documentation_complete: true

prodtype: rhel7

title: 'Configure Kernel Parameter for Accepting Source-Routed Packets for All Interfaces'

description: '<sysctl-desc-macro sysctl="net.ipv6.conf.all.accept_source_route" value="0" />'

rationale: |-
    Source-routed packets allow the source of the packet to suggest routers
    forward the packet along a different path than configured on the router, which can
    be used to bypass network security measures. This requirement applies only to the
    forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
    the system is functioning as a router.
    <br /><br />
    Accepting source-routed packets in the IPv6 protocol has few legitimate
    uses. It should be disabled unless it is absolutely required.

severity: medium

identifiers:
    cce@rhel7: 80179-5

references:
    cui: 3.1.20
    disa: 366
    nist: AC-4
    srg: SRG-OS-000480-GPOS-00227
    stigid@rhel7: "040830"

ocil: '<sysctl-check-macro sysctl="net.ipv6.conf.all.accept_source_route" value="0" />'
