{"record":{"id":"f6f927f396c9c110","repo":"cilium/cilium","slug":"incorrect-value-for-probed-ipsec-output-mask-attri","errorCode":null,"errorMessage":"incorrect value for probed IPSec output mask attribute","messagePattern":"incorrect value for probed IPSec output mask attribute","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/ipsec/probe_linux.go","lineNumber":80,"sourceCode":"\tstate := initDummyXfrmState()\n\terr := createDummyXfrmState(state)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer func() {\n\t\t//nolint:forbidigo\n\t\te = errors.Join(e, netlink.XfrmStateDel(state))\n\t}()\n\n\tvar probedState *netlink.XfrmState\n\tif probedState, err = netlink.XfrmStateGet(state); err != nil {\n\t\treturn err\n\t}\n\tif probedState == nil || probedState.OutputMark == nil {\n\t\treturn errors.New(\"IPSec output mark attribute missing from xfrm probe\")\n\t}\n\tif probedState.OutputMark.Mask != linux_defaults.RouteMarkMask {\n\t\treturn errors.New(\"incorrect value for probed IPSec output mask attribute\")\n\t}\n\treturn\n}\n","sourceCodeStart":62,"sourceCodeEnd":84,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/ipsec/probe_linux.go#L62-L84","documentation":"This is the second validation in ProbeXfrmStateOutputMask: the kernel DID return the OUTPUT_MARK attribute (OutputMark != nil) but its Mask field does not equal linux_defaults.RouteMarkMask (0x600). Cilium requires the exact route mark mask so its IPSec routing (mark-based interface selection) works; a different mask means the kernel probe state was modified or the constant mismatches what the kernel applied.","triggerScenarios":"ProbeXfrmStateOutputMask fetches a probed xfrm state whose OutputMark.Mask differs from linux_defaults.RouteMarkMask; typically the xfrm state table was polluted by another component (e.g. another IPSec stack such as strongSwan or a prior Cilium run) that owns the probe state key.","commonSituations":"Conflicting IPSec software installed on the node creating/overwriting xfrm states with the same SPI/mark; leftover xfrm state from a previous Cilium installation; custom linux_defaults mark configuration that no longer matches the kernel default.","solutions":["Flush stale xfrm states on the node: 'ip xfrm state flush' (or 'ip xfrm state delete' for specific entries) and restart the agent so the probe recreates its state","Check for other IPSec software (strongSwan, Libreswan, WireGuard+masks) on the node and remove conflicting configurations","Verify linux_defaults.RouteMarkMask is not overridden by conflicting mark settings in the Cilium config (e.g. other components using the same mark bits)","Reboot the node if xfrm state cannot be safely flushed while in use"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Ensure no conflicting xfrm states/marks exist before starting\nout, err := exec.Command(\"ip\", \"xfrm\", \"state\").Output()\nif err == nil && strings.Contains(string(out), \"mark\") && conflictingOwner(string(out)) {\n    return fmt.Errorf(\"conflicting xfrm state mark detected; flush with 'ip xfrm state flush'\")\n}","typeGuard":"func outputMarkMatchesDefault(state *netlink.XfrmState, want uint32) bool {\n    return state != nil && state.OutputMark != nil && state.OutputMark.Mask == want\n}","tryCatchPattern":"if err := ipsec.ProbeXfrmStateOutputMask(); err != nil {\n    if strings.Contains(err.Error(), \"incorrect value\") {\n        _ = exec.Command(\"ip\", \"xfrm\", \"state\", \"flush\").Run() // clear stale states, then retry once\n        return ipsec.ProbeXfrmStateOutputMask()\n    }\n    return err\n}","preventionTips":["Do not run other IPSec stacks (strongSwan etc.) alongside Cilium IPSec on the same node","Flush xfrm state after uninstalling a previous Cilium install","Keep mark values consistent with linux_defaults across upgrades","Reboot nodes cleanly when IPSec state may be stale"],"tags":["ipsec","xfrm","netlink","mark-conflict"],"backgroundTag":"xfrm-mark-mismatch","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}