cilium/cilium · error

failed to parse sequence number '%s': %w

Error message

failed to parse sequence number '%s': %w

What it means

maxSequenceNumber shells out to `ip xfrm state list reqid <DefaultReqID>` to find the highest IPsec output sequence number. This error wraps any failure of that exec command — the `ip` binary is missing from PATH, the caller lacks privileges to list XFRM states, or the command exits non-zero — aborting IPsec status collection.

Source

Thrown at cilium-dbg/cmd/encrypt_status.go:322

			name := v.Type().Field(i).Name
			value := v.Field(i).Interface().(int)
			if value != 0 {
				countErrors += int64(value)
				errorMap[name] = int64(value)
			}
		}
	}
	return countErrors, errorMap, nil
}

func extractMaxSequenceNumber(ipOutput string) (int64, error) {
	maxSeqNum := int64(0)
	for line := range strings.SplitSeq(ipOutput, "\n") {
		matched := regex.FindStringSubmatchIndex(line)
		if matched != nil {
			oseq, err := strconv.ParseInt(line[matched[2]:matched[3]], 16, 64)
			if err != nil {
				return 0, fmt.Errorf("failed to parse sequence number '%s': %w",
					line[matched[2]:matched[3]], err)
			}
			if oseq > maxSeqNum {
				maxSeqNum = oseq
			}
		}
	}
	return maxSeqNum, nil
}

func maxSequenceNumber() (string, error) {
	out, err := exec.Command("ip", "xfrm", "state", "list", "reqid", ciliumReqId).Output()
	if err != nil {
		return "", fmt.Errorf("cannot get xfrm states: %w", err)
	}
	maxSeqNum, err := extractMaxSequenceNumber(string(out))
	if err != nil {
		return "", err

View on GitHub (pinned to ac7b90affa)

Solutions

1. Install iproute2 in the environment/container image where the CLI runs
2. Run the command as root / with NET_ADMIN capability
3. Verify manually: `ip xfrm state list reqid 1` should succeed on the node
4. If the wrapped netlink error is EPERM/ENOENT, use safenetlink.XfrmStateList (as dumpIPsecStatus already does) instead of exec'ing `ip`

Example fix

// before
out, err := exec.Command("ip", "xfrm", "state", "list", "reqid", "1").Output()
// after: surface stderr for diagnosability
out, err := exec.Command("ip", "xfrm", "state", "list", "reqid", "1").CombinedOutput()
if err != nil {
    return "", fmt.Errorf("cannot get xfrm states (is iproute2 installed? root?): %w: %s", err, out)
}

if _, err := exec.LookPath("ip"); err != nil {
    return fmt.Errorf("iproute2 `ip` binary not found in PATH: %w", err)
}
if os.Geteuid() != 0 {
    return fmt.Errorf("listing xfrm states requires root")
}

func isExecMissingBinary(err error) bool {
    var execErr *exec.Error
    return errors.As(err, &execErr)
}

var execErr *exec.Error
if errors.As(err, &execErr) && execErr.Name == "ip" {
    // iproute2 missing — install iproute2 instead of retrying
} else if isPermission(err) {
    // retry with elevated privileges
}

When it happens

Trigger: Running `cilium encrypt status` with IPsec states installed (keys > 0) on a host where the exec of `ip xfrm state list reqid 1` fails: iproute2 not installed in the container image, non-root execution without NET_ADMIN, or netlink error propagating as a non-zero exit.

Common situations: Slim container images without iproute2; running the cilium-dbg binary in a debug container lacking NET_ADMIN; PATH issues in minimal debug pods.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• error getting IPsec max sequence number: %w
• IPSec output mark attribute missing from xfrm probe
• incorrect value for probed IPSec output mask attribute
• cannot get xfrm state: %w
• error counting IPsec keys: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/fc17199e722c22ea. Report an issue: GitHub.