Affected by GO-2023-2078 and 16 other vulnerabilities

GO-2023-2078: Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium

GO-2023-2079: Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium

GO-2023-2080: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium

GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium

GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

GO-2025-3415: DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium

GO-2025-3416: Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium

GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

metricsmap

package

v1.14.0 Latest Latest Go to latest Published: Jul 27, 2023 License: Apache-2.0 Imports: 8 Imported by: 21

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Overview ¶

Package metricsmap represents the BPF metrics map in the BPF programs. It is implemented as a hash table containing an entry of different drop and forward counts for different drop/forward reasons and directions. +groupName=maps

Index ¶

Constants
Variables
func MetricDirection(dir uint8) string
func SyncMetricsMap(ctx context.Context) error
type IterateCallback
type Key
type MetricsMap
type Value
type Values
- func (vs Values) Bytes() uint64
- func (vs Values) Count() uint64

Constants ¶

View Source

const (
	// MapName for metrics map.
	MapName = "cilium_metrics"
	// MaxEntries is the maximum number of keys that can be present in the
	// Metrics Map.
	//
	// Currently max. 2 bits of the Key.Dir member are used (unknown,
	// ingress or egress). Thus we can reduce from the theoretical max. size
	// of 2**16 (2 uint8) to 2**10 (1 uint8 + 2 bits).
	MaxEntries = 1024
)

Variables ¶

View Source

var (
	// Metrics is the bpf metrics map
	Metrics metricsMap
)

Functions ¶

func MetricDirection ¶

func MetricDirection(dir uint8) string

MetricDirection gets the direction in human readable string format

func SyncMetricsMap ¶

func SyncMetricsMap(ctx context.Context) error

SyncMetricsMap is called periodically to sync off the metrics map by aggregating it into drops (by drop reason and direction) and forwards (by direction) with the prometheus server.

Types ¶

type IterateCallback ¶

type IterateCallback func(*Key, *Values)

IterateCallback represents the signature of the callback function expected by the IterateWithCallback method, which in turn is used to iterate all the keys/values of a metrics map.

type Key ¶

type Key struct {
	Reason   uint8     `align:"reason"`
	Dir      uint8     `align:"dir"`
	Reserved [3]uint16 `align:"reserved"`
}

Key must be in sync with struct metrics_key in <bpf/lib/common.h>

func (*Key) Direction ¶

func (k *Key) Direction() string

Direction gets the direction in human readable string format

func (*Key) DropForwardReason ¶

func (k *Key) DropForwardReason() string

DropForwardReason gets the forwarded/dropped reason in human readable string format

func (*Key) IsDrop ¶

func (k *Key) IsDrop() bool

IsDrop checks if the reason is drop or not.

type MetricsMap ¶

type MetricsMap interface {
	IterateWithCallback(IterateCallback) error
}

MetricsMap interface represents a metrics map, and can be reused to implement mock maps for unit tests.

type Value ¶

type Value struct {
	Count uint64 `align:"count"`
	Bytes uint64 `align:"bytes"`
}

Value must be in sync with struct metrics_value in <bpf/lib/common.h>

type Values ¶

type Values []Value

Values is a slice of Values

func (Values) Bytes ¶

func (vs Values) Bytes() uint64

Bytes returns the sum of all the per-CPU bytes values

func (Values) Count ¶

func (vs Values) Count() uint64

Count returns the sum of all the per-CPU count values

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL