cilium/cilium · error

failed to read xfrm statistics: %w

Error message

failed to read xfrm statistics: %w

What it means

extractMaxSequenceNumber parses the output of `ip xfrm state list reqid 1`, extracting each state's oseq field with a regex and parsing it as hex. This error is thrown when a matched oseq value cannot be parsed by strconv.ParseInt, aborting computation of the maximum IPsec sequence number.

Source

Thrown at cilium-dbg/cmd/encrypt_status.go:297

		ListenPort: int64(wgDevice.ListenPort),
		PublicKey:  wgDevice.PublicKey.String(),
		PeerCount:  int64(len(wgDevice.Peers)),
	})

	return &result, nil
}

func getXfrmStats(mountPoint string) (int64, map[string]int64, error) {
	fs, err := procfs.NewDefaultFS()
	if mountPoint != "" {
		fs, err = procfs.NewFS(mountPoint)
	}
	if err != nil {
		return 0, nil, fmt.Errorf("cannot get a new proc FS: %w", err)
	}
	stats, err := fs.NewXfrmStat()
	if err != nil {
		return 0, nil, fmt.Errorf("failed to read xfrm statistics: %w", err)
	}
	v := reflect.ValueOf(stats)
	countErrors := int64(0)
	errorMap := make(map[string]int64)
	if v.Type().Kind() == reflect.Struct {
		for i := range v.NumField() {
			name := v.Type().Field(i).Name
			value := v.Field(i).Interface().(int)
			if value != 0 {
				countErrors += int64(value)
				errorMap[name] = int64(value)
			}
		}
	}
	return countErrors, errorMap, nil
}

func extractMaxSequenceNumber(ipOutput string) (int64, error) {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect `ip xfrm state list reqid 1` output manually for malformed oseq fields
2. Ensure the stock iproute2 `ip` binary is used (check PATH, remove wrappers/aliases)
3. Re-run after IPsec re-keying if a state was mid-update producing partial output
4. Patch the parser (or upgrade Cilium) if a new iproute2 format is the cause

Example fix

null

out, _ := exec.Command("ip", "xfrm", "state", "list", "reqid", "1").Output()
if !validOseqOutput(string(out)) {
    return fmt.Errorf("ip output contains unparseable oseq fields")
}

func validOseqOutput(output string) bool {
    re := regexp.MustCompile(`oseq[[:blank:]]0[xX]([[:xdigit:]]+)`)
    for _, m := range re.FindAllStringSubmatch(output, -1) {
        if _, err := strconv.ParseInt(m[1], 16, 64); err != nil { return false }
    }
    return true
}

maxSeq, err := maxSequenceNumber()
if err != nil && strings.Contains(err.Error(), "failed to parse sequence number") {
    log.Printf("iproute2 output not parseable; check `ip` binary and version: %v", err)
}

When it happens

Trigger: While running `cilium encrypt status` (dumpIPsecStatus → maxSequenceNumber → extractMaxSequenceNumber), the iproute2 output contains an `oseq 0x...` token whose captured substring is not valid base-16 (malformed, truncated, or non-hex output from a non-standard `ip` binary).

Common situations: Non-standard or patched iproute2 output; output truncated mid-token by the exec output capture; an `ip` shim/wrapper injecting extra text; extreme values exceeding int64 on 32-bit-like environments.

Related errors

• error getting IPsec max sequence number: %w
• IPSec output mark attribute missing from xfrm probe
• incorrect value for probed IPSec output mask attribute
• IPsec key has unsupported format
• IPsec key invalid [expected parts: 5, actual parts: %d]

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/bb5c1c91c556dd9e. Report an issue: GitHub.