HAProxyIPOptionsMitigationMissing

Overview

The HAProxy VMs run an nftables rule, managed by the gitlab-server::nft_cve_2026_98432 Chef recipe, that drops IPv4 TCP packets carrying IP options. It mitigates CVE-2026-98432. A cron job exports the rule’s drop counter every 5 minutes to /opt/prometheus/node_exporter/metrics/nft_cve_2026_98432.prom. When the cve_2026_98432 table is not loaded, the file is still written but is empty.

This alert fires when that file exists on a host but has had no drop counter for 15 minutes. The host is most likely not mitigated.

Chef does not fix this by itself: it only reloads the table when the rules file changes, so a table removed out of band (for example by nft flush ruleset, or a manual nft delete table) stays missing while Chef keeps succeeding. The Chef alerts (ChefClientError, ChefClientStale, ChefClientDisabled) don’t catch it.

Services

• Service Overview
• Owner: Production Engineering: Networking & Incident Management
• Label: gitlab-com/gl-infra/production~“Service::HAProxy”

Diagnosis

On the affected node (the fqdn label), check whether the table is loaded and what the exporter writes:

sudo nft list table inet cve_2026_98432
cat /opt/prometheus/node_exporter/metrics/nft_cve_2026_98432.prom
sudo systemctl status nft-cve_2026_98432

• The table is missing: go to Remediation.
• The table is loaded but the file is empty: the exporter can’t read the counter. Run sudo /usr/local/sbin/nft_cve_2026_98432_metrics.sh and check its output.

Remediation

Reload the table from its rules file, and confirm the drop rule is back:

sudo systemctl reload-or-restart nft-cve_2026_98432
sudo nft list table inet cve_2026_98432

The alert resolves after the next export, within 5 minutes.

Then find out what removed the table, so it doesn’t happen again:

sudo journalctl --since "2 hours ago" | grep -iE 'nft|nftables'

If it was removed by another tool or service, raise it with SIRT in the CVE-2026-98432 channel.