cilium/cilium · error

error getting IPsec max sequence number: %w

Error message

error getting IPsec max sequence number: %w

What it means

dumpIPsecStatus calls maxSequenceNumber, which shells out to `ip xfrm state list reqid 1` and parses the oseq field of each state. This error wraps a failure of that parsing — the oseq hex value found by the regex could not be parsed by strconv.ParseInt — aborting IPsec status collection.

Source

Thrown at cilium-dbg/cmd/encrypt_status.go:248

	}

	// no ipsec state installed
	if keys == 0 {
		return nil, nil
	}

	var result models.IPsecStatus

	result.KeysInUse = int64(keys)

	result.DecryptInterfaces, err = getDecryptionInterfaces()
	if err != nil {
		return nil, fmt.Errorf("error getting IPsec decryption interfaces: %w", err)
	}

	result.MaxSeqNumber, err = maxSequenceNumber()
	if err != nil {
		return nil, fmt.Errorf("error getting IPsec max sequence number: %w", err)
	}

	errCount, errMap, err := getXfrmStats("")
	if err != nil {
		return nil, fmt.Errorf("error getting xfrm stats: %w", err)
	}

	result.ErrorCount = errCount
	result.XfrmErrors = errMap
	return &result, nil
}

func dumpWireGuardStatus() (*models.WireguardStatus, error) {
	wgClient, err := wgctrl.New()
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the iproute2 version and output: run `ip xfrm state list reqid 1` manually and inspect the oseq lines
2. Ensure a standard iproute2 `ip` binary is first in PATH for the user running the CLI
3. Retry after state re-keying; if output looks fine, upgrade/downgrade iproute2 to a version Cilium is tested with
4. Report/patch: the parse assumes hex oseq; a newer iproute2 decimal format would require updating the regex/parsing

Example fix

// before: implicit dependence on PATH
out, _ := exec.Command("ip", "xfrm", "state", "list", "reqid", "1").Output()
// after: pin an absolute path
out, _ := exec.Command("/sbin/ip", "xfrm", "state", "list", "reqid", "1").Output()

out, err := exec.Command("sh", "-c", "ip xfrm state list reqid 1 | head -50").Output()
if err != nil {
    return fmt.Errorf("ip xfrm output unavailable: %w", err)
}
for _, line := range strings.Split(string(out), "\n") {
    if i := strings.Index(line, "oseq 0x"); i >= 0 {
        tok := strings.Fields(line[i:])[1][2:]
        if _, err := strconv.ParseInt(tok, 16, 64); err != nil {
            return fmt.Errorf("unexpected iproute2 oseq format: %s", line)
        }
    }
}

func validOseqOutput(output string) bool {
    re := regexp.MustCompile(`oseq[[:blank:]]0[xX][[:xdigit:]]+`)
    for _, m := range re.FindAllString(output, -1) {
        hex := m[strings.LastIndex(m, "0x"):]
        if _, err := strconv.ParseInt(hex, 16, 64); err != nil { return false }
    }
    return true
}

When it happens

Trigger: The `ip` (iproute2) output contains a line matching the `oseq 0x...` regex whose captured text is not valid hex (unexpected iproute2 output format, truncated output, or a modified/aliased `ip` binary producing non-standard output) while running `cilium encrypt status`.

Common situations: Very old or very new iproute2 versions changing `ip xfrm state` output formatting; a locale/PATH issue causing a different `ip` to be executed; piping or wrapping `ip` via a shim that alters output.

Related errors

• failed to read xfrm statistics: %w
• failed to parse sequence number '%s': %w
• IPSec output mark attribute missing from xfrm probe
• incorrect value for probed IPSec output mask attribute
• IPsec key has unsupported format

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/6e2eb91009002774. Report an issue: GitHub.