 60
 )
 
@@ -83,11 +83,13 @@ func buildRequestURL(baseURL *url.URL, key, value string, cli, useHostOnly bool)
 	if useHostOnly {
 		baseURL.Path = ""
 	}
+	// TODO: pass arg for tunnel login
 	if !cli {
 		return baseURL.String(), nil
 	}
 	q.Set("redirect_url", baseURL.String()) // we add the token as a query param on both the redirect_url and the main url
 	q.Set("send_org_token", "true")         // indicates that the cli endpoint should return both the org and app token
+	q.Set("edge_token_transfer", "true")    // use new LoginHelper service built on workers
 	baseURL.RawQuery = q.Encode()           // and this actual baseURL.
 	baseURL.Path = "cdn-cgi/access/cli"
 	return baseURL.String(), nil
@@ -103,9 +105,6 @@ func transferRequest(requestURL string, log *zerolog.Logger) ([]byte, string, er
 		if err != nil {
 			return nil, "", err
 		} else if len(buf) > 0 {
-			if err := putSuccess(client, requestURL); err != nil {
-				log.Err(err).Msg("Failed to update resource success")
-			}
 			return buf, key, nil
 		}
 	}
@@ -136,22 +135,3 @@ func poll(client *http.Client, requestURL string, log *zerolog.Logger) ([]byte,
 	}
 	return buf.Bytes(), resp.Header.Get("service-public-key"), nil
 }
-
-// putSuccess tells the server we successfully downloaded the resource
-func putSuccess(client *http.Client, requestURL string) error {
-	req, err := http.NewRequest("PUT", requestURL+"/ok", nil)
-	if err != nil {
-		return err
-	}
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return err
-	}
-
-	resp.Body.Close()
-	if resp.StatusCode != 200 {
-		return fmt.Errorf("HTTP Response Status Code: %d", resp.StatusCode)
-	}
-	return nil
-}