Affected by GO-2024-2653 and 14 other vulnerabilities

GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

GO-2025-3415: DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium

GO-2025-3416: Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium

GO-2025-3560: Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium

GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

metricsmap

package

v1.15.1 Latest Latest Go to latest Published: Feb 14, 2024 License: Apache-2.0 Imports: 9 Imported by: 21

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Overview ¶

Package metricsmap represents the BPF metrics map in the BPF programs. It is implemented as a hash table containing an entry of different drop and forward counts for different drop/forward reasons and directions. +groupName=maps

Index ¶

Constants
Variables
func MetricDirection(dir uint8) string
func RegisterCollector()
type IterateCallback
type Key
type MetricsMap
type Value
type Values
- func (vs Values) Bytes() uint64
- func (vs Values) Count() uint64

Constants ¶

View Source

const (
	// MapName for metrics map.
	MapName = "cilium_metrics"
	// MaxEntries is the maximum number of keys that can be present in the
	// Metrics Map.
	//
	// Currently max. 2 bits of the Key.Dir member are used (unknown,
	// ingress or egress). Thus we can reduce from the theoretical max. size
	// of 2**16 (2 uint8) to 2**10 (1 uint8 + 2 bits).
	MaxEntries = 1024
)

Variables ¶

View Source

var Cell = cell.Module(
	"metricsmap",
	"eBPF Metrics Map",
	cell.Invoke(RegisterCollector),
)

View Source

var (
	// Metrics is the bpf metrics map
	Metrics = metricsMap{ebpf.NewMap(&ebpf.MapSpec{
		Name:       MapName,
		Type:       ebpf.PerCPUHash,
		KeySize:    uint32(unsafe.Sizeof(Key{})),
		ValueSize:  uint32(unsafe.Sizeof(Value{})),
		MaxEntries: MaxEntries,
		Pinning:    ebpf.PinByName,
	})}
)

Functions ¶

func MetricDirection ¶

func MetricDirection(dir uint8) string

MetricDirection gets the direction in human readable string format

func RegisterCollector ¶ added in v1.15.0

func RegisterCollector()

Types ¶

type IterateCallback ¶

type IterateCallback func(*Key, *Values)

IterateCallback represents the signature of the callback function expected by the IterateWithCallback method, which in turn is used to iterate all the keys/values of a metrics map.

type Key ¶

type Key struct {
	Reason   uint8     `align:"reason"`
	Dir      uint8     `align:"dir"`
	Reserved [3]uint16 `align:"reserved"`
}

Key must be in sync with struct metrics_key in <bpf/lib/common.h>

func (*Key) Direction ¶

func (k *Key) Direction() string

Direction gets the direction in human readable string format

func (*Key) DropForwardReason ¶

func (k *Key) DropForwardReason() string

DropForwardReason gets the forwarded/dropped reason in human readable string format

func (*Key) IsDrop ¶

func (k *Key) IsDrop() bool

IsDrop checks if the reason is drop or not.

type MetricsMap ¶

type MetricsMap interface {
	IterateWithCallback(IterateCallback) error
}

MetricsMap interface represents a metrics map, and can be reused to implement mock maps for unit tests.

type Value ¶

type Value struct {
	Count uint64 `align:"count"`
	Bytes uint64 `align:"bytes"`
}

Value must be in sync with struct metrics_value in <bpf/lib/common.h>

type Values ¶

type Values []Value

Values is a slice of Values

func (Values) Bytes ¶

func (vs Values) Bytes() uint64

Bytes returns the sum of all the per-CPU bytes values

func (Values) Count ¶

func (vs Values) Count() uint64

Count returns the sum of all the per-CPU count values

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL