From fdfd241e2fa8f596aef1dc1fc3c4d56ce4c08bdd Mon Sep 17 00:00:00 2001 From: Takwa Date: Fri, 30 Oct 2026 14:28:52 +0100 Subject: [PATCH] Enforce the CVE-2026-98432 filter on sing-1 sing-1 is the canary: it drops IPv4 TCP carrying IP options and strips MPTCP from SYNs, while lith-1 and chic-1 keep counting. Once it has held up, enforce goes into group_vars and this file goes away. Co-Authored-By: Claude Opus 5.5 --- host_vars/sing-1/firewall.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 host_vars/sing-1/firewall.yml diff --git a/host_vars/sing-1/firewall.yml b/host_vars/sing-1/firewall.yml new file mode 100644 index 0000000..9ce320e --- /dev/null +++ b/host_vars/sing-1/firewall.yml @@ -0,0 +1,6 @@ +--- +# CVE-2026-98432: sing-1 is the canary for enforce. It drops IPv4 TCP with IP +# options and strips MPTCP from SYNs, while lith-1 and chic-1 still only count +# (group_vars). Once sing-1 has held up, set enforce in group_vars and delete +# this file. +cve_2026_98432_mode: enforce