{"record":{"id":"6e2eb91009002774","repo":"cilium/cilium","slug":"error-getting-ipsec-max-sequence-number-w","errorCode":null,"errorMessage":"error getting IPsec max sequence number: %w","messagePattern":"error getting IPsec max sequence number: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-dbg/cmd/encrypt_status.go","lineNumber":248,"sourceCode":"\t}\n\n\t// no ipsec state installed\n\tif keys == 0 {\n\t\treturn nil, nil\n\t}\n\n\tvar result models.IPsecStatus\n\n\tresult.KeysInUse = int64(keys)\n\n\tresult.DecryptInterfaces, err = getDecryptionInterfaces()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting IPsec decryption interfaces: %w\", err)\n\t}\n\n\tresult.MaxSeqNumber, err = maxSequenceNumber()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting IPsec max sequence number: %w\", err)\n\t}\n\n\terrCount, errMap, err := getXfrmStats(\"\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting xfrm stats: %w\", err)\n\t}\n\n\tresult.ErrorCount = errCount\n\tresult.XfrmErrors = errMap\n\treturn &result, nil\n}\n\nfunc dumpWireGuardStatus() (*models.WireguardStatus, error) {\n\twgClient, err := wgctrl.New()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-dbg/cmd/encrypt_status.go#L230-L266","documentation":"dumpIPsecStatus calls maxSequenceNumber, which shells out to `ip xfrm state list reqid 1` and parses the oseq field of each state. This error wraps a failure of that parsing — the oseq hex value found by the regex could not be parsed by strconv.ParseInt — aborting IPsec status collection.","triggerScenarios":"The `ip` (iproute2) output contains a line matching the `oseq 0x...` regex whose captured text is not valid hex (unexpected iproute2 output format, truncated output, or a modified/aliased `ip` binary producing non-standard output) while running `cilium encrypt status`.","commonSituations":"Very old or very new iproute2 versions changing `ip xfrm state` output formatting; a locale/PATH issue causing a different `ip` to be executed; piping or wrapping `ip` via a shim that alters output.","solutions":["Check the iproute2 version and output: run `ip xfrm state list reqid 1` manually and inspect the oseq lines","Ensure a standard iproute2 `ip` binary is first in PATH for the user running the CLI","Retry after state re-keying; if output looks fine, upgrade/downgrade iproute2 to a version Cilium is tested with","Report/patch: the parse assumes hex oseq; a newer iproute2 decimal format would require updating the regex/parsing"],"exampleFix":"// before: implicit dependence on PATH\nout, _ := exec.Command(\"ip\", \"xfrm\", \"state\", \"list\", \"reqid\", \"1\").Output()\n// after: pin an absolute path\nout, _ := exec.Command(\"/sbin/ip\", \"xfrm\", \"state\", \"list\", \"reqid\", \"1\").Output()","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"sh\", \"-c\", \"ip xfrm state list reqid 1 | head -50\").Output()\nif err != nil {\n    return fmt.Errorf(\"ip xfrm output unavailable: %w\", err)\n}\nfor _, line := range strings.Split(string(out), \"\\n\") {\n    if i := strings.Index(line, \"oseq 0x\"); i >= 0 {\n        tok := strings.Fields(line[i:])[1][2:]\n        if _, err := strconv.ParseInt(tok, 16, 64); err != nil {\n            return fmt.Errorf(\"unexpected iproute2 oseq format: %s\", line)\n        }\n    }\n}","typeGuard":"func validOseqOutput(output string) bool {\n    re := regexp.MustCompile(`oseq[[:blank:]]0[xX][[:xdigit:]]+`)\n    for _, m := range re.FindAllString(output, -1) {\n        hex := m[strings.LastIndex(m, \"0x\"):]\n        if _, err := strconv.ParseInt(hex, 16, 64); err != nil { return false }\n    }\n    return true\n}","tryCatchPattern":null,"preventionTips":["Pin a tested iproute2 version in debug images","Do not wrap/shim the `ip` binary on nodes","Verify `ip xfrm state list` output format after iproute2 upgrades"],"tags":["ipsec","xfrm","parsing","iproute2"],"backgroundTag":"xfrm-output-parse-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}