From: Christian Pointner <equinox@realraum.at>
Date: Mon, 17 Jun 2019 21:39:27 +0000 (+0200)
Subject: Merge pull request #63 from realraum/sack-workaround
X-Git-Url: https://git.realraum.at/?p=noc.git;a=commitdiff_plain;h=5781177efd71f54e20308c9fd83647214f6e080a;hp=f75744856ad223a1dce0e6cacac0455302afc03a

Merge pull request #63 from realraum/sack-workaround

ansible/base: Workaround SACK DoS ([NFLX-2019-001])
---

diff --git a/ansible/roles/base/tasks/06net.yml b/ansible/roles/base/tasks/06net.yml
index 04e33cd..e257b9b 100644
--- a/ansible/roles/base/tasks/06net.yml
+++ b/ansible/roles/base/tasks/06net.yml
@@ -24,5 +24,10 @@
     # C.f. https://queue.acm.org/detail.cfm?id=3022184
     net.ipv4.tcp_congestion_control: bbr
 
+    # Disable Selective Acknowledgement (SACK)
+    # Workaround CVE-2019-11477, CVE-2019-11478, CVE-2019-11479
+    # See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
+    net.ipv4.tcp_sack: 0
+
   loop_control:
     label: "{{ item.key }}"