[TakGN]

Stacked on #24. Merge #24 first, then point this PR at main before merging it. The repo doesn't delete merged branches, so GitHub won't retarget it by itself, and merged as it stands it would land in #24's branch, where CI never applies anything:

gh pr edit 25 --base main

Merging it into main is what applies enforce to sf, once a reviewer approves it in production.

What

host_vars/sf/firewall.yml sets cve_2026_98432_mode: enforce for sf alone. sf2 keeps counting through group_vars/infra_boxes. This is the same canary step sing-1 took before #23 made enforce the default for the other boxes.

The change on sf, from a dry run of the ruleset:

-		meta nfproto ipv4 meta l4proto tcp ip hdrlength != 5 counter comment "cve-2026-98432 ipv4 options"
+		meta nfproto ipv4 meta l4proto tcp ip hdrlength != 5 counter drop comment "cve-2026-98432 ipv4 options"
-		tcp flags & syn == syn tcp option mptcp exists counter comment "cve-2026-98432 mptcp"
+		tcp flags & syn == syn tcp option mptcp exists counter reset tcp option mptcp comment "cve-2026-98432 mptcp"
+		tcp flags & syn == syn tcp option mptcp exists counter drop comment "cve-2026-98432 mptcp repeated"

Loading it is one nft transaction on its own table. It restarts nothing.

Why now, not after an hour of counting

• sf and sf2 counted zero. No IP-option packets and no MPTCP SYNs, sf since 16:09 UTC and sf2 since 16:14 UTC on 2026-10-30.
• The other three boxes see almost nothing either. sing-1, lith-1 and chic-1 have enforced since about 13:20 UTC. Each dropped the same 6 option-carrying packets (360 bytes): one scan across three continents, by the look of it. They stripped MPTCP from 2–5 SYNs each; those connections went ahead as plain TCP.
• It's instant to undo: sudo systemctl stop cve-2026-98432-filter deletes the table.

Reviewer notes

• What to approve. This PR's cve dry run, run as ipni-ci, should show exactly the ruleset diff above on sf, plus the reload, and nothing on sf2. A local dry run without sudo also listed the CI account's tasks, but only because a non-root user can't read the account's key and sudoers file to compare them.
• site.yml's dry run also runs. It treats any host_vars/ change as its own, but sf isn't in ipfs_nodes, so it should change nothing.
• After it's applied, watch the drop counter for a while: ssh -t ipni-sf1 'sudo nft list table inet cve_2026_98432'. Then set enforce in group_vars/infra_boxes/main.yml for sf2 and delete this file.

🤖 Generated with Claude Code