documentation_complete: true

prodtype: rhel7,fedora

title: 'Configure Kernel Parameter to Use Reverse Path Filtering by Default'

description: '<sysctl-desc-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />'

rationale: |-
    Enabling reverse path filtering drops packets with source addresses
    that should not have been able to be received on the interface they were
    received on. It should not be used on systems which are routers for
    complicated networks, but is helpful for end hosts and routers serving small
    networks.

severity: medium

identifiers:
    cce@rhel7: 80168-8

references:
    cis: 3.2.7
    cui: 3.1.20
    nist: AC-4,SC-5,SC-7

ocil: '<sysctl-check-macro sysctl="net.ipv4.conf.default.rp_filter" value="1" />'
