The system must prevent local applications from generating source-routed packets.

An XCCDF Rule

Description

<VulnDiscussion>Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-216157r603268_rule
Severity: Low
References: CCI-000366
Updated: 9 months ago

The root role is required.

# pfedit /etc/ipf/ipf.conf 

For Solaris 11, 11.1, 11.2, and 11.3 that use IP Filter dd rules to block outgoing source-routed packets, such as:
block out log quick all with opt lsrr 
block out log quick all with opt ssrr

Reload the IPF rules.

# ipf -Fa -A -f /etc/ipf/ipf.conf   

For Solaris 11.3 or newer that use Packet Filter remove or modify any rules that include "allow-opts".

Reload the Packet Filter rules:
# svcadm refresh firewall:default

The system must prevent local applications from generating source-routed packets.

Description

Remediation - Manual Procedure