documentation_complete: true

title: 'Configure Kernel Parameter for Accepting Source-Routed Packets for All Interfaces'

description: '<sysctl-desc-macro sysctl="net.ipv6.conf.all.accept_source_route" value="0" />'

rationale: |-
    Source-routed packets allow the source of the packet to suggest routers
    forward the packet along a different path than configured on the router, which can
    be used to bypass network security measures. This requirement applies only to the
    forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
    the system is functioning as a router.

    Accepting source-routed packets in the IPv6 protocol has few legitimate
    uses. It should be disabled unless it is absolutely required.

severity: medium

identifiers:
    cce: RHEL6-CCE-TBD

references:
    disa: 366
    nist: AC-4

ocil: '<sysctl-check-macro sysctl="net.ipv6.conf.all.accept_source_route" value="0" />'
