UCF STIG Viewer Logo

The system must not forward IPv4 source-routed packets.


Overview

Finding ID Version Rule ID IA Controls Severity
V-226888 GEN003600 SV-226888r603265_rule Medium
Description
Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.
STIG Date
Solaris 10 SPARC Security Technical Implementation Guide 2022-09-07

Details

Check Text ( C-29050r484948_chk )
Determine the type of zone that you are currently securing.
# zonename

If the zone is not the global zone, determine if any interfaces are exclusive to the zone:
# dladm show-link

If the output indicates "insufficient privileges" then this requirement is not applicable.

If the zone is the global zone or the non-global zone has exclusive interfaces verify the network settings:

# ndd /dev/ip ip_forward_src_routed
If the returned value is not 0, this is a finding.
Fix Text (F-29038r484949_fix)
Configure the system to not forward IPv4 source-routed packets.
Procedure:
# ndd /dev/ip ip_forward_src_routed 0

This command must also be added to a system startup script.