[TakGN]

What

The last step of the CVE-2026-98432 rollout on sf and sf2:

• group_vars/infra_boxes/main.yml: the default cve_2026_98432_mode goes from count to enforce, so sf2 joins sf.
• host_vars/sf/firewall.yml is deleted. sf now gets enforce from the group default, so nothing changes for it.
• README: the sf/sf2 paragraph pointed at a test from outside on port 5222. Enforce the CVE-2026-98432 filter on every ipfs_nodes box #23 found that the paths tried so far drop IP options before they reach a box, so it now points at the on-box test, which user can run without sudo.

With this, every box in the inventory enforces.

History

• 2026-10-30 16:09 / 16:14 UTC: sf and sf2 start counting. Nothing matches on either box.
• 16:26 UTC: sf enforces alone (Enforce the CVE-2026-98432 filter on sf #25, applied by CI).
• The ipfs_nodes boxes have enforced since about 13:20 UTC. Each dropped the same 6 option-carrying packets, a scan by the look of it.

What the merge does

The cve dry run should show, on sf2 only, the ruleset going from count to enforce, plus the reload:

-		meta nfproto ipv4 meta l4proto tcp ip hdrlength != 5 counter comment "cve-2026-98432 ipv4 options"
+		meta nfproto ipv4 meta l4proto tcp ip hdrlength != 5 counter drop comment "cve-2026-98432 ipv4 options"
-		tcp flags & syn == syn tcp option mptcp exists counter comment "cve-2026-98432 mptcp"
+		tcp flags & syn == syn tcp option mptcp exists counter reset tcp option mptcp comment "cve-2026-98432 mptcp"
+		tcp flags & syn == syn tcp option mptcp exists counter drop comment "cve-2026-98432 mptcp repeated"

sf should show no change. Locally, every box resolves to enforce, and a dry run shows sf's ruleset unchanged and sf2's exactly as above. Loading it is one nft transaction on its own table and restarts nothing.

Before merging

Merge once sf has held up under enforce:

• Its drop counter stays at 0 or takes a scan-sized jump:

  ssh -t ipni-sf1 'sudo nft list table inet cve_2026_98432'

• The indexer and ingest look normal.

To undo on a box: sudo systemctl stop cve-2026-98432-filter.

The real fix is still Debian's 6.1.190-1 kernel and a reboot on both boxes, then cve_2026_98432_mode: off.

🤖 Generated with Claude Code