{"record":{"id":"fc17199e722c22ea","repo":"cilium/cilium","slug":"failed-to-parse-sequence-number-s-w","errorCode":null,"errorMessage":"failed to parse sequence number '%s': %w","messagePattern":"failed to parse sequence number '(.+?)': %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-dbg/cmd/encrypt_status.go","lineNumber":322,"sourceCode":"\t\t\tname := v.Type().Field(i).Name\n\t\t\tvalue := v.Field(i).Interface().(int)\n\t\t\tif value != 0 {\n\t\t\t\tcountErrors += int64(value)\n\t\t\t\terrorMap[name] = int64(value)\n\t\t\t}\n\t\t}\n\t}\n\treturn countErrors, errorMap, nil\n}\n\nfunc extractMaxSequenceNumber(ipOutput string) (int64, error) {\n\tmaxSeqNum := int64(0)\n\tfor line := range strings.SplitSeq(ipOutput, \"\\n\") {\n\t\tmatched := regex.FindStringSubmatchIndex(line)\n\t\tif matched != nil {\n\t\t\toseq, err := strconv.ParseInt(line[matched[2]:matched[3]], 16, 64)\n\t\t\tif err != nil {\n\t\t\t\treturn 0, fmt.Errorf(\"failed to parse sequence number '%s': %w\",\n\t\t\t\t\tline[matched[2]:matched[3]], err)\n\t\t\t}\n\t\t\tif oseq > maxSeqNum {\n\t\t\t\tmaxSeqNum = oseq\n\t\t\t}\n\t\t}\n\t}\n\treturn maxSeqNum, nil\n}\n\nfunc maxSequenceNumber() (string, error) {\n\tout, err := exec.Command(\"ip\", \"xfrm\", \"state\", \"list\", \"reqid\", ciliumReqId).Output()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"cannot get xfrm states: %w\", err)\n\t}\n\tmaxSeqNum, err := extractMaxSequenceNumber(string(out))\n\tif err != nil {\n\t\treturn \"\", err","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-dbg/cmd/encrypt_status.go#L304-L340","documentation":"maxSequenceNumber shells out to `ip xfrm state list reqid <DefaultReqID>` to find the highest IPsec output sequence number. This error wraps any failure of that exec command — the `ip` binary is missing from PATH, the caller lacks privileges to list XFRM states, or the command exits non-zero — aborting IPsec status collection.","triggerScenarios":"Running `cilium encrypt status` with IPsec states installed (keys > 0) on a host where the exec of `ip xfrm state list reqid 1` fails: iproute2 not installed in the container image, non-root execution without NET_ADMIN, or netlink error propagating as a non-zero exit.","commonSituations":"Slim container images without iproute2; running the cilium-dbg binary in a debug container lacking NET_ADMIN; PATH issues in minimal debug pods.","solutions":["Install iproute2 in the environment/container image where the CLI runs","Run the command as root / with NET_ADMIN capability","Verify manually: `ip xfrm state list reqid 1` should succeed on the node","If the wrapped netlink error is EPERM/ENOENT, use safenetlink.XfrmStateList (as dumpIPsecStatus already does) instead of exec'ing `ip`"],"exampleFix":"// before\nout, err := exec.Command(\"ip\", \"xfrm\", \"state\", \"list\", \"reqid\", \"1\").Output()\n// after: surface stderr for diagnosability\nout, err := exec.Command(\"ip\", \"xfrm\", \"state\", \"list\", \"reqid\", \"1\").CombinedOutput()\nif err != nil {\n    return \"\", fmt.Errorf(\"cannot get xfrm states (is iproute2 installed? root?): %w: %s\", err, out)\n}","handlingStrategy":"retry","validationCode":"if _, err := exec.LookPath(\"ip\"); err != nil {\n    return fmt.Errorf(\"iproute2 `ip` binary not found in PATH: %w\", err)\n}\nif os.Geteuid() != 0 {\n    return fmt.Errorf(\"listing xfrm states requires root\")\n}","typeGuard":"func isExecMissingBinary(err error) bool {\n    var execErr *exec.Error\n    return errors.As(err, &execErr)\n}","tryCatchPattern":"var execErr *exec.Error\nif errors.As(err, &execErr) && execErr.Name == \"ip\" {\n    // iproute2 missing — install iproute2 instead of retrying\n} else if isPermission(err) {\n    // retry with elevated privileges\n}","preventionTips":["Include iproute2 in debug container images","Run encryption diagnostics as root","Prefer netlink-based XFRM listing (safenetlink.XfrmStateList) over exec'ing `ip` in code"],"tags":["ipsec","xfrm","exec","iproute2","privileges"],"backgroundTag":"xfrm-state-list-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}