documentation_complete: true

prodtype: rhel7,fedora

title: 'Configure Kernel Parameter for Accepting Source-Routed Packets for All Interfaces'

description: '<sysctl-desc-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />'

rationale: "Source-routed packets allow the source of the packet to suggest routers\nforward the packet along a different path than configured on the router, which can\nbe used to bypass network security measures. This requirement applies only to the\nforwarding of source-routerd traffic, such as when IPv4 forwarding is enabled and \nthe system is functioning as a router.\n<br /><br />\nAccepting source-routed packets in the IPv4 protocol has few legitimate\nuses. It should be disabled unless it is absolutely required."

severity: medium

identifiers:
    cce@rhel7: 27434-0

references:
    cis: 3.2.1
    cui: 3.1.20
    disa: 366
    nist: AC-4,CM-7,SC-5
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "040610"

ocil: '<sysctl-check-macro sysctl="net.ipv4.conf.all.accept_source_route" value="0" />'
