Skip to content
ATO Pathways
  Log In

Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

An XCCDF Rule

Description

To set the runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter, run the following command: 

$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: 
net.ipv6.conf.default.accept_source_route = 0

Rationale

Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router. Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required.

ID
xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition: