From 6a35065be688fe449120d09045b90ad1ad681386 Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Wed, 10 Jun 2026 18:45:43 +1000
Subject: [PATCH 16/23] CVE-2026-58224: ctdb-doc: Emphasise that the private network must be
 private

Note that the difference in the first couple of lines is leading
whitespace being switch to a TAB.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/doc/ctdb.7.xml | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/ctdb/doc/ctdb.7.xml b/ctdb/doc/ctdb.7.xml
index be2dd5e5b65..9087acf9870 100644
--- a/ctdb/doc/ctdb.7.xml
+++ b/ctdb/doc/ctdb.7.xml
@@ -242,14 +242,25 @@
 	services provided by the cluster.
       </para>
       <para>
-        It is strongly recommended that the private addresses are
-        configured on a private network that is separate from client
-        networks.  This is because the CTDB protocol is both
-        unauthenticated and unencrypted.  If clients share the private
-        network then steps need to be taken to stop injection of
-        packets to relevant ports on the private addresses.  It is
-        also likely that CTDB protocol traffic between nodes could
-        leak sensitive information if it can be intercepted.
+	It is strongly recommended that the private addresses are
+	configured on a private network that is separate from client
+	networks.  This is because <emphasis>the CTDB protocol is both
+	unauthenticated and unencrypted</emphasis>.  If clients share
+	the private network then steps need to be taken to stop
+	injection of packets to relevant ports on the private
+	addresses.  It is also likely that CTDB protocol traffic
+	between nodes could leak sensitive information if it can be
+	intercepted or manipulated.
+      </para>
+      <para>
+	In summary, the private network should not be accessible by
+	untrusted sources.  We can't say "must not" because this can't
+	be enforced by CTDB, so we can only make a strong
+	recommendation. However, for this reason, future bugs in the
+	CTDB protocol used over the private network will be fixed as
+	regular bugs without following the Samba security process.
+	The same is true of local CTDB protocols used for Unix domain
+	socket and other communication.
       </para>
 
       <para>
-- 
2.43.0


