From 61dc5c87f24f0de4af25b11777bd8820b795ceb6 Mon Sep 17 00:00:00 2001 From: Takwa Date: Fri, 30 Oct 2026 17:22:22 +0100 Subject: [PATCH] Enforce the CVE-2026-98432 filter on sf sf goes first among the ipni/infra boxes, as sing-1 did for the others: it drops IPv4 TCP with IP options and strips MPTCP from SYNs, while sf2 keeps counting. Both counted nothing from 16:09 and 16:14 UTC on 2026-10-30; sing-1, lith-1 and chic-1, enforcing since 13:20, have dropped 6 option-carrying packets each, a scan by the look of it. Once sf has held up, set enforce in group_vars/infra_boxes and delete this file. Co-Authored-By: Claude Opus 5.5 --- host_vars/sf/firewall.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 host_vars/sf/firewall.yml diff --git a/host_vars/sf/firewall.yml b/host_vars/sf/firewall.yml new file mode 100644 index 0000000..45515bc --- /dev/null +++ b/host_vars/sf/firewall.yml @@ -0,0 +1,7 @@ +--- +# CVE-2026-98432: sf is the canary for enforce among the ipni/infra boxes. It +# drops IPv4 TCP with IP options and strips MPTCP from SYNs, while sf2 still +# only counts (group_vars/infra_boxes). Both counted nothing from 2026-10-30 +# 16:09 UTC (sf) and 16:14 (sf2). Once sf has held up, set enforce in +# group_vars/infra_boxes and delete this file. +cve_2026_98432_mode: enforce