From 3d413976c3e069998e15008a051acc9581beccba Mon Sep 17 00:00:00 2001 From: Takwa Date: Fri, 30 Oct 2026 17:36:07 +0100 Subject: [PATCH] Enforce the CVE-2026-98432 filter on sf2 too enforce becomes the infra_boxes default, so sf2 joins sf, and sf's canary file goes. Both counted nothing from 16:09 UTC on 2026-10-30; sf has enforced alone since 16:26 (#25). With this, every box in the inventory enforces. The README's sf/sf2 paragraph pointed at a test from outside on 5222. The paths tried so far drop IP options before they reach a box (#23), so it now points at the on-box test, which needs no sudo. Co-Authored-By: Claude Opus 5.5 --- README.md | 5 +++-- group_vars/infra_boxes/main.yml | 6 ++++-- host_vars/sf/firewall.yml | 7 ------- 3 files changed, 7 insertions(+), 11 deletions(-) delete mode 100644 host_vars/sf/firewall.yml diff --git a/README.md b/README.md index c990f08..3861ec3 100644 --- a/README.md +++ b/README.md @@ -184,8 +184,9 @@ machine it signs in as their shared `user` account on port 5222, whose sudo wants its password, so it takes `-K`: `ansible-playbook cve.yml -K --check --diff -l sf`, then without `--check`. Their mode is `cve_2026_98432_mode` in `group_vars/infra_boxes/main.yml`, -rolled out the same way: `count`, then `enforce` one box at a time. To test -from outside, use 5222. Both run Debian 12 with nft 1.0.6, and both have +rolled out the same way: `count`, then `enforce` one box at a time; both +enforce since 2026-10-30. To prove it, use the on-box test above as `user` +(no sudo needed to run it). Both run Debian 12 with nft 1.0.6, and both have loaded the enforce ruleset in a throwaway namespace. The real fix is Debian's `6.1.190-1` kernel and a reboot. diff --git a/group_vars/infra_boxes/main.yml b/group_vars/infra_boxes/main.yml index 07ad3ce..52d05a9 100644 --- a/group_vars/infra_boxes/main.yml +++ b/group_vars/infra_boxes/main.yml @@ -16,5 +16,7 @@ infra_ci_pubkey_file: "{{ playbook_dir }}/keys/github-actions.pub" # The same switch as group_vars/ipfs_nodes (see its comment), set separately so # these boxes go through count before enforce on their own schedule. Override -# per box in host_vars to enforce one before the other. -cve_2026_98432_mode: count +# per box in host_vars to enforce one before the other. Both counted from +# 2026-10-30 16:09 UTC (nothing matched), then sf enforced alone from 16:26 +# before this became the default. +cve_2026_98432_mode: enforce diff --git a/host_vars/sf/firewall.yml b/host_vars/sf/firewall.yml deleted file mode 100644 index 45515bc..0000000 --- a/host_vars/sf/firewall.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# CVE-2026-98432: sf is the canary for enforce among the ipni/infra boxes. It -# drops IPv4 TCP with IP options and strips MPTCP from SYNs, while sf2 still -# only counts (group_vars/infra_boxes). Both counted nothing from 2026-10-30 -# 16:09 UTC (sf) and 16:14 (sf2). Once sf has held up, set enforce in -# group_vars/infra_boxes and delete this file. -cve_2026_98432_mode: enforce