{"record":{"id":"6c58ac54e9bd3fb1","repo":"cloudflare/cloudflared","slug":"group-id-d-is-not-between-ping-group-d-to-d","errorCode":null,"errorMessage":"Group ID %d is not between ping group %d to %d","messagePattern":"Group ID (.+?) is not between ping group (.+?) to (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/icmp_linux.go","lineNumber":92,"sourceCode":"func checkInPingGroup() error {\n\tfile, err := os.ReadFile(pingGroupPath)\n\tif err != nil {\n\t\treturn err\n\t}\n\tgroupID := uint64(os.Getegid())\n\t// Example content: 999\t   59999\n\tfound := findGroupIDRegex.FindAll(file, 2)\n\tif len(found) == 2 {\n\t\tgroupMin, err := strconv.ParseUint(string(found[0]), 10, 32)\n\t\tif err != nil {\n\t\t\treturn errors.Wrapf(err, \"failed to determine minimum ping group ID\")\n\t\t}\n\t\tgroupMax, err := strconv.ParseUint(string(found[1]), 10, 32)\n\t\tif err != nil {\n\t\t\treturn errors.Wrapf(err, \"failed to determine maximum ping group ID\")\n\t\t}\n\t\tif groupID < groupMin || groupID > groupMax {\n\t\t\treturn fmt.Errorf(\"Group ID %d is not between ping group %d to %d\", groupID, groupMin, groupMax)\n\t\t}\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"did not find group range in %s\", pingGroupPath)\n}\n\nfunc (ip *icmpProxy) Request(ctx context.Context, pk *packet.ICMP, responder ICMPResponder) error {\n\tctx, span := responder.RequestSpan(ctx, pk)\n\tdefer responder.ExportSpan()\n\n\toriginalEcho, err := getICMPEcho(pk.Message)\n\tif err != nil {\n\t\ttracing.EndWithErrorStatus(span, err)\n\t\treturn err\n\t}\n\tobserveICMPRequest(ip.logger, span, pk.Src.String(), pk.Dst.String(), originalEcho.ID, originalEcho.Seq)\n\n\tshouldReplaceFunnelFunc := createShouldReplaceFunnelFunc(ip.logger, responder, pk, originalEcho.ID)","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/icmp_linux.go#L74-L110","documentation":"On Linux, cloudflared's ICMP proxy needs to create raw ICMP sockets without root by writing to /proc/sys/net/ipv4/ping_group_range. checkInPingGroup parses the allowed min/max group IDs from that file and rejects the process's group if it falls outside the range. The error means the current group ID is not permitted to open unprivileged ping sockets.","triggerScenarios":"testPermission -> checkInPingGroup runs when cloudflared starts the Linux ICMP proxy; it fails when /proc/sys/net/ipv4/ping_group_range has a range (e.g. '1 0' default meaning disabled, or a narrow range) that does not contain the process's groupID.","commonSituations":"Default kernel settings where ping_group_range is '1 0' (disabled); running cloudflared as a non-root user whose group is outside the configured range; hardened/containerized environments with restricted ping_group_range.","solutions":["Widen the allowed range: `sudo sysctl -w net.ipv4.ping_group_range=\"0 2147483647\"` and persist it in /etc/sysctl.d/.","Check the current range with `cat /proc/sys/net/ipv4/ping_group_range` and run cloudflared under a group inside that range.","Alternatively run cloudflared as root (or with CAP_NET_RAW) so the group check is bypassed.","Verify the group of the running user with `id -g` and add the user to a permitted group if the range is intentionally narrow."],"exampleFix":"// before\n$ cat /proc/sys/net/ipv4/ping_group_range\n1\t0        # disabled -> Group ID 1000 is not between ping group 1 to 0\n// after\n$ sudo sysctl -w net.ipv4.ping_group_range=\"0 2147483647\"\n$ cat /proc/sys/net/ipv4/ping_group_range\n0\t2147483647","handlingStrategy":"validation","validationCode":"function canPingUnprivileged(): boolean {\n  const range = fs.readFileSync('/proc/sys/net/ipv4/ping_group_range', 'utf8').trim().split(/\\s+/).map(Number);\n  const gid = process.getgid();\n  return range.length === 2 && gid >= range[0] && gid <= range[1];\n}","typeGuard":"func pingGroupInRange(groupID uint32) (bool, error) {\n    data, err := os.ReadFile(pingGroupPath)\n    if err != nil { return false, err }\n    fields := strings.Fields(string(data))\n    if len(fields) != 2 { return false, fmt.Errorf(\"unexpected ping_group_range: %q\", data) }\n    min, _ := strconv.ParseUint(fields[0], 10, 32)\n    max, _ := strconv.ParseUint(fields[1], 10, 32)\n    return groupID >= uint32(min) && groupID <= uint32(max), nil\n}","tryCatchPattern":null,"preventionTips":["Set net.ipv4.ping_group_range='0 2147483647' in sysctl config on hosts running cloudflared as non-root.","Verify the running user's GID is inside ping_group_range before starting ICMP proxying.","In containers, pass the sysctl at launch (docker run --sysctl ...).","Prefer running with CAP_NET_RAW if group configuration is not possible."],"tags":["icmp","linux","permissions","ping-group-range","cloudflared"],"backgroundTag":"value-out-of-range","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}