Affected by GO-2023-2078 and 16 other vulnerabilities

GO-2023-2078: Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium

GO-2023-2079: Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium

GO-2023-2080: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium

GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium

GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

GO-2025-3415: DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium

GO-2025-3416: Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium

GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

gc

package

v1.14.0 Latest Latest Go to latest Published: Jul 27, 2023 License: Apache-2.0 Imports: 16 Imported by: 1

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Index ¶

Variables
func Enable(ipv4, ipv6 bool, restoredEndpoints []*endpoint.Endpoint, mgr EndpointManager, ...)
type EndpointManager
type SignalData
- func (d SignalData) String() string

Constants ¶

This section is empty.

Variables ¶

View Source

var Cell = cell.Invoke(registerSignalHandler)

Cell registers a signal handler for CT and NAT fill-up signals.

Functions ¶

func Enable ¶ added in v1.7.0

func Enable(ipv4, ipv6 bool, restoredEndpoints []*endpoint.Endpoint, mgr EndpointManager,
	nodeAddressing types.NodeAddressing)

Enable enables the connection tracking garbage collection. The restored endpoints and local node addresses are used to avoid GCing connections that may still be in use: connections of active endpoints and, in case the host firewall is enabled, connections of the local host.

Types ¶

type EndpointManager ¶

type EndpointManager interface {
	GetEndpoints() []*endpoint.Endpoint
}

EndpointManager is any type which returns the list of Endpoints which are globally exposed on the current node.

type SignalData ¶

type SignalData uint32

SignalData holds the IP address family type BPF program sent along with the SignalNatFillUp and SignalCTFillUp signals.

const (
	// SignalProtoV4 denotes IPv4 protocol
	SignalProtoV4 SignalData = iota
	// SignalProtoV6 denotes IPv6 protocol
	SignalProtoV6
	SignalProtoMax
)

func (SignalData) String ¶

func (d SignalData) String() string

String implements fmt.Stringer for SignalData

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL