routechecks

Jul 24, 2024 GO-2024-3071 +1 more

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

Changes in this version

+ func CheckBackend(input Input) (bool, error)

+ func CheckGammaServiceAllowedForNamespace(input Input, parentRef gatewayv1.ParentReference) (bool, error)

+ func CheckHasServiceImportSupport(input Input) (bool, error)

+ func GetAllListenerHostNames(listeners []gatewayv1.Listener) []gatewayv1.Hostname

+ type CheckParentFunc func(input Input, ref gatewayv1.ParentReference) (bool, error)

type GRPCRouteInput

+ func (g *GRPCRouteInput) GetParentGammaService(parent gatewayv1.ParentReference) (*corev1.Service, error)

type HTTPRouteInput

+ func (h *HTTPRouteInput) GetParentGammaService(parent gatewayv1.ParentReference) (*corev1.Service, error)

type Input

+ GetParentGammaService func(parent gatewayv1.ParentReference) (*corev1.Service, error)

type TLSRouteInput

+ func (t *TLSRouteInput) GetParentGammaService(parent gatewayv1.ParentReference) (*corev1.Service, error)

Sep 20, 2024 GO-2024-3208

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Aug 12, 2024 GO-2024-3208

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Jul 11, 2024 GO-2024-3071 +3 more

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Jun 10, 2024 GO-2024-3071 +3 more

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

May 10, 2024 GO-2024-2922 +4 more

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Apr 11, 2024 GO-2024-2922 +4 more

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Mar 26, 2024 GO-2024-2922 +4 more

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Mar 13, 2024 GO-2024-2666 +5 more

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Feb 14, 2024 GO-2024-2653 +8 more

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Jan 31, 2024 GO-2024-2653 +8 more

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Changes in this version

+ type GRPCRouteInput struct

+ Client client.Client

+ Ctx context.Context

+ GRPCRoute *gatewayv1alpha2.GRPCRoute

+ Grants *gatewayv1beta1.ReferenceGrantList

+ Logger *logrus.Entry

+ func (g *GRPCRouteInput) GetClient() client.Client

+ func (g *GRPCRouteInput) GetContext() context.Context

+ func (g *GRPCRouteInput) GetGVK() schema.GroupVersionKind

+ func (g *GRPCRouteInput) GetGateway(parent gatewayv1.ParentReference) (*gatewayv1.Gateway, error)

+ func (g *GRPCRouteInput) GetGrants() []gatewayv1beta1.ReferenceGrant

+ func (g *GRPCRouteInput) GetHostnames() []gatewayv1beta1.Hostname

+ func (g *GRPCRouteInput) GetNamespace() string

+ func (g *GRPCRouteInput) GetRules() []GenericRule

+ func (g *GRPCRouteInput) Log() *logrus.Entry

+ func (g *GRPCRouteInput) SetAllParentCondition(condition metav1.Condition)

+ func (g *GRPCRouteInput) SetParentCondition(ref gatewayv1beta1.ParentReference, condition metav1.Condition)

+ type GRPCRouteRule struct

+ Rule gatewayv1alpha2.GRPCRouteRule

+ func (g *GRPCRouteRule) GetBackendRefs() []gatewayv1.BackendRef

Sep 20, 2024 GO-2024-3208

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Aug 12, 2024 GO-2024-3208

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Jul 11, 2024 GO-2024-3072 +1 more

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Jun 10, 2024 GO-2024-3072 +1 more

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

May 10, 2024 GO-2024-2922 +2 more

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Apr 11, 2024 GO-2024-2922 +2 more

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Mar 26, 2024 GO-2024-2922 +2 more

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Mar 13, 2024 GO-2024-2666 +3 more

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Feb 13, 2024 GO-2024-2653 +6 more

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Jan 18, 2024 GO-2024-2568 +8 more

  GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium

  GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Dec 11, 2023 GO-2024-2568 +8 more

  GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium

  GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Nov 10, 2023 GO-2024-2568 +8 more

  GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium

  GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Oct 18, 2023 GO-2024-2568 +8 more

  GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium

  GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Sep 11, 2023 GO-2024-2568 +8 more

  GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium

  GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

  GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

  GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium

Aug 31, 2023 GO-2022-0457 +10 more

  GO-2022-0457: Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium

  GO-2022-0458: Improper Privilege Management in Cilium in github.com/cilium/cilium

  GO-2022-0959: Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium

  GO-2023-1643: Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium

  GO-2023-1785: Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium

  GO-2023-2078: Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium

  GO-2023-2079: Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium

  GO-2023-2080: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium

  GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium

  GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium

  GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

Changes in this version

+ func CheckAgainstCrossNamespaceBackendReferences(input Input) (bool, error)

+ func CheckBackendIsExistingService(input Input) (bool, error)

+ func CheckBackendIsService(input Input) (bool, error)

+ func CheckGatewayAllowedForNamespace(input Input, parentRef gatewayv1beta1.ParentReference) (bool, error)

+ func CheckGatewayMatchingHostnames(input Input, parentRef gatewayv1beta1.ParentReference) (bool, error)

+ func CheckGatewayMatchingPorts(input Input, parentRef gatewayv1beta1.ParentReference) (bool, error)

+ func CheckGatewayMatchingSection(input Input, parentRef gatewayv1beta1.ParentReference) (bool, error)

+ func CheckGatewayRouteKindAllowed(input Input, parentRef gatewayv1beta1.ParentReference) (bool, error)

+ type CheckGatewayFunc func(input Input, ref gatewayv1beta1.ParentReference) (bool, error)

+ type CheckRuleFunc func(input Input) (bool, error)

+ type GenericRule interface

+ GetBackendRefs func() []gatewayv1beta1.BackendRef

+ type HTTPRouteInput struct

+ Client client.Client

+ Ctx context.Context

+ Grants *gatewayv1beta1.ReferenceGrantList

+ HTTPRoute *gatewayv1beta1.HTTPRoute

+ Logger *logrus.Entry

+ func (h *HTTPRouteInput) GetClient() client.Client

+ func (h *HTTPRouteInput) GetContext() context.Context

+ func (h *HTTPRouteInput) GetGVK() schema.GroupVersionKind

+ func (h *HTTPRouteInput) GetGateway(parent gatewayv1beta1.ParentReference) (*gatewayv1beta1.Gateway, error)

+ func (h *HTTPRouteInput) GetGrants() []gatewayv1beta1.ReferenceGrant

+ func (h *HTTPRouteInput) GetHostnames() []gatewayv1beta1.Hostname

+ func (h *HTTPRouteInput) GetNamespace() string

+ func (h *HTTPRouteInput) GetRules() []GenericRule

+ func (h *HTTPRouteInput) Log() *logrus.Entry

+ func (h *HTTPRouteInput) SetAllParentCondition(condition metav1.Condition)

+ func (h *HTTPRouteInput) SetParentCondition(ref gatewayv1beta1.ParentReference, condition metav1.Condition)

+ type HTTPRouteRule struct

+ Rule gatewayv1beta1.HTTPRouteRule

+ func (t *HTTPRouteRule) GetBackendRefs() []gatewayv1beta1.BackendRef

+ type Input interface

+ GetClient func() client.Client

+ GetContext func() context.Context

+ GetGVK func() schema.GroupVersionKind

+ GetGateway func(parent gatewayv1beta1.ParentReference) (*gatewayv1beta1.Gateway, error)

+ GetGrants func() []gatewayv1beta1.ReferenceGrant

+ GetHostnames func() []gatewayv1beta1.Hostname

+ GetNamespace func() string

+ GetRules func() []GenericRule

+ Log func() *logrus.Entry

+ SetAllParentCondition func(condition metav1.Condition)

+ SetParentCondition func(ref gatewayv1beta1.ParentReference, condition metav1.Condition)

+ type TLSRouteInput struct

+ Client client.Client

+ Ctx context.Context

+ Grants *gatewayv1beta1.ReferenceGrantList

+ Logger *logrus.Entry

+ TLSRoute *gatewayv1alpha2.TLSRoute

+ func (t *TLSRouteInput) GetClient() client.Client

+ func (t *TLSRouteInput) GetContext() context.Context

+ func (t *TLSRouteInput) GetGVK() schema.GroupVersionKind

+ func (t *TLSRouteInput) GetGateway(parent gatewayv1beta1.ParentReference) (*gatewayv1beta1.Gateway, error)

+ func (t *TLSRouteInput) GetGrants() []gatewayv1beta1.ReferenceGrant

+ func (t *TLSRouteInput) GetHostnames() []gatewayv1beta1.Hostname

+ func (t *TLSRouteInput) GetNamespace() string

+ func (t *TLSRouteInput) GetRules() []GenericRule

+ func (t *TLSRouteInput) Log() *logrus.Entry

+ func (t *TLSRouteInput) SetAllParentCondition(condition metav1.Condition)

+ func (t *TLSRouteInput) SetParentCondition(ref gatewayv1beta1.ParentReference, condition metav1.Condition)

+ type TLSRouteRule struct

+ Rule gatewayv1alpha2.TLSRouteRule

+ func (t *TLSRouteRule) GetBackendRefs() []gatewayv1beta1.BackendRef