Fix computation of IPsec max. sequence number

cilium/cmd/encrypt_status.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"reflect"
 	"regexp"
+	"strconv"
 	"strings"
 
 	"github.com/prometheus/procfs"
@@ -30,7 +31,7 @@ type void struct{}
 var (
 	voidType    void
 	countErrors int
-	regex       = regexp.MustCompile("oseq[[:blank:]](0[xX][[:xdigit:]]+)?")
+	regex       = regexp.MustCompile("oseq[[:blank:]]0[xX]([[:xdigit:]]+)")
 )
 
 var encryptStatusCmd = &cobra.Command{
@@ -89,27 +90,36 @@ func countUniqueIPsecKeys() int {
 	return len(keys)
 }
 
-func maxSequenceNumber() string {
-	maxSeqNum := "0"
-	out, err := exec.Command("ip", "xfrm", "state", "list", "reqid", ciliumReqId).Output()
-	if err != nil {
-		Fatalf("Cannot get xfrm states: %s", err)
-	}
-	commandOutput := string(out)
-	lines := strings.Split(commandOutput, "\n")
+func extractMaxSequenceNumber(ipOutput string) int64 {
+	maxSeqNum := int64(0)
+	lines := strings.Split(ipOutput, "\n")
 	for _, line := range lines {
 		matched := regex.FindStringSubmatchIndex(line)
 		if matched != nil {
-			oseq := line[matched[2]:matched[3]]
+			oseq, err := strconv.ParseInt(line[matched[2]:matched[3]], 16, 64)
+			if err != nil {
+				Fatalf("Failed to parse sequence number '%s': %s",
+					line[matched[2]:matched[3]], err)
+			}
 			if oseq > maxSeqNum {
 				maxSeqNum = oseq
 			}
 		}
 	}
-	if maxSeqNum == "0" {
+	return maxSeqNum
+}
+
+func maxSequenceNumber() string {
+	out, err := exec.Command("ip", "xfrm", "state", "list", "reqid", ciliumReqId).Output()
+	if err != nil {
+		Fatalf("Cannot get xfrm states: %s", err)
+	}
+	commandOutput := string(out)
+	maxSeqNum := extractMaxSequenceNumber(commandOutput)
+	if maxSeqNum == 0 {
 		return "N/A"
 	}
-	return fmt.Sprintf("%s/0xffffffff", maxSeqNum)
+	return fmt.Sprintf("0x%x/0xffffffff", maxSeqNum)
 }
 
 func getEncryptionMode() {

cilium/cmd/encrypt_status_test.go

@@ -119,3 +119,43 @@ func (s *EncryptStatusSuite) TestGetXfrmStats(c *C) {
 	}
 	c.Assert(currentCount, Equals, errCount)
 }
+
+func (s *EncryptStatusSuite) TestExtractMaxSequenceNumber(c *C) {
+	ipOutput := `src 10.84.1.32 dst 10.84.0.30
+	proto esp spi 0x00000003 reqid 1 mode tunnel
+	replay-window 0
+	mark 0x3cb23e00/0xffffff00 output-mark 0xe00/0xf00
+	aead rfc4106(gcm(aes)) 0x64ad37a9d8a8f20fb2e74ef6000f9d580898719f 128
+	anti-replay context: seq 0x0, oseq 0xc3, bitmap 0x00000000
+	sel src 0.0.0.0/0 dst 0.0.0.0/0
+src 0.0.0.0 dst 10.84.1.32
+	proto esp spi 0x00000003 reqid 1 mode tunnel
+	replay-window 0
+	mark 0xd00/0xf00 output-mark 0xd00/0xf00
+	aead rfc4106(gcm(aes)) 0x64ad37a9d8a8f20fb2e74ef6000f9d580898719f 128
+	anti-replay context: seq 0x0, oseq 0x1410, bitmap 0x00000000
+	sel src 0.0.0.0/0 dst 0.0.0.0/0
+src 10.84.1.32 dst 10.84.2.145
+	proto esp spi 0x00000003 reqid 1 mode tunnel
+	replay-window 0
+	mark 0x7e63e00/0xffffff00 output-mark 0xe00/0xf00
+	aead rfc4106(gcm(aes)) 0x64ad37a9d8a8f20fb2e74ef6000f9d580898719f 128
+	anti-replay context: seq 0x0, oseq 0x13e0, bitmap 0x00000000
+	sel src 0.0.0.0/0 dst 0.0.0.0/0`
+
+	maxSeqNumber := extractMaxSequenceNumber(ipOutput)
+	c.Assert(maxSeqNumber, Equals, int64(0x1410))
+}
+
+// Attempt to simulate a case where the output would be interrupted mid-sentence.
+func (s *EncryptStatusSuite) TestExtractMaxSequenceNumberError(c *C) {
+	ipOutput := `src 10.84.1.32 dst 10.84.0.30
+	proto esp spi 0x00000003 reqid 1 mode tunnel
+	replay-window 0
+	mark 0x3cb23e00/0xffffff00 output-mark 0xe00/0xf00
+	aead rfc4106(gcm(aes)) 0x64ad37a9d8a8f20fb2e74ef6000f9d580898719f 128
+	anti-replay context: seq 0x0, oseq 0x`
+
+	maxSeqNumber := extractMaxSequenceNumber(ipOutput)
+	c.Assert(maxSeqNumber, Equals, int64(0))
+}