Affected by GO-2022-0457 and 16 other vulnerabilities

GO-2022-0457: Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium

GO-2022-0458: Improper Privilege Management in Cilium in github.com/cilium/cilium

GO-2022-0959: Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium

GO-2023-1643: Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium

GO-2023-1730: Debug mode leaks confidential data in Cilium in github.com/cilium/cilium

GO-2023-1785: Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium

GO-2023-2078: Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium

GO-2023-2079: Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium

GO-2023-2080: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium

GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium

GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium

metricsmap

package

v1.11.2 Latest Latest Go to latest Published: Feb 23, 2022 License: Apache-2.0 Imports: 8 Imported by: 21

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Overview ¶

Package metricsmap represents the BPF metrics map in the BPF programs. It is implemented as a hash table containing an entry of different drop and forward counts for different drop/forward reasons and directions. +groupName=maps

Index ¶

Constants
Variables
func MetricDirection(dir uint8) string
func SyncMetricsMap(ctx context.Context) error
type IterateCallback
type Key
type MetricsMap
type Value
type Values
- func (vs Values) Bytes() uint64
- func (vs Values) Count() uint64

Constants ¶

View Source

const (
	// MapName for metrics map.
	MapName = "cilium_metrics"
	// MaxEntries is the maximum number of keys that can be present in the
	// Metrics Map.
	//
	// Currently max. 2 bits of the Key.Dir member are used (unknown,
	// ingress or egress). Thus we can reduce from the theoretical max. size
	// of 2**16 (2 uint8) to 2**10 (1 uint8 + 2 bits).
	MaxEntries = 1024
)

Variables ¶

View Source

var (
	// Metrics is the bpf metrics map
	Metrics metricsMap
)

Functions ¶

func MetricDirection ¶

func MetricDirection(dir uint8) string

MetricDirection gets the direction in human readable string format

func SyncMetricsMap ¶

func SyncMetricsMap(ctx context.Context) error

SyncMetricsMap is called periodically to sync off the metrics map by aggregating it into drops (by drop reason and direction) and forwards (by direction) with the prometheus server.

Types ¶

type IterateCallback ¶

type IterateCallback func(*Key, *Values)

IterateCallback represents the signature of the callback function expected by the IterateWithCallback method, which in turn is used to iterate all the keys/values of a metrics map.

type Key ¶

type Key struct {
	Reason   uint8     `align:"reason"`
	Dir      uint8     `align:"dir"`
	Reserved [3]uint16 `align:"reserved"`
}

Key must be in sync with struct metrics_key in <bpf/lib/common.h>

func (*Key) Direction ¶

func (k *Key) Direction() string

Direction gets the direction in human readable string format

func (*Key) DropForwardReason ¶

func (k *Key) DropForwardReason() string

DropForwardReason gets the forwarded/dropped reason in human readable string format

func (*Key) IsDrop ¶

func (k *Key) IsDrop() bool

IsDrop checks if the reason is drop or not.

type MetricsMap ¶

type MetricsMap interface {
	IterateWithCallback(IterateCallback) error
}

MetricsMap interface represents a metrics map, and can be reused to implement mock maps for unit tests.

type Value ¶

type Value struct {
	Count uint64 `align:"count"`
	Bytes uint64 `align:"bytes"`
}

Value must be in sync with struct metrics_value in <bpf/lib/common.h>

type Values ¶

type Values []Value

Values is a slice of Values

func (Values) Bytes ¶

func (vs Values) Bytes() uint64

Bytes returns the sum of all the per-CPU bytes values

func (Values) Count ¶

func (vs Values) Count() uint64

Count returns the sum of all the per-CPU count values

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL